// Compliance Guide
DPDPA 2023 Consent Notice Requirements
A step-by-step statutory implementation guide for Indian Data Fiduciaries under Section 6(1) and Rule 3 of the Digital Personal Data Protection Act, 2023.
Statutory Foundation: Section 6(1) & Rule 3
Under Section 6(1) of the Digital Personal Data Protection Act, 2023 (DPDPA), every request for consent presented by a Data Fiduciary to a Data Principal must be accompanied or preceded by an explicit, standalone notice. Vague terms of service or bundled acknowledgments do not satisfy statutory scrutiny.
Rule 3 of the DPDP Rules specifies the exact operational format of this notice. The notice must be unbundled, presented in clear and plain language, and made accessible in English and all 22 languages specified in the Eighth Schedule to the Constitution of India.
Mandatory Contents of a Compliant Consent Notice
1. Specified Personal Data Categories
The notice must enumerate exactly what personal data is being gathered (e.g. name, email, phone number, location, device telemetry, cookies). Blanket statements such as 'any data required for our services' are non-compliant.
2. Explicit Processing Purpose
State the precise, lawful purpose for which each category of data will be processed. Each purpose must be granular and unbundled so the Data Principal can make an informed choice.
3. One-Click Withdrawal Mechanism
The notice must clearly explain how the Data Principal may withdraw their consent at any time, with an ease comparable to giving consent (as mandated by Section 6(4)).
4. Grievance Officer Contact Information
Provide the contact details (name, email, and communication address) of the Data Protection Officer (DPO) or the designated grievance redressal representative.
5. Right to File a Complaint with the Board
The notice must state that the Data Principal has the right to file a formal complaint with the Data Protection Board of India if their grievance is not resolved satisfactorily.
The 22 Eighth Schedule Languages Requirement
India's DPDPA introduces an unprecedented mandate: Data Principals must be offered the choice to access the consent notice in English or any of the 22 languages listed in the Eighth Schedule to the Constitution of India (including Hindi, Tamil, Bengali, Telugu, Marathi, Kannada, Malayalam, and Gujarati).
SYRA Data's Notice Generator automates this multi-language requirement, generating standardized, legally vetted notice clauses across regional languages so businesses do not have to manually commission 22 separate legal translations.
How to Implement Compliant Notices: Step-by-Step
Audit Digital Data Ingestion Points
Identify every form, registration workflow, cookie banner, and mobile app screen where personal information is requested.
Draft Granular, Unbundled Purpose Clauses
Separate optional marketing trackers from essential functional cookies, and bind each purpose to an affirmative action.
Integrate Grievance and Withdrawal Links
Ensure the notice links directly to your DPO contact and an accessible consent management dashboard.
Deploy Multi-Language Toggles
Provide an accessible language switcher allowing the visitor to view the full notice in their preferred Indian language.
Frequently Asked Questions
Can a consent notice be embedded within a website's general Terms of Service?
No. Section 6(1) requires the notice to be presented separately or accompanied by a distinct request. Bundling consent inside general terms of service violates the statutory requirement for explicit, unbundled consent.
What happens if a Data Fiduciary collects data without a compliant Section 6(1) notice?
Collecting personal data without the requisite statutory notice constitutes unlawful processing under DPDPA 2023, exposing the Data Fiduciary to penalties of up to ₹50 crore under the Schedule of the Act.
Does the notice requirement apply to existing users whose data was collected prior to DPDPA?
Yes. Section 6(2) mandates that for personal data collected before the Act's commencement, Data Fiduciaries must issue a retrospective notice as soon as reasonably practicable.
Related Compliance Guides
Audit Your Website's Consent Notice Today
Run a free website compliance scan with SYRA Data to instantly identify missing Section 6(1) notice clauses, unconsented trackers, and language gaps.