Editor's note: This briefing was originally published before the DPDP Rules, 2025 were notified. It has been reviewed and updated in March 2026 to reflect the notified Rules and phased implementation.
The DPDPA mandates that every consent request must be accompanied by a clear, standalone notice. Generic 'I agree to T&Cs' checkboxes are no longer sufficient. Here is what Indian businesses must implement.
Your consent notice is the first place many businesses will fail DPDPA in practice. If your form does not clearly explain what data you collect, why you collect it, and what the person is agreeing to, your consent process is already weak. This briefing explains what your forms must say from day one. Most Indian business websites currently bundle consent into Terms and Conditions, which the DPDPA explicitly prohibits. If your sign-up form, enquiry form, or checkout page uses pre-checked boxes or bundled consent language, you are operating outside the framework of the Act. Rectifying this during the phased implementation window is significantly easier than retrofitting it under active regulatory scrutiny.
Businesses collecting personal data through websites, apps, or offline forms must redesign their consent flows. This affects customer acquisition, CRM onboarding, newsletter subscriptions, lead generation forms, and employee data collection. Penalties for non-compliant consent or notice fall under the Schedule's residual category — breach of any other provision of the Act — and can reach up to ₹50 crore (Schedule Item 7).
Under Section 5(1) of the Digital Personal Data Protection Act, 2023, every request for consent must be accompanied or preceded by a 'notice' from the Data Fiduciary to the Data Principal. This notice must be itemised, clear, and in plain language. It must specify exactly what data is being collected, the purpose for which it is being processed, how the individual can exercise their rights, and how they can complain to the Data Protection Board. Crucially, under Section 6(1) consent must be free, specific, informed, unconditional, and unambiguous — meaning each distinct purpose requires a separate consent signal. You cannot combine marketing consent with transaction processing consent in the same checkbox.
Audit every form on your website and mobile app for consent language
Remove pre-checked consent boxes immediately
Separate marketing consent from service delivery consent
Add a purpose statement to each consent item
Link to your Privacy Notice from every consent point
Log consent with timestamp, IP, and privacy notice version
Test your consent withdrawal mechanism works end-to-end
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →मुफ़्त डाउनलोड
संपूर्ण DPDPA अनुपालन गाइड
आसान भाषा में। DPDP Rules 2025 समझने के लिए आपके व्यवसाय को जो कुछ चाहिए — फ़ाउंडर्स के लिए लिखा गया, वकीलों के लिए नहीं। अब 7 भारतीय भाषाओं में।
गाइड डाउनलोड करें →5 तैयार टेम्पलेट
सिर्फ़ पढ़िए नहीं — अनुपालन शुरू कीजिए
प्राइवेसी नोटिस, सहमति की भाषा, डेटा इन्वेंटरी, DSR SOP, वेंडर रजिस्टर। आपके ईमेल पर, मुफ़्त।
2-min reads, plain English, every morning. Free forever.
