Under Sections 5 and 6 of the DPDP Act, 2023, a notice must tell people, in clear and plain language, what personal data you collect and why, how they can withdraw consent, exercise their rights and complain to the Data Protection Board. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give.
Digital Personal Data Protection Act, 2023
Section 5Notice before or at the time of seeking consent, including for consent obtained before the Act commenced.
Digital Personal Data Protection Act, 2023
Section 6Conditions for valid consent, withdrawal and consent managers.
Digital Personal Data Protection Act, 2023
Section 7Legitimate uses where personal data may be processed without consent.
Digital Personal Data Protection Rules, 2025
Rules 3 and 4Contents of the notice and registration and duties of consent managers.
Section 5 requires a notice either before or at the time of seeking consent. The DPDP Rules, 2025 add that it should be understandable on its own, independent of any other information, and give an itemised description of the personal data and the specific purpose for each item, together with a link or means to withdraw consent, exercise rights and complain to the Board. Bundling it inside long terms of service makes it harder to show the consent was informed.
The Data Principal must be given the option to read the notice in English or in any language listed in the Eighth Schedule to the Constitution. For consumer-facing businesses operating in several states, this usually means offering the notice in the main regional languages of the user base, not just English.
Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to the data necessary for the stated purpose. Pre-ticked boxes, silence or inactivity, or consent made a condition of a service for data that service does not need, are unlikely to qualify. Any part of a consent that infringes the Act or another law is invalid to that extent.
Section 7 lists “legitimate uses” that do not need consent: data a person voluntarily provides for a specified purpose where they have not objected, certain state functions, compliance with a law or court order, medical emergencies and disasters, and employment-related purposes, among others. A legitimate use still has to be documented, and notice, security and retention duties continue to apply.
Only if it meets the Section 5 and 6 standard: an itemised, plain-language notice and a clear affirmative choice per purpose, with an easy way to withdraw. A banner that only says “by continuing you agree” is unlikely to be enough.
You can require consent for data that is actually necessary for the service. Making consent to unrelated processing, such as marketing, a condition of the service is unlikely to be “free” and “unconditional”.
A consent manager is a Board-registered entity that lets people give, manage, review and withdraw consent through an accessible, interoperable platform. Registration provisions apply about a year after the Rules were notified.
The fiduciary, and its processors, must stop processing within a reasonable time and erase the data unless another law requires it to be retained. Processing done before withdrawal remains lawful.
CaseDocker keeps contracts, signatures, stamp papers, notices and compliance deadlines in one place, with reminders before anything lapses.
