Notice and consent under the DPDP Act
When India's DPDP Act lets you use personal data, what a valid notice and a valid consent need, and what to do when your purposes change.
Before you ask for consent under the DPDP Act, you give a notice. Here is what the notice and the consent need.
Not legal advice
This page is a summary, not legal advice. It leaves out detail and exceptions, and the law may change. Read the Act and the Rules, and ask your own counsel.
When you may use personal data#
You may process personal data only for a lawful purpose (section 4(1)). You also need the person's consent, or one of the "legitimate uses" listed in section 7 of the Act.
Examples of legitimate uses are:
- data a person gave you voluntarily for a stated purpose
- a duty under law to disclose information to the State
- a medical emergency
- employment
How the product helps. Each purpose names its basis. A purpose that is not based on consent names the clause of section 7 it relies on. The hosted privacy notice shows that basis to people in India.
Which basis is right is your decision. See Add purposes.
What a valid notice needs#
You give a notice before or with every request for consent (section 5(1), Rule 3). The notice must:
- stand on its own, and be understandable without reading anything else
- be in clear and plain language
- list the personal data, item by item
- state each purpose, and describe the goods, services or uses the processing makes possible
- give the link to your website or app, and any other means, by which the person can withdraw consent, use their rights and complain to the Board
- be available in English or any of the 22 languages in the Eighth Schedule to the Constitution, as the person chooses (section 5(3))
The request for consent must also give contact details: those of your Data Protection Officer, or of another person who answers questions about the processing (section 6(3)).
How the product helps. Where a DPDP region rule applies, the banner itself lists each purpose with its description and its data. It carries your contact, a Your rights link and a complaint link. When the form has more than one language, it also shows a language chooser.
A form shown under a DPDP rule cannot be published while one of these is missing:
- the description or the data of a purpose based on consent
- the complaint link
- the privacy contact
See Write the notice and Add a language.
What valid consent needs#
Consent must be free, specific, informed, unconditional and unambiguous. The person gives it by a clear affirmative action. It covers only the purpose named, and only the personal data needed for that purpose (section 6(1)).
If consent is ever questioned in a proceeding, you have to prove two things. You gave the notice, and the person consented (section 6(10)).
How the product helps. A region rule under the DPDP Act is always opt in. Nothing optional runs before the person chooses, and pre-ticked defaults are ignored.
Reject all sits beside Accept all in the same style. A form that hides it cannot be published while an opt-in rule serves it, and the DPDP Act check fails it.
Each answer is sealed with the exact version of the notice shown. You can export it as a signed receipt. See Choose regions and How consent is proven.
When your purposes change#
Neither the Act nor the Rules has a separate rule on changing a notice. Consent is given for a specified purpose (section 6(1)). So a new purpose or new personal data is generally read as needing a new notice and a new consent. That is a reading of the text, not a stated rule.
How the product helps. When you publish a new version, returning visitors are asked again, and shown what changed, after any of these:
- a new purpose
- a new partner
- a changed category or legal basis
- a decision on a purpose that lasts longer
A wording fix does not ask anyone again. Adding to the Data used of a purpose is not detected, so choose Ask everyone again for that. You can override either way. See Ask visitors again.
An example#
Kaveri Stores shows its shop banner in India under a DPDP region rule. The banner lists Analytics and Marketing, each with its description and its data.
Meera Iyer allows Analytics and declines Marketing. Her consent record keeps both answers, with version 2 of the form.
Later the shop adds a Personalisation purpose and publishes version 3. On her next visit Meera sees the banner again, with a note of what changed.