Consent Docs
Open console

DPDP duties for notice and consent

Each DPDP Act duty about notice, consent, withdrawal and earlier consent, with what PIEDAP Consent does and what remains yours.

Reference10 min readFor anyone looking something up

Each duty about notice, consent and withdrawal under India's DPDP Act, 2023 and DPDP Rules, 2025, with what the product does and what remains yours.

Confirm the citations

Where the product cites a section or rule in its own messages, this page uses the same citation. This is not legal advice. Confirm each citation with your counsel.

How to read the tables#

  • Duty is a short version of the section or rule beside it. Read the text itself before you rely on it.
  • A DPDP rule is an enabled region rule under the DPDP law, the preset for India.
  • You are the Data Fiduciary. The product processes consent records for you.
  • Rule 3 and sections 5 and 6 apply from 13 May 2027. DPDP rule set lists every date with its Gazette source.

Notice#

Duty Section or rule What the product does What remains yours
Give a notice with or before every request for consent. It must stand on its own and use clear, plain language. Section 5(1); Rule 3(a), (b) The banner and preference centre carry the notice for each purpose. Under a DPDP rule the first layer lists every purpose with its description and data items. Wording that is plain and true. The product does not check reading level.
Itemise the personal data. Rule 3(b)(i) Each purpose has Data used items. They show under the purpose in the banner and on the hosted privacy notice. Listing the data you really process.
State the specified purpose and the goods, services or uses it enables. Rule 3(b)(ii) Each purpose has a name and a description, in each language. An accurate description.
Say how to withdraw, use rights and complain to the Board. Section 5(1)(ii) to (iii); Rule 3(c) The preference centre withdraws. Under a DPDP rule the banner carries a Your rights link to the hosted request form, the complaint link and the privacy contact. The hosted privacy notice names the Data Protection Board of India and says a grievance comes first (section 13(3)). Setting the complaint link and keeping it up to date.
Give the contact of the Data Protection Officer, or of another person who answers, in every request for consent. Section 6(3) Under a DPDP rule the banner shows the privacy contact's email and phone, and who handles grievances, from Project settings. The phone and grievance officer need runtime 1.0.7 or later. Naming a real contact and answering the mail.
Offer the notice in English or any Eighth Schedule language. Section 5(3), 6(3) Under a DPDP rule the banner and preference centre show a language chooser when the form is published in more than one language. Built-in labels and starter wording exist for all 22 languages, and the hosted pages use the same languages. Urdu, Kashmiri and Sindhi render right to left. Machine translation can draft empty fields. A language other than the form's default is published only after a person approves it. Reviewing each language before approving it. The built-in Indian-language labels and starter wording have not been reviewed by native speakers.

What publishing checks#

The product checks a form served under a DPDP rule when you publish it. It checks again when you create or enable the rule for a published form. It refuses with DPDP_NOTICE_INCOMPLETE while any of these is missing:

Missing Applies to Citation in the message
Data used items Each purpose based on consent Rule 3(b)(i)
A description Each purpose based on consent Rule 3(b)(ii)
A real choice: the purpose must not be always on Each purpose based on consent Section 6(1)
The section 7 clause relied on Each purpose not based on consent Section 4(1)
The complaint link The form Section 5(1)(iii); Rule 3(c)(iii)
The privacy contact email Project settings Section 6(3)

Part of the answer when a publish is refused:

JSON
{
  "statusCode": 400,
  "code": "DPDP_NOTICE_INCOMPLETE",
  "errorData": {
    "missing": [
      "the data used by Course updates by email (Rule 3(b)(i))",
      "a privacy contact email in Settings (section 6(3))"
    ]
  }
}

Under any enabled opt-in rule, whatever its law, publishing also refuses a form that hides Reject all, with REJECT_ALL_REQUIRED. Saving an opt-in rule for such a form is refused the same way. errorData.rules names the rules that serve it.

Duty Section or rule What the product does What remains yours
Process only for a lawful purpose, on consent or a legitimate use in section 7. Section 4(1), 7 Each purpose names its basis. A purpose not based on consent names the clause of section 7, (a) to (i), it relies on. The hosted notice shows people in India "Consent" or "Legitimate use (section 7(x) of the DPDP Act)". Choosing the right clause and being able to defend it.
Consent is free, specific, informed, unconditional and unambiguous. It is given by a clear affirmative action and limited to the data the purpose needs. Section 6(1) The DPDP preset is opt-in: nothing optional runs before a choice, and pre-ticked defaults are ignored. A DPDP rule cannot be saved as opt-out or notice-only (DPDP_REQUIRES_OPT_IN). Reject all sits beside Accept all in the same style. A form that hides it cannot be published while an opt-in rule serves it (REJECT_ALL_REQUIRED), and the DPDP Act check fails it. A person can answer purpose by purpose and, where the form offers it, partner by partner. Not making a service conditional on consent it does not need. Keeping each purpose to the data it needs.
Prove that notice was given and consent obtained, if it is questioned. Section 6(10) Every decision is sealed with the exact form version shown, chained, anchored daily and exportable as a signed receipt. Consent taken in a branch, by phone or on paper can carry a sealed capture context: the channel, how the person confirmed and a reference to your evidence. The product records the method your system reports and does not check it. Keeping the link from your own identifier to the person. Identifiers are stored only as keyed hashes unless you turn on Store a reversible subject identifier. Keeping your copy of the daily anchors. Keeping the one-time password log, recording or signed form a capture reference points to.

How consent is proven describes the seal, the chain and the anchors.

Withdrawal#

Duty Section or rule What the product does What remains yours
Allow withdrawal at any time, with the same ease as giving consent. Section 6(4); Rule 3(c)(i) The privacy button and any data-piedap-open link reopen the choices. Under a DPDP rule the button stays on unless the page has its own data-piedap-open link. People can also withdraw in the consent portal and on the hosted request form. Your server can withdraw everything a person agreed to with POST /sdk/v1/subjects/withdraw (scope subjects:withdraw). Each withdrawal is a sealed event. Keeping a visible way back to the choices on every page and screen.
Stop processing within a reasonable time, and make your Data Processors stop. Section 6(6) The runtime passes the new choice to tags that accept one. It deletes the known first-party cookies of the withdrawn purposes and holds their tags from then on. A script that already ran keeps running until the visitor leaves the page. A consent.withdrawn webhook tells your systems whom it concerns: the identifier type, the subject fingerprint, and the identifier itself if the project stores a readable copy. Your systems can ask the consent check before they process. It answers withdrawn from the moment the withdrawal is recorded. For each partner registered as a Data Processor, the product writes a stop task with a due date, lists it in the webhook and tracks what was reported. Calling the consent check before you process, or subscribing an endpoint to consent.withdrawn. Stopping the processing in your systems. Passing each instruction to the processor and recording what it reported.

Registration of Consent Managers with the Board opens on 13 November 2026. Section 6(7) and (10) apply from 13 May 2027.

Duty Section or rule What the product does What remains yours
Let a person give, review and withdraw consent through a registered Consent Manager. Section 6(7); section 2(g) Consent Managers, under Properties, lists those you accept, each with its Board registration number, its own key and its status. It sends consent artefacts and withdrawals to /sdk/v1/consent-managers, and can read back the state of an artefact. The contract is versioned and its JSON Schemas are public. No national interface has been published; the format is the product's own. Choosing which Consent Managers to accept and checking that each is registered with the Board. Agreeing with each which notice and purposes it asks about.
Prove that notice was given and consent obtained. Section 6(10) An artefact is written through the same sealed path as any consent, against the notice version it names. The record's source is CONSENT_MANAGER, and the seal carries the Consent Manager and the artefact id. The identifier is hashed on arrival. Keeping your agreement with the Consent Manager, and the notice it showed.
Act on a withdrawal made through a Consent Manager, as easily as on one made with you. Sections 6(4), 6(6) A withdrawal by artefact or by identifier goes through the normal withdrawal: consent.withdrawn, stop tasks for your Data Processors, and the consent check answers withdrawn. A suspended Consent Manager can still send withdrawals. Stopping the processing in your systems, as for any withdrawal.
Keep the Consent Manager in step when the person changes their mind with you. Section 6(7); First Schedule, Part B A change or withdrawal made elsewhere is sent to the Consent Manager that issued the artefact, signed like a webhook. A notification that cannot be delivered raises consent_manager.notification_failed. Telling the Consent Manager another way when a notification fails.

Accept consent from a Consent Manager sets one up.

Duty Section or rule What the product does What remains yours
Tell people again, or ask again, when the privacy policy changes. Sections 5, 6 Publishing a policy asks whether the change is wording only or material. Forms linked to it that show an earlier version are listed with their current records, with Republish and ask again and a link to start a notice campaign. A policy.published webhook names them. See Update the privacy policy. Deciding whether a change is material. Asking again or telling people.
Give the notice, as soon as reasonably practicable, to people who consented before the Act commenced. Section 5(2) Publishing a new form version with re-consent shows the notice again to returning visitors and records their new answer. You can import consent you collected earlier, from a CSV file in Records or from your server. It carries the date it was given, can be marked as given before the Act, and can name the notice the person saw. An import never replaces a newer answer, a withdrawal or an erasure. A notice campaign sends one published notice version to a list of people as single-use links that your own systems deliver. It records who was sent which version, who acknowledged and who withdrew, under signed daily roots, and leaves out people you erased. Deciding which earlier consents were given before the Act, and keeping your original proof of them. Delivering the links through a channel you own. Choosing the mode and each person's basis with your counsel. Reviewing the page wording.

↑↓ to move, Enter to open