DPDP Act Consent Notice for a Data Fiduciary
The DPDP Act has rewritten the consent-notice expectation. A privacy policy buried in a footer no longer satisfies the law — the notice has to be standalone, clear and itemised.
Introduction
The DPDP Act, 2023 has reset the baseline for personal-data collection in India. Consent must be free, specific, informed, unconditional, unambiguous; obtained through clear affirmative action; preceded by — not buried inside — a notice that itemises categories, purposes, and rights.
When to Use This Prompt
- Any new product, service or feature collecting personal data of Indian residents.
- Onboarding flows for apps, websites, SaaS, connected devices.
- Change in categories of data or purposes.
- New processor or cross-border transfer.
Statutory & Case-Law Backdrop
Section 5 requires a notice in clear and plain language. Section 6 sets out conditions of valid consent and the right to withdraw. Section 11+ enumerates data-principal rights. Rules (separately notified) prescribe form and content.
The Prompt
Paste into ChatGPT, Claude or Gemini. Replace every bracketed placeholder with your specific facts before generating.
Draft a consent notice and capture mechanism for [COMPANY] (Data Fiduciary) compliant with Sections 5 and 6 of the DPDP Act, 2023. Inputs: - Categories of personal data collected: [DETAILS] - Specified purposes: [DETAILS] - Means of processing: [IN-HOUSE / PROCESSOR — IDENTIFY] - Sharing / cross-border transfer: [DETAILS] - Retention and deletion: [DETAILS] - Grievance Officer: [NAME, EMAIL] The notice must be in plain language, given separately at or before consent, in English plus one Eighth Schedule language. Include itemised purposes, rights of data principal (access, correction, erasure, grievance, nomination), withdrawal mechanism, grievance contact.
Anatomy of the Draft
Why the prompt is built the way it is — section by section.
Itemised data-purpose pairing
Each category paired with the specific purpose. Bundled consent does not satisfy specificity.
Rights of data principal
Access, correction, erasure, grievance, nomination — each with a working mechanism.
Withdrawal mechanism
As easy as giving consent. Customer-service-only withdrawal does not satisfy proportionality.
Grievance Officer and language
Named officer with email and response timelines. English plus an Eighth Schedule language.
Common Mistakes to Avoid
- ×Combining consent with terms of service.
- ×Generic purpose language.
- ×Difficult withdrawal flows.
- ×Missing or non-functional grievance officer.
- ×Failing to update on changes.
Frequently Asked Questions
Implied consent valid?+
No. Section 6 requires clear affirmative action. Pre-ticked boxes are unlawful.
Children's data special rules?+
Yes — Section 9 requires verifiable parental consent and prohibits behavioural monitoring of children.
Penalties?+
Up to Rs. 250 crores per instance depending on the contravention.
Final Thoughts
DPDP compliance starts with the consent notice and the workflow that captures consent. Itemised, plain-language, multi-lingual, with a working withdrawal flow.
Disclaimer
This article is for informational and drafting-aid purposes only. It is not legal advice. AI-generated drafts must be reviewed by qualified counsel before filing or being relied upon. Verify every citation and statutory reference against the original source.
Related Prompts in Notices & Compliance
Legal Notice for Breach of Contract
Pre-litigation notice demanding performance or damages within 15 days.
RTI Application under Section 6 RTI Act
Crisp RTI request with specific, time-bound queries to the PIO.
Consumer Complaint before District Commission
Consumer Protection Act 2019 complaint with deficiency in service grounds.