Consent notices under Section 5 and Rule 3: what a valid notice must contain
This explainer is also published on dpdpa.support. Every section, rule and date was checked against the official text on 4 Oct 2026.
Under the Digital Personal Data Protection Act, 2023, a Data Fiduciary (the person or business deciding why and how personal data is processed) cannot ask for consent without also giving a notice. Section 5(1) requires every request for consent under Section 6 to be accompanied or preceded by a notice. Rule 3 of the DPDP Rules, 2025 sets out what that notice must contain and how it must be presented. If the notice falls short, the consent built on it is open to challenge.
What Section 5(1) requires
The notice must tell the Data Principal:
(i) the personal data and the purpose for which it is proposed to be processed;
(ii) how she may exercise her rights under Section 6(4), to withdraw consent, and Section 13, to grievance redressal; and
(iii) how she may make a complaint to the Data Protection Board of India.
Section 5(1) adds that this must be done “in such manner and as may be prescribed”. Rule 3 is that prescription.
What Rule 3 adds
Rule 3 sets three requirements, in clauses (a), (b) and (c).
(a) It must stand on its own. The notice must be presented, and be understandable, independently of any other information you have made, are making or may make available. In practice, the minimum content belongs in the notice itself rather than behind a link to a longer privacy policy.
(b) It must give a fair account in clear and plain language. It must include the details the person needs to give specific and informed consent, and at the minimum:
an itemised description of the personal data; and
the specified purpose or purposes, with a specific description of the goods or services to be provided, or the uses to be enabled, by the processing.
(c) It must give the way in and the ways out. It must give the particular communication link to your website or app, or both. It must also describe any other means by which the person can:
withdraw her consent, with the ease of doing so comparable to the ease with which she gave it;
exercise her rights under the Act; and
make a complaint to the Board.
Language and contact details
Section 5(3) requires you to give the person the option to read the notice in English or in any language specified in the Eighth Schedule to the Constitution, which lists India’s scheduled languages. Section 6(3) applies the same language option to the consent request itself and requires it to be in clear and plain language. The request must also give the contact details of a Data Protection Officer, where applicable, or of another person you have authorised to respond to communications about her rights.
Checklist for a draft notice
The notice… comes with or before the consent request. Source: Section 5(1)
The notice… is understandable on its own, without other documents. Source: Rule 3(a)
The notice… uses clear and plain language. Source: Rule 3(b); Section 6(3)
The notice… lists the personal data item by item. Source: Rule 3(b)(i)
The notice… states each specific purpose and what the processing provides or enables. Source: Rule 3(b)(ii); Section 5(1)(i)
The notice… gives your website or app link. Source: Rule 3(c)
The notice… explains how to withdraw consent, as easily as it was given. Source: Rule 3(c)(i); Section 6(4)
The notice… explains how to exercise rights and use grievance redressal. Source: Rule 3(c)(ii); Section 5(1)(ii)
The notice… explains how to complain to the Board. Source: Rule 3(c)(iii); Section 5(1)(iii)
The notice… can be read in English or any Eighth Schedule language. Source: Section 5(3)
The notice… gives a contact for rights questions (the request carries this). Source: Section 6(3)
Rule 3 does not list retention periods or recipients in its minimum. Including them can build trust, but they are your choice rather than part of the legal test.
A good notice does not rescue bad consent
Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. The Act’s own illustration is a telemedicine app that asks for both health-service processing and access to the user’s phone contacts. Because the contact list is not necessary for the service, the consent is limited to the telemedicine processing.
Section 6(2) makes any part of a consent that infringes the Act, the Rules or any other law invalid to that extent. Its illustration is an insurance customer asked to consent to waiving her right to complain to the Board; that part is invalid.
Section 6(10) puts the burden on you. If consent is the basis of processing and a question arises in a proceeding, the Data Fiduciary must prove that a notice was given and that consent was given in line with the Act and the Rules. Keep the notice version shown, the time, and the action the person took.
Consent you already hold: Section 5(2)
Where a person gave consent before the date of commencement, Section 5(2)(a) requires you to give her a notice as soon as reasonably practicable. It must cover the data and the purpose for which it has been processed, how to exercise her rights under Sections 6(4) and 13, and how to complain to the Board. Section 5(2)(b) lets you continue processing until she withdraws consent.
Section 1(2) reads “commencement” in a provision as the date that provision comes into force. Section 5 comes into force on 13 May 2027 under clause (c) of G.S.R. 843(E). On that reading, every consent collected before 13 May 2027, including any you collect from today, needs a Section 5(2) notice. The DPDP Act commencement timeline sets out what else starts that day.
Where a notice is not tied to consent
Section 5(1) attaches the notice to requests for consent. Section 4(1) allows processing on two grounds: consent, or certain legitimate uses listed in Section 7. If a processing activity rests on a legitimate use, test it against that ground on its own terms instead of assuming the consent-notice rules settle it.
Start date, and where to begin
Sections 5 and 6 (other than Section 6(9)) and Rule 3 apply from 13 May 2027 (Rule 1(4) for the Rule). Draft notices from your data map: one row per purpose, with the data items and the legal basis, makes the itemised description in Rule 3(b) straightforward to write.
Sources
Every section, rule and date above was checked against the official text on 4 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
Section 1(2): "Commencement" read as the date each provision comes into force
Section 4(1): Consent or certain legitimate uses
Section 5(1): Notice with or before every consent request
Section 5(2): Notice for consent given before commencement
Section 5(3): English or any Eighth Schedule language
Section 6(1): Valid consent; telemedicine illustration
Section 6(2): Infringing parts of consent invalid; insurance illustration
Section 6(3): Plain language, language option and contact details in the consent request
Section 6(4): Withdrawal as easy as giving consent
Section 6(9): Consent Manager registration (separate start date)
Section 6(10): Data Fiduciary must prove notice and consent
Section 7: Certain legitimate uses
Section 13: Grievance redressal
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
Rule 1(4): Rule 3 in force eighteen months from publication
Rule 3: Notice: (a) stands alone; (b) itemised data and specific purposes; (c) link, withdrawal, rights, complaint
Notifications
G.S.R. 843(E), clause (c): Sections 5 and 6 (except 6(9)) in force eighteen months from 13 November 2025
Write the notice section by section
How-to 05 is a consent notice template built on Section 5(1) and Rule 3, filled from the rows of your data map whose legal basis is consent. It marks what goes beyond the Rule 3 minimum.
The how-to walkthroughs and the editable Word and Excel files are in the DPDPA Compliance Toolkit program on this site. The version of this article that we keep up to date is on dpdpa.support.
Drafting aid, not legal advice.
Comments