DPDP Act India: Notice and Consent Explained

DPDP Act India: start with commencement

For a DPDP Act India compliance plan, the first question is whether a provision is in force. As of 25 October 2026, the principal notice, consent and children’s-data duties discussed below remain preparation items under India’s phased commencement timetable. The enacted text is essential for designing compliant processes, but enactment alone does not make every duty operative.

The Digital Personal Data Protection Act, 2023 (DPDP Act) permits different provisions to commence on different dates. Commencement notification G.S.R. 843(E) of 13 November 2025 (see the official Act record) brought sections 1(2), 2, 18 to 26, 35, 38 to 43, and 44(1) and 44(3) into force on that date. Sections 6(9) and 27(1)(d), concerning Consent Manager registration and the Board’s response to breaches of registration conditions, are scheduled to commence on 13 November 2026. The remaining provisions, including sections 3 to 5, section 6(1) to (8) and (10), and sections 7 to 17, are scheduled to commence on 13 May 2027. That later group includes the notice duty in section 5 and the children’s-data duties in section 9.

The separately notified Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E) of 13 November 2025) also have a phased timetable. Under rule 1, rules 1, 2 and 17 to 21 took effect on publication; rule 4 is scheduled to take effect on 13 November 2026; and rules 3, 5 to 16, 22 and 23 are scheduled for 13 May 2027. The fact that the Board-related Rules are in force does not, by itself, bring the later notice and consent requirements into force.

For implementation, maintain two workstreams: obligations already in force and systems being prepared for later duties. Other applicable Indian laws and contractual commitments still require separate attention.

Map the Data Fiduciary before mapping notices

Under section 2 of the DPDP Act, a Data Fiduciary is a person who, alone or together with others, determines the purpose and means of processing personal data. A Data Processor processes personal data on behalf of a Data Fiduciary. In a corporate group or vendor arrangement, those roles turn on who makes the relevant processing decisions, not simply on which entity stores the data or supplies the software.

Build a processing-purpose register for customer, employee, vendor, prospect and user-data flows. For each flow, record:

• the entity determining the purpose and means of processing;
• the personal data, purpose and collection channel;
• the systems and processors involved;
• the proposed notice and consent interface, where consent is the intended basis; and
• the commencement status of the relevant requirement.

This register is a practical implementation tool, not a prescribed statutory form. It also helps counsel distinguish consent-based processing from processing that may fall within section 7’s specified legitimate uses; not every processing activity calls for a consent request.

What a DPDP Act notice must cover

Under section 5(1) of the DPDP Act, a request for consent under section 6 must be accompanied or preceded by a notice. The notice must tell the Data Principal what personal data is proposed to be processed and for what purpose, how to exercise the rights to withdraw consent and seek grievance redressal, and how to complain to the Data Protection Board, in the prescribed manner. Section 5(2) also addresses notice for certain processing based on consent given before the Act’s commencement.

Rule 3 of the Digital Personal Data Protection Rules, 2025, scheduled for 13 May 2027, specifies how the notice is to be presented and what information it must contain. It calls for a notice understandable independently of other information, with an itemised description of the personal data, the specified purpose and the goods or services to be provided or uses to be enabled by the processing, together with routes for withdrawing consent, exercising rights and making a complaint.

For each proposed consent journey, ask whether a person can identify the data, purpose, and goods, services or uses enabled by the processing before deciding; find the relevant rights and complaint routes; and read the notice on the actual collection channel. A general privacy policy can provide context, but should not be assumed to replace the notice required for a particular consent request.

Consent and withdrawal: design for the statutory standard

Section 6(1) of the DPDP Act says consent must be free, specific, informed, unconditional and unambiguous, expressed through clear affirmative action. It must relate to a specified purpose and be limited to the personal data necessary for that purpose. These are the standards against which proposed consent journeys should be designed, rather than a reason to treat the provision as already operative on 25 October 2026.

Section 6(3) of the DPDP Act requires a consent request to be in clear and plain language, with the option to access it in English or a language in the Eighth Schedule to the Constitution. It also requires contact details for a Data Protection Officer, where applicable, or another person authorised to respond to rights-related communications. Counsel should test bundled choices, preselected settings and broad purpose descriptions against these requirements before launch.

Section 6(4) gives a Data Principal whose data is processed on the basis of consent the right to withdraw it at any time, with ease comparable to giving it. Under section 6(6), the Data Fiduciary must then cease, and cause its Data Processors to cease, the relevant processing within a reasonable time, unless continued processing without consent is required or authorised by law. Withdrawal does not undo processing lawfully carried out on consent before withdrawal.

Section 6(10), scheduled to commence on 13 May 2027, places the burden on the Data Fiduciary to prove, if a question arises in a proceeding where consent is the basis for processing, that the required notice was given and consent was obtained in accordance with the Act and Rules. Retain evidence of the notice version presented, the consent action and any subsequent withdrawal. Test the withdrawal path through authentication, affected systems and processor instructions. The Act does not prescribe a particular logging product or interface.

Consent Managers: distinguish registration from software

The Act defines a Consent Manager as a person registered with the Board who acts as a single point of contact for Data Principals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Section 6 addresses the Data Principal’s use of a Consent Manager and, in section 6(9), the Manager’s registration. A vendor selling consent-management software is not, for that reason alone, a registered Consent Manager; nor does the Act require every organisation to use one.

Section 6(9) and the Board provision in section 27(1)(d) are scheduled to commence on 13 November 2026, as is rule 4 of the Digital Personal Data Protection Rules, 2025, which sets out the registration framework. These dates are distinct from the 13 May 2027 commencement scheduled for the other consent duties in section 6. Before relying on a proposed Consent Manager, distinguish a product’s technical capabilities from its statutory registration status. Meanwhile, organisations can map which systems would need to receive and act on changes to consent status.

Children’s personal data and lawful-guardian consent

Under the DPDP Act, a child is an individual under 18. Section 9 provides for verifiable parental consent before processing a child’s personal data and restricts processing likely to harm a child’s well-being, tracking or behavioural monitoring of children, and targeted advertising directed at them. The Act also provides for specified exemptions. Rule 10 addresses verifiable parental consent, while other provisions of the Rules address exemptions. Section 9 and the relevant Rules are scheduled to commence on 13 May 2027.

Separately, section 9(1) requires verifiable consent from the lawful guardian of a person with a disability who has such a guardian before processing that person’s personal data. Rule 11 sets out the procedure for this consent. Both provisions are scheduled to commence on 13 May 2027. Map data flows involving people with disabilities who have lawful guardians and identify where the guardian-consent procedure will be needed.

Inventory account creation, family accounts, education services, games, health services and campaigns that may collect children’s data. Record where age is assessed, whether a parent or lawful guardian is involved, and which processing features may need redesign. Do not assume that an age gate alone satisfies the eventual requirements.

Status on 25 October 2026: current framework and preparation

Provision	Status on 25 October 2026	Practical action
DPDP Act section 5: notice	Scheduled to commence on 13 May 2027.	Map consent requests and legacy consent records; prepare notices against section 5 and rule 3.
DPDP Act section 6(1) to (8) and (10): consent, withdrawal and proof	Scheduled to commence on 13 May 2027.	Design purpose-specific choices, preserve notice and consent evidence, and test withdrawal across systems and processors.
DPDP Act sections 6(9) and 27(1)(d): Consent Manager registration and Board action	Scheduled to commence on 13 November 2026.	Distinguish registered Consent Managers from software providers.
DPDP Act section 9: children’s data and lawful-guardian consent	Scheduled to commence on 13 May 2027.	Map children’s-data flows, relevant lawful-guardian consent flows and features requiring redesign.
DPDP Rules, 2025, rules 1, 2 and 17 to 21	In force from publication under rule 1 of the notified Rules.	Keep the existing framework distinct from later individual-facing requirements.
DPDP Rules, 2025, rule 4: Consent Manager registration	Scheduled to commence on 13 November 2026.	Assess registration status and integration needs before relying on a provider as a Consent Manager.
DPDP Rules, 2025, rule 3: detailed notice; rules 10 to 12: consent procedures and children’s-data exemptions	Scheduled to commence on 13 May 2027.	Prepare notice interfaces and assess parental and lawful-guardian consent against the applicable Act and Rule provisions.

Build a phased compliance plan

1. Maintain a commencement register. Record the applicable Act provision or Rule, its commencement date, the official notification and an internal owner.
2. Map roles and purposes. Identify the Data Fiduciary, processors, data, purpose and systems for each material flow.
3. Prepare notices and consent journeys. Compare live interfaces with sections 5 and 6 and rule 3, while distinguishing future design work from current duties.
4. Test withdrawal end to end. Confirm that a change reaches internal systems and relevant processors, and retain evidence of notices and consent actions.
5. Review children’s-data and lawful-guardian touchpoints. Identify flows that may require parental or lawful-guardian consent, and features needing other changes when the relevant provisions commence.

Where personal data is used in advanced systems, include those uses in the same purpose and vendor mapping exercise. See The Impact of the DPDP Act on Artificial Intelligence in India for related context.

Legal-information disclaimer: This is general information about India’s DPDP framework as of 25 October 2026, not legal advice. Applicable commencement notifications and later changes should be assessed for each implementation decision.

Next step: Explore Lexi’s AI-native legal technology for in-house teams working through vendor contracts, privacy notices and DPDP implementation.