Consent Notices & Data Collection Documentation
A consent notice is the short statement a business gives a person when it asks to use their personal data. Under the Digital Personal Data Protection Act, 2023, every request for consent must come with a notice saying what data will be processed and why, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board of India.
Consent under section 6 has to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. The business carries the burden of proving that it gave the notice and obtained the consent. These duties apply from 13 May 2027.
When you need it
When building sign-up and checkout flows
The notice and the consent action are part of the product’s design, and are easier to build in than to add later.
When forms collect more than they need
Consent covers only data necessary for the stated purpose. Extra fields have to be justified or removed.
When one tick-box covers everything
A single consent bundled with the terms of service, covering marketing and sharing as well, does not meet the Act.
When the service is used by under-18s
Children’s data needs verifiable consent from a parent, and tracking and targeted advertising aimed at children are barred.
When there is an existing database
People whose data was collected on consent before the Act applies have to be sent a notice as soon as reasonably practicable.
How the process works
Five stages. Timings are typical, not promised.
- 1
Map the collection points
One to two weeksList every place where personal data is collected: website forms, app screens, cookies, call centres, paper forms and data received from partners.
Documents
- Screenshots of forms and sign-up flows
- The current privacy policy
- A list of the purposes data is used for
- 2
Decide the ground for each purpose
About a weekFor each purpose, decide whether it needs consent or falls within a legitimate use under section 7, such as data given voluntarily for a stated purpose, or employment.
- 3
Draft the notices
One to two weeksWrite a notice for each collection point that can be understood on its own, with an itemised description of the data and the specific purpose, and working links to withdraw consent, exercise rights and complain.
- 4
Design the consent action and the record
With the product teamSpecify how consent is given, by an unticked box or a clear button, kept separate for each purpose, and what record is stored: who, when, which notice and which version.
- 5
Withdrawal and existing data
Before the duties applyBuild a way to withdraw that is as easy as giving consent, decide what stops when consent is withdrawn, and plan the notice to people already in the database.
Common questions
It must be free, specific, informed, unconditional and unambiguous, shown by a clear affirmative action, and it covers only the personal data necessary for the purpose stated in the notice. Silence, pre-ticked boxes and consent hidden in general terms do not qualify.
Under Rule 3, it must be understandable independently of anything else, and give an itemised description of the personal data, the specified purpose and the goods or services it enables, with the means to withdraw consent, exercise rights and complain to the Board.
The person must have the option to read the notice, and the request for consent, in English or in any language listed in the Eighth Schedule to the Constitution.
No. Section 7 lists legitimate uses that need no consent, including data a person provides voluntarily for a specified purpose without objecting, compliance with a law or court order, medical emergencies and purposes of employment.
At any time, and the Act requires withdrawing to be as easy as giving consent. After withdrawal the business must stop processing within a reasonable time, and have its processors stop, unless another law requires the processing.
For anyone under eighteen, section 9 requires verifiable consent from a parent or lawful guardian before processing. Tracking, behavioural monitoring and advertising targeted at children are prohibited, subject to exemptions in the Rules.
A company registered with the Data Protection Board through which a person can give, manage, review and withdraw consent across different businesses. Registration opens on 13 November 2026. Using one is optional for a business.
Yes. Commercial messages and calls are also regulated by the telecom regulator’s rules on unsolicited commercial communication, which have their own consent and registration requirements.
Related
To discuss consent notices, write to info@ireniclegal.com or call +91 96547 47331. Written by Adv. Kanika Marwaha Bindal; last updated 7 October 2026.