DPDP consent notice template
you can actually ship.
A working template for the notice required under Section 5, with the clauses the Act asks for, the fields you have to fill in, and guidance on the Eighth Schedule languages. Free to copy and adapt.
Last updated Published by TryTrustableNot legal advice
What the notice has to contain
Section 5 asks for a specific set of things. A notice that misses one of them is incomplete however well written the rest is.
| Required element | What good looks like |
|---|---|
| The personal data being collected | Itemised, not a category. "Name, email, phone number" rather than "contact information". |
| The purpose of processing | One line per purpose, in the words a user would use. If you cannot say the purpose plainly, you probably cannot justify it. |
| How to exercise rights | A route, not an intention. A link or an address that reaches a person who can act. |
| How to withdraw consent | Named and reachable from where consent was given, at the same granularity. |
| How to complain to the Board | The Data Protection Board's complaint route, stated plainly. |
From 13 May 2027, Rule 3 of the DPDP Rules 2025 adds to this. The notice must make sense on its own without reference to other documents, itemise the personal data, describe the goods, services or uses the processing enables, and give a link to your website or app through which the person can withdraw consent, exercise their rights and complain to the Board. The DPDP Act and Rules 2025 guide covers the rest of the timetable.
The template
Replace everything in square brackets. Keep it this short: length is not thoroughness, and a notice nobody reads is a notice you cannot rely on.
We collect and use your personal data as set out below. WHAT WE COLLECT AND WHY • Account details (name, email, phone): to create and run your account. • Usage data (pages viewed, actions taken): to keep the service working and improve it. • Payment details: to process your payments. Handled by our payment processor. HOW LONG WE KEEP IT For as long as your account is open, and for [X months] afterwards, unless the law requires us to keep it longer. YOUR RIGHTS You can ask us for a summary of the data we hold about you, ask us to correct or erase it, and nominate someone to exercise these rights on your behalf. You can withdraw your consent at any time, as easily as you gave it. HOW TO REACH US [Name / role], [email]. We will respond within [X] days. IF YOU ARE NOT SATISFIED You may complain to the Data Protection Board of India at [Board contact route].
Need this in Hindi, Tamil, Telugu, Bengali or Marathi? We maintain translations for customers and will send the current set on request: admin@trytrustable.com.
The Eighth Schedule question
The Eighth Schedule to the Constitution lists 22 languages: Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu and Urdu. The Act requires your notice to be available in English or any of them.
Two things follow. First, translation is a content problem you can solve once. Second, and less obviously, the language shown becomes part of the evidence. If a person read the notice in Tamil and consented, the record needs to say Tamil. A consent record without a language field cannot answer the question the Board would ask.
Versioning, which is the part that gets skipped
Notices change. Purposes get added, vendors get swapped, retention periods move. If your consent records point at "the notice" rather than a version of it, then every historical consent silently re-points at today's text, and you have no way to show what a person actually agreed to in 2024.
Stamp a version on the notice, store that version on every consent record, and keep old versions readable. It costs nothing at build time and is unrecoverable afterwards. This is what our consent ledger does by default, and it is available on its own as Consent by TryTrustable, a standalone consent management platform.
If some of your users will reach you through a registered Consent Manager rather than your own banner, your notice still has to exist and still has to be versioned: the Consent Manager carries it to the person, it does not write it for you. The guide to DPDP Consent Managers explains how the two fit together. Before you publish, scan your site for trackers that fire before consent, because a notice is undermined by tags that load before anyone reads it.
The things people ask us
Can we just translate our GDPR privacy policy?
Not as a notice. A GDPR privacy policy is a long reference document; a DPDP notice is a short, itemised statement given at or before collection, tied to the specific purposes you are asking consent for. Keep the policy, and write the notice separately.
Which of the 22 languages do we actually need?
The Act requires the notice to be available in English or any Eighth Schedule language. The practical test is your own user base: if a meaningful share of your users read Hindi, Tamil or Bengali, offering the notice only in English is hard to defend. Start with English plus the two or three languages your support tickets already arrive in.
Do we need a new consent every time we add a purpose?
Yes. Consent is specific to the purposes stated in the notice. A new purpose needs a new notice and a fresh consent, which is why versioning the notice matters: it is how you show which purposes a given consent actually covered.
What does 'as easy to withdraw as to give' mean in practice?
If consent took one tap in a banner, withdrawal cannot take an email to support and a three-day wait. A visible preferences link on every page, with the same granularity as the original choice, is the defensible implementation. From 13 May 2027, Rule 3 also requires the notice to give a link through which consent can be withdrawn.
Ship the notice, then prove it was read.
The template gets you to a compliant notice. The ledger gets you to a defensible one: every choice recorded against the notice version and language that produced it.