Consent notices · DPDP S. 5, S. 6, S. 9 · Rules 3 and 10

DPDP consent notices, one purpose at a time.

Build the notice your customer sees before you use their data. Write it once, show it in 23 languages, and collect a separate choice for each purpose on your website, in your forms or by email.

Book a demo→ What the law asks

23: languages: English and the 22 Eighth Schedule languages
3: notice modes: cookie banner, form panel, email request
5: steps to build a notice, with no code

Figure 1. A notice with itemised data, a purpose-level choice and a retention period for each purpose. Sample content.

What the law asks

What does the DPDP Act ask of a consent notice?

The notice must come before or with the request for consent. Rule 3 sets what it must contain. Section 6 sets what makes the consent valid.

Requirement	Source	What it means	How Promiz helps
Notice before or with the request	S. 5(1)	You must give a notice when you ask for consent.	Every consent is tied to the exact notice version shown.
Stand-alone, plain language	Rule 3	The notice must make sense on its own, in clear and plain words.	Content step with field-level guidance on where each text appears.
Itemised data and specific purpose	Rule 3	List the personal data and each purpose, with the goods or services involved.	Purposes with data categories, goods or services, and a description in every language.
Withdraw as easily as you consented	S. 6(4) · Rule 3	Give a link to withdraw, with the same ease as giving consent.	Floating button on your site and a "Manage my consent" link to the privacy portal.
How to use rights and complain	Rule 3	Explain how to exercise rights and how to complain to the Board.	Grievance officer and Board complaint text shown from Organization Settings.
English or an Eighth Schedule language	S. 5(3)	The person can read the notice in English or any of the 22 listed languages.	23 languages, by hand or with auto-translation, switchable on screen.
Free, specific, clear consent	S. 6(1)	Consent needs a clear affirmative action for a specific purpose.	No pre-ticked boxes. Essential and optional purposes are handled apart.
Verifiable consent for children	S. 9 · Rule 10	A parent or guardian must give verifiable consent for a child's data.	Guardian age check through DigiLocker, and child-restriction flags on purposes.

Sources: Digital Personal Data Protection Act, 2023, sections 5, 6 and 9; DPDP Rules, 2025 (G.S.R. 846(E)), Rules 3 and 10. These duties apply from May 2027.

In Promiz

How do you build a notice in Promiz?

The notice builder asks only for what the chosen mode shows. You can preview each change before you publish.

Figure 2. The five-step notice builder.

Step 1 Choose the mode
Cookie banner for your site, form panel for sign-up or KYC, or an email request for a customer who is not online.
Step 2 Write the binding text
This exact text is fingerprinted and stored with every consent.
Step 3 Add purposes
Record legal basis, data categories, source, receiving teams, retention and child flags.
Step 4 Design and translate
Use the preference-center builder, then translate by hand or with auto-translation.
Step 5 Publish and connect
Add the website script, attach the notice to a form, or send an email request.

Capabilities

What can you control in a notice?

Three notice modes

A cookie banner with Accept all, Reject all and Manage preferences. A form panel tied to email or phone. An email with a secure, single-use link that expires after the period you set.

Purposes that belong to the notice

Each purpose lives on its own notice, so a KYC form and a marketing banner never share wording by accident. You record legal basis, data, source, teams, retention and whether it is essential.

Preference-center builder

Set colours, logo, layout, button styles and a floating "manage preferences" button. A live preview updates as you edit.

Versions you can trace

Every change saves a new version. You can open the history for the notice, for one language, or for one purpose.

Identity checks

Turn on email OTP or SMS OTP on the notice. The setting applies to every language, so they never drift apart.

Children and guardians

Where a purpose needs it, Promiz adds an age step and verifies the guardian as an adult through DigiLocker. The verified reference is stored with the consent.

Tag gating on your website

Scripts tied to a purpose run only after that purpose is allowed. The banner shows again only when the choice expires or the notice changes.

Completeness checks

The review step and the dashboard tell you when a notice or its translations are incomplete.

Compare

Why not write the notice in a document and a form?

Task	Email, spreadsheets and a basic banner	Promiz
Show the notice in the customer's language	One English PDF	Same notice in 23 languages, switchable on screen
Prove which wording a person saw	Not possible after edits	Fingerprinted text and version on each record
Separate choice per purpose	One "I agree" box	A switch for each optional purpose
Stop tags before consent	Tags fire on page load	Tags wait until their purpose is allowed
Consent from a customer who is offline	Phone call, no record	Email request with a single-use link

FAQ

Consent notices: frequent questions

Not answered here? Ask us in a demo.

What must a DPDP consent notice contain?

Under Rule 3, the notice must be clear and plain, make sense on its own, list the personal data and each specified purpose with the goods or services involved, and give a way to withdraw consent, exercise rights and complain to the Data Protection Board.

Which languages does Promiz support for notices?

English and the 22 languages in the Eighth Schedule of the Constitution. You translate by hand or with background auto-translation, and customers switch language on screen.

Do cookie banners need consent under the DPDP Act?

The Act does not name cookies. If a cookie or tracker processes personal data for a purpose that needs consent, the notice and consent duties apply. Promiz blocks tagged scripts until their purpose is allowed. Your legal team decides which trackers need consent.

How does Promiz handle consent for children?

A purpose can require guardian consent and can carry child-restriction flags. Promiz verifies the guardian as an adult through DigiLocker and stores the verified reference with the consent.

What happens to old consents when we edit a notice?

Each edit saves a new version. Older records keep the version the customer agreed to, so your proof does not change.

Bring one purpose. Leave with a working notice.

In 30 minutes we build a notice for one of your purposes, collect a consent and show you the record.

Book a 30-minute demo→ We reply within 1 business day.

This page explains the law in plain words. It is not legal advice. Your legal team decides how the Act applies to you. Last reviewed 21 September 2026.