DPDP Rules, 2025 are now in effect. See where your business stands, in 3–5 minutes.Find out — free →
Editor's note: This briefing was originally published before the DPDP Rules, 2025 were notified. It has been reviewed and updated in March 2026 to reflect the notified Rules and phased implementation.
The DPDPA mandates that every consent request must be accompanied by a clear, standalone notice. Generic 'I agree to T&Cs' checkboxes are no longer sufficient. Here is what Indian businesses must implement.
Your consent notice is the first place many businesses will fail DPDPA in practice. If your form does not clearly explain what data you collect, why you collect it, and what the person is agreeing to, your consent process is already weak. This briefing explains what your forms must say from day one. Most Indian business websites currently bundle consent into Terms and Conditions, which the DPDPA explicitly prohibits. If your sign-up form, enquiry form, or checkout page uses pre-checked boxes or bundled consent language, you are operating outside the framework of the Act. Rectifying this during the phased implementation window is significantly easier than retrofitting it under active regulatory scrutiny.
Businesses collecting personal data through websites, apps, or offline forms must redesign their consent flows. This affects customer acquisition, CRM onboarding, newsletter subscriptions, lead generation forms, and employee data collection. Penalties for non-compliant consent can reach up to ₹250 crore per instance of non-compliance.
Under Section 6 of the Digital Personal Data Protection Act, 2023, every Data Fiduciary must provide a 'notice' to the Data Principal before or at the time of collecting personal data. This notice must be itemised, clear, and in plain language. It must specify exactly what data is being collected, the purpose for which it is being processed, and how the individual can exercise their rights. Crucially, consent must be free, specific, informed, unconditional, and unambiguous — meaning each distinct purpose requires a separate consent signal. You cannot combine marketing consent with transaction processing consent in the same checkbox.
Audit every form on your website and mobile app for consent language
Remove pre-checked consent boxes immediately
Separate marketing consent from service delivery consent
Add a purpose statement to each consent item
Link to your Privacy Notice from every consent point
Log consent with timestamp, IP, and privacy notice version
Test your consent withdrawal mechanism works end-to-end
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
