DPDP Guide · Consent
A DPDP notice and DPDP consent are two separate obligations that people constantly merge. Getting the distinction right is the foundation of a compliant consent flow.
In short
A DPDP notice and DPDP consent are two different things. The notice, under Section 5, is the information a Data Fiduciary must give before or when it asks for consent: what personal data it wants, for what specified purpose, and how the individual can withdraw consent or complain. The consent, under Section 6, is the individual's free, specific, informed and unambiguous agreement to that purpose. You cannot obtain valid consent without first giving a compliant notice, but a notice on its own is not consent.
The notice is something you give. The consent is something they give. The notice informs; the consent agrees. One is an act by the Data Fiduciary, the other is an act by the Data Principal, and the law treats them as distinct steps that happen in a specific order.
| Dimension | DPDP Notice | DPDP Consent |
|---|---|---|
| What it is | Information you present to the individual | The individual's agreement to the purpose |
| Statutory basis | Section 5 (and Rule 3 of the DPDP Rules 2025) | Section 6 |
| Who acts | The Data Fiduciary | The Data Principal |
| Timing | Before or at the moment consent is requested | After, or together with, the notice |
| Form | A clear, itemised, standalone statement | A clear affirmative action (tick, toggle, tap) |
| Proof needed | That the notice was shown, and its contents | That agreement was freely and specifically given |
Section 5 requires that the notice accompany or precede every consent request. Rule 3 of the DPDP Rules 2025 adds that it must be clear, understandable, and capable of standing on its own, so an individual can read it independently of any other document. In practice a compliant notice sets out:
The notice must be available in English or any language listed in the Eighth Schedule to the Constitution, at the individual's option.
A privacy policy is not a Section 5 notice. A policy is a broad, background document; the notice is a specific, just-in-time statement tied to the exact purpose you are asking to process for. You can link to your policy from the notice, but the notice itself has to carry the itemised data and purpose.
Consent under Section 6 has to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the specified purpose. Pre-ticked boxes, bundled agreements, and silence do not qualify. The individual must be able to withdraw consent at any time, and withdrawing has to be as easy as giving it was.
Because consent has to be informed, it depends entirely on the notice that came before it. That is why the two obligations are sequenced: the notice supplies the information, and the consent is the agreement to what the notice described. For the full standard, see the valid consent under Section 6 guide.
A compliant flow runs in a fixed order, and each step produces something you may later need to prove.
Notice sits in Section 5; consent sits in Section 6; and Section 6(10) places the burden of proving valid consent on the Data Fiduciary. Most of these obligations take effect on 13 May 2027, so the time to design the sequence is now.
If you cannot show the notice that was displayed and the consent that was captured, you have not met the Section 6(10) burden of proof, regardless of what your database says a user "agreed" to.
No. A privacy policy is a broad transparency document. A DPDP notice under Section 5 is a specific, itemised, just-in-time statement of the exact personal data and purpose tied to a consent request. You can link to the policy from the notice, but the policy does not replace it.
Not always. Consent is one lawful basis. Section 7 lists certain legitimate uses where processing is allowed without consent, though transparency obligations can still apply. When you rely on consent, however, a compliant notice must come first.
The notice must be available in English or any language listed in the Eighth Schedule to the Constitution of India, at the individual's option.
Yes. They can appear together, and often should, as long as the notice content is clear and itemised and the consent is a distinct affirmative action. Combining them on screen is fine; merging them so the individual cannot tell what they are agreeing to is not.
The consent is unlikely to be valid, because consent must be informed and the notice is what informs it. In any proceeding, Section 6(10) puts the burden of proving valid consent on the Data Fiduciary, and without a notice that burden is very hard to meet.
General information about the DPDP Act and Rules, not legal advice, and not affiliated with any government body.