Home › Free tools › DPDP consent notice builder
From 13 May 2027, asking for consent needs a notice that lists each kind of personal data and each purpose, says how to withdraw as easily as consent was given, and how to complain to the Data Protection Board. Tick what you collect and why, and get the notice and the consent boxes.
Leave a box empty if you have not decided yet: the notice marks the place, and the gaps say what is missing.
Consent notice1 Summary
2 The draft notice
3 What this could not check
A draft from your answers, based on section 5 of the Digital Personal Data Protection Act, 2023 and Rule 3 of the DPDP Rules, 2025. Have it checked against what you actually collect, and by a lawyer for regulated sectors. Guidance, not legal advice; see the terms.
The questions people search for before they run the check.
Under Rule 3 of the DPDP Rules, 2025: an itemised description of the personal data, each specified purpose with the goods, services or uses it enables, and the link and other means to withdraw consent, exercise rights and complain to the Data Protection Board, in clear and plain language that stands on its own.
From 13 May 2027, eighteen months after the Rules were published, along with most duties under the Act. Notices and consent flows take time to build, so most organisations start now.
No. Consent must be free, specific and unambiguous, so marketing needs its own box, not ticked in advance, and saying no must not stop someone using the service.
Not on its own. Rule 3 requires the notice to be understandable independently of other information. A short, itemised notice at the point of consent, with a link to the full policy for more, is the usual approach.
No. It is a draft built from your answers, based on the Act and the Rules. Check it against what you actually collect, and with a lawyer for regulated sectors.
A notice has to match what is collected, withdrawal has to work, and consent has to be recorded. That is what the Board will ask to see.