DPDPA consent readiness for India
India's Digital Personal Data Protection Act, 2023 makes consent the main basis for processing personal data. The DPDP Rules, 2025 set out how notices must look and when each duty starts.
- Who
- Anyone processing digital personal data in India, or offering goods or services to people in India
- Model
- Opt-in: consent must be given by a clear affirmative action before processing
- Laws
- Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
What the law requires
An itemised notice in plain language
Before asking for consent, give a notice that stands on its own, lists the personal data and the specific purpose for each item, and is written clearly enough to understand without reading anything else.
DPDP Act s.5; DPDP Rules, Rule 3
Consent that is free and specific
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose.
DPDP Act s.6(1)
Withdrawal as easy as giving
People can withdraw consent at any time, and doing so must be comparably easy to giving it. Once withdrawn, processing for that purpose has to stop within a reasonable time.
DPDP Act s.6(4)-(6)
Who to contact
The notice must say how to exercise rights and how to complain to the Data Protection Board, and give the contact details of the Data Protection Officer or the person who answers on your behalf.
DPDP Act s.5(1); s.8(9)
Consent Managers
People can give, manage and withdraw consent through a registered Consent Manager. Your systems should accept consent recorded that way as well as directly.
DPDP Act s.6(7)-(9); DPDP Rules, Rule 4
Keep records and protect them
Data Fiduciaries must be able to show that notice was given and consent obtained, and must take reasonable security safeguards. Breaches can attract penalties of up to ₹250 crore.
DPDP Act s.6(10), s.8(5); Schedule
Notices in all 22 languages
Section 5(3) lets a person read the notice in English or any language in the Eighth Schedule to the Constitution. Plain Theory picks the language from the page and the browser, and lets visitors switch inside the notice.
- অসমীয়াAssamese
- বাংলাBengali
- बड़ोBodo
- डोगरीDogri
- ગુજરાતીGujarati
- हिन्दीHindi
- ಕನ್ನಡKannada
- كٲشُرKashmiri
- कोंकणीKonkani
- मैथिलीMaithili
- മലയാളംMalayalam
- ꯃꯤꯇꯩꯂꯣꯟManipuri
- मराठीMarathi
- नेपालीNepali
- ଓଡ଼ିଆOdia
- ਪੰਜਾਬੀPunjabi
- संस्कृतम्Sanskrit
- ᱥᱟᱱᱛᱟᱲᱤSantali
- سنڌيSindhi
- தமிழ்Tamil
- తెలుగుTelugu
- اردوUrdu
Drafts, then a person signs off. Each language starts as a machine-assisted draft. A native speaker on your team reviews it and marks it reviewed; the reviewer and date are recorded and show up in your Evidence Pack.
Which plans. English and Hindi are on every plan, including Free. All 22 languages are on Starter and above.
Itemised notices
Rule 3 asks for a notice that makes sense on its own and gives, for each purpose, an itemised description of the personal data and what it's used for, along with the goods, services or uses it enables.
In Plain Theory each category carries its own list of data items and how long they're kept. The notice is built from that list, so the words a visitor reads and the data you actually collect come from one place.
- Data items and retention per purpose, edited in the banner builder
- Rights, grievance contact and Data Protection Board link in the notice
- The fairness check flags any optional purpose with no data items listed
Analytics
Optional- Why
- To see which pages are useful and fix the ones that aren't.
- Data collected
- Pages you visit and how long you stay
- Device and browser type
- Approximate location (city)
- Kept for
- 13 months, then deleted
- Change your mind
- Privacy choices button on every page. One tap withdraws.
Consent Manager or consent management platform?
Some vendors suggest every consent tool must register with the Board. That isn't what the Rules say. Only Consent Managers register. A consent management platform like Plain Theory doesn't, and you don't need a Consent Manager to comply.
| Question | Consent Manager | Consent management platform |
|---|---|---|
| What it is | Consent Manager:A registered intermediary that lets a person give, manage and withdraw consent across many businesses | CMP:Software a business runs on its own site or app to collect and record consent |
| Registers with the Data Protection Board | Consent Manager:Yes, from 13 November 2026 | CMP:No |
| Eligibility | Consent Manager:Company in India, net worth of at least ₹2 crore, independent certification, no conflict of interest | CMP:None |
| Sees the personal data | Consent Manager:No. Must be data-blind: it can't read the data the consent covers | CMP:Records consent decisions for the business that uses it |
| Do you need one? | Consent Manager:Optional. People may choose to use one; businesses must accept consent given through one | CMP:You need some way to give notice and record consent; a CMP is the usual one |
Today
Consent arriving from another system can be applied with PlainConsent.set() and is logged like any other decision. On Business, withdrawals can be pushed to your systems with signed webhooks.
Not yet
A direct connection to registered Consent Managers. The Board hasn't published the interoperability standard; we'll build to it when it does. Plain Theory won't register as a Consent Manager.
When each duty applies
The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in phases. MeitY has consulted on bringing the May 2027 date forward to 13 November 2026; as of October 2026 that change has not been notified in the Gazette.
- 13 November 2025
- Rules notified; provisions setting up the Data Protection Board in force.
- 13 November 2026
- Registration and obligations of Consent Managers begin (Rule 4).
- 13 May 2027
- Notice, consent, withdrawal, security safeguards, breach reporting, retention, children's data and Data Principal rights become enforceable.
How Plain Theory handles it
Each requirement maps to something the product does by default. Nothing here needs a custom build.
| Requirement | In Plain Theory |
|---|---|
| Itemised notice (Rule 3) | Each purpose lists its own data items and retention, edited in the banner builder and shown in the notice |
| Notice in 22 languages (s.5(3)) | Drafts for all 22 Eighth Schedule languages, each marked draft or reviewed by a named person |
| Clear affirmative action (s.6) | Nothing non-essential runs until the visitor chooses; no pre-ticked purposes |
| Withdrawal as easy as giving (s.6(4)) | A persistent Privacy choices button reopens the purposes; one tap withdraws, and on Business signed webhooks tell your systems |
| Rights, grievance and Board complaint | Rights page, grievance email and Data Protection Board link set once and shown in every DPDPA notice |
| DPO or contact person | Your DPO's name and email from Settings appear inside the notice |
| Proof of notice and consent (s.6(10)) | Hash-chained receipts with the notice version and language, verifiable on demand, exported as an Evidence Pack |
| Processing actually stops | Leak detection lists any tracker that still fires after a person declines, page by page, on your Leaks page |
| Records kept long enough (Rule 6) | 1-year log on Starter, 2 years on Growth, 7 years on Business |
| Data localisation | Receipts are stored in India (Mumbai, ap-south-1) |
Common questions
Does DPDPA apply to cookies?
DPDPA covers personal data in digital form. Identifiers set by cookies and trackers, combined with browsing behaviour, are personal data when they relate to an identifiable person. Treat analytics and advertising trackers as needing consent.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint a DPO based in India. Everyone else must still name a person who answers questions about data processing. Plain Theory shows whichever contact you set.
Does our consent tool need to register with the Data Protection Board?
No. Only Consent Managers register with the Board. A consent management platform that a business runs on its own site doesn't. Using a registered Consent Manager is optional for businesses, though you must accept consent given through one.
Are machine translations enough for the 22 languages?
Treat them as a starting point. The notice has to be clear to the person reading it, so have a native speaker check each language before you rely on it. Plain Theory records who reviewed each one and when.
Is data localisation required?
The Act doesn't require all data to stay in India, but the government can restrict transfers to specific countries and sector regulators may have their own rules. Plain Theory stores receipts in India (Mumbai), which avoids the question for consent records.
Get DPDPA-ready this week
Free for your first site. Upgrade when you add more sites or teammates.
No card needed · GDPR, CCPA/CPRA and DPDPA from one script