Consent Notice
Definition
A notice that must be provided to the data principal before or at the time of requesting consent. It must be clear, plain-language, and specify the personal data to be processed and the purpose of processing. Consent must be free, specific, informed, unconditional, and unambiguous.
- Regulation
- India's Digital Personal Data Protection Act 2023
- Timing
- Before or at the time of requesting consent
- Language requirement
- Clear, plain language
- Must specify
- Personal data covered and purpose of processing
Common questions
What consent qualities does the DPDP Act require alongside a proper notice?+
Consent must be free, specific, informed, unconditional, and unambiguous. A notice satisfying the disclosure requirement does not by itself make the consent valid if, for example, the consent is bundled into an unrelated agreement or the individual has no real ability to decline.
Why does the Act require the notice to specify the purpose of processing rather than a general statement?+
A vague or blanket purpose statement would let a data fiduciary process personal data far beyond what the individual actually agreed to. Requiring a specific stated purpose limits use of the data to what was disclosed and gives the data principal a concrete basis to judge whether to consent.
Related terms
- Data Fiduciary
- The term used in India's Digital Personal Data Protection Act 2023 for an entity that determines the purpose and means of processing...
- Data Principal
- The individual to whom the personal data relates. Equivalent to the data subject under GDPR. The DPDP Act grants data principals rights...
- Data Processor
- An entity that processes personal data on behalf of a data fiduciary, under the fiduciary's instructions. Equivalent to the data processor under...
- Data Protection Board of India (DPBI)
- The adjudicatory body established by the DPDP Act to receive complaints, investigate breaches of the Act, and impose penalties. The Board operates...
- Significant Data Fiduciary (SDF)
- A data fiduciary designated by the central government as carrying elevated risk based on data volume, sensitivity, national security considerations, or impact...