Compliance
A compliant notice avoids unlawful processing and the heavy penalties that can reach hundreds of crores under the DPDP Act
Check your DPDP readiness — free More on the blogThe first task is to list every personal data element that will be captured at a given touch‑point – name, email, phone, address, photograph or any identifier. Simultaneously, define the exact purpose for which each element is needed, such as order fulfilment, marketing or employee onboarding. This information must be recorded in a simple spreadsheet or document that can be referenced when drafting the notice. No data point should be collected without a clear, documented purpose.
Using the list created, write a short notice that explains in plain English (or any Eighth Schedule language relevant to the audience) what data will be collected, why it is needed, how consent can be withdrawn, how a grievance can be raised and how a complaint can be made to the Data Protection Board. Keep the notice separate from the privacy policy and avoid cross‑references. Aim for a paragraph of 3‑4 sentences that a layperson can read in under a minute.
The notice must be presented before or at the moment consent is sought. For web forms, place it as a distinct box above the consent tick‑box. For offline interactions, display it on a printed sheet or a digital screen that the user can read before signing. Ensure the language matches the user’s preferred language; if the audience is multilingual, provide the notice in each relevant language side by side.
Do not merge the notice with the consent tick‑box or signature line. First show the notice, then provide a separate consent mechanism – a checkbox, a digital signature or a verbal acknowledgment. This two‑step process demonstrates that the user has read the notice before giving consent, satisfying the statutory requirement for distinct steps.
The marketing, sales, HR and IT teams that handle data collection must be briefed on the notice requirements. A short training session should cover where the notice appears, how to verify that the user has seen it, and the steps for withdrawing consent. Keep attendance records as proof that staff were instructed, which can be produced during an audit.
For data gathered prior to the DPDP Act, issue the same notice as soon as reasonably practicable. Send it by email, post or in‑app notification, depending on how the data was originally obtained. Include a clear option for the data principal to withdraw consent immediately. Log the date each legacy notice was sent and any responses received.
If the Data Protection Board requests proof, you must produce the notice text, the date and method of delivery, the consent records, and the internal logs showing who approved and who trained on the notice. Store these documents in a secure, searchable repository for at least the period required by the Act.
Whenever a new data‑processing activity is introduced or an existing purpose changes, revisit the notice. Update the language, add any new data points, and re‑run the training for affected staff. Record the revision date and the approver’s name to demonstrate ongoing compliance.
It should be a short, stand‑alone statement in plain English or an Eighth Schedule language that lists the personal data to be collected, the specific purpose, how consent can be withdrawn, how a grievance can be raised and how to complain to the Data Protection Board. It must be shown before or at the moment consent is sought and not hidden inside a longer privacy policy.
You can reuse a template, but each notice must reflect the exact data and purpose for the particular collection point. If the purpose or data type differs, the notice must be adjusted accordingly and the change documented.
Typically the compliance officer or legal head approves the notice, while the teams that collect data – marketing, sales, HR or IT – implement it. Training records should show that these teams understand the two‑step process of notice then consent.
Provide the final notice text, the delivery method and date, consent logs, internal approval records, training attendance sheets and any version‑control files showing updates. Keeping these documents organised will demonstrate that you complied with Section 5.
Published 22 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.