DPDPA privacy notice must enable informed consent, not clicks

Under the Digital Personal Data Protection Act, 2023 (DPDPA), a privacy notice must do more than meet statutory disclosure requirements. It must communicate clearly enough for a data principal to understand how their personal data will be used and make a genuinely informed decision about consent.

Yet a peculiar irony lies in how most organisations approach privacy notices. Enormous effort goes into making the notice legally compliant: ticking every statutory box, referencing every required provision, and surviving regulatory scrutiny. Far less effort goes into asking the more fundamental question: will the person reading this actually understand it?

Under the DPDPA, a privacy notice is not a procedural formality. It is the instrument through which a data fiduciary establishes a lawful relationship with the data principal, and that relationship rests on consent that is informed, specific, free and unconditional, and based on a clear affirmative action.

A notice that is technically compliant but practically incomprehensible defeats the very purpose the law was designed to serve. The DPDPA does not just ask organisations to disclose; it asks them to communicate.

What Does Informed Consent Mean Under DPDPA?

The word “informed” in the DPDPA is not decorative. It carries real legal weight, and organisations consistently underestimate what it demands in practice.

First, making information available is not the same as informing someone. A notice that discloses everything required but does so in dense, legalistic prose satisfies the letter of disclosure while failing the spirit of informed consent. If a data principal cannot practically understand the notice, they cannot genuinely consent; they can only click “I agree.”

Second, informed consent means the individual understands the consequences of processing, not just its mechanics. If an EdTech platform uses student behavioural data to generate aptitude profiles shared with partner institutions, the parent consenting on a child’s behalf must understand that downstream use, not merely that “performance data is collected to improve learning outcomes.”

Third, specific consent means one click cannot authorise everything at once. Bundled consents, where a single action covers collection, analytics, third-party sharing, and marketing in one sweep, are not consistent with the DPDPA’s framework. Bundling unrelated processing purposes into a single consent risk falling short of the DPDPA’s requirement that consent be specific and informed.

Privacy Notices Should Address Different Audiences

Most privacy notices are written for lawyers, not for the people they are meant to benefit. This is the most consequential failure in notice drafting, and it is almost universal.

A notice served to a first-generation internet user in rural Uttar Pradesh making their first digital payment needs a fundamentally different register than one served to a senior executive on an enterprise software platform.

The DPDPA recognises this. It requires data principals to be given the option to access notices and consent requests in English or any language specified in the Eighth Schedule to the Constitution. This is more than a translation consideration: meaningful communication depends on presenting information in a language and register the individual can genuinely understand.

Good notice drafting starts with audience analysis: What is the literacy and digital familiarity of the people being addressed? What decisions are they being asked to make, and what are the stakes for them specifically? What channel is delivering the notice, and how does that shape comprehension?

The answers should determine the vocabulary, structure and level of detail, not the other way around.

Common Privacy Notice Drafting Mistakes

The most common privacy notice drafting failures include excessive information, vague processing purposes, unclear third-party sharing, difficult consent withdrawal and insufficient explanation of what data processing means for the individual.

The kitchen-sink notice: Many organisations try to address every conceivable legal risk by cramming in every conceivable piece of information. The result is a 12-page document that is technically comprehensive and practically unreadable. The DPDPA’s requirement for “clear and plain language” is a constraint on length and complexity, not just vocabulary. A notice that encourages uninformed acceptance is not compliant.

Purpose inflation: Phrases like “analytics and service improvement,” “research and development,” and “security and fraud prevention” can be stretched to cover processing activities the data principal would never reasonably anticipate. The DPDPA requires purposes to be specific enough for the individual to understand what they are actually consenting to. Vague, inflated purposes undermine that standard and invite regulatory challenge.

The invisible third party: References to “trusted partners,” “service providers,” or “entities in our group” do not give data principals a fair account of who will access their data. If sharing with a named analytics vendor, an advertising platform, or a foreign subsidiary is routine, that should be disclosed with real specificity, not hidden behind generic categories.

The asymmetric withdrawal mechanism: The DPDPA is explicit: withdrawing consent must be no harder than giving it. If consent is given through a single toggle, it cannot be withdrawn through a seven-step process buried in account settings. Current practice violates this symmetry principle constantly, and it will attract enforcement attention once the DPDPA’s regime becomes fully operational.

No rational decision pathway: Most privacy notices describe what will happen but do not adequately explain why it matters to the individual. Saying “we will share your data with marketing partners for targeted advertising” may describe the activity, but it does not necessarily help them understand the profiling or inferences that may result. A good notice does not require a data science tutorial, but it does need enough context for the individual to form a genuine view.

What Should a DPDPA Privacy Notice Include?

A good privacy notice should clearly identify what personal data is collected, why it is processed, who can access it, how long it is retained, what rights the data principal can exercise, and what happens if consent is refused or withdrawn.

It should name the actual categories of data being collected, including name, contact details, location data, financial information, health data, behavioural and usage data, and device identifiers, rather than aggregating them into vague catch-all phrases.

For each category, it should explain its specific purpose and the service it enables. If data feeds into AI-driven personalisation or automated decision-making, say so plainly, not in a footnote cross-referencing a separate AI policy that most users will never read.

It should clarify who else will see the data: processors, third parties, group entities, and the basis on which sharing occurs. Retention periods should be stated by category or purpose, not dressed up in the circular assurance that data will be kept “as long as necessary.”

A good privacy notice must also tell the data principal what they can actually do, with clear, functional mechanisms to withdraw consent, access and correct data, request erasure, and file a complaint with the Data Protection Board of India. These mechanisms should be as easy to use as the original consent flow.

Finally, the notice should be clear about the practical consequences of refusing or withdrawing consent, including whether that decision affects access to a service or particular functionality.

The DPDPA requires consent to be limited to personal data necessary for the specified purpose. Organisations should therefore distinguish processing necessary to provide a service from unrelated processing, rather than using access to the service to obtain broader consent than the stated purpose requires.

How Privacy Notices Can Build Trust

The privacy notice is too often treated as a legal defence document—something whose purpose is to insulate the organisation from liability by recording that it made the disclosure. That framing is not just inadequate; under the DPDPA, it is legally insufficient.

A privacy notice is a trust instrument. It gives the data principal genuine agency over their personal data by ensuring they understand what they are agreeing to and why. A clear, specific, audience-appropriate notice that honestly explains the nature and consequences of processing is not merely a better compliance document—it is the foundation of a sustainable relationship between an organisation and the individuals whose data it holds.

With key DPDPA obligations due to take effect in 2027, organisations would do well to treat notice drafting as a communication design exercise grounded in legal obligation. The test at the end of the process is simple: could a person in the target audience read the notice, understand it and make a genuine decision? If the answer is no, the notice is not done.