Back to Resources
Template

Consent Notice Template

A template framework for drafting consent notices that meet the requirements of the DPDPA.

This template provides guidance on structuring a consent notice. Each section includes explanatory notes and sample text that should be customized to your organization's specific processing activities.

1. Identity of the Data Fiduciary
Clearly identify your organization as the entity determining the purpose and means of processing. Include the registered name and contact details.

Sample Text

[Organization Name], a company registered under the laws of India, with its registered office at [Address] ("we", "us", or "our"), is the Data Fiduciary responsible for the processing of your personal data as described in this notice.

2. Purpose of Processing
Specify each distinct purpose for which personal data will be processed. The DPDPA requires that data be processed only for the specific purpose communicated to the Data Principal at the time of consent. See Rule 3 for detailed privacy notice requirements.

Sample Text

We process your personal data for the following purposes: • To provide and maintain the services you have requested • To communicate with you regarding your account or inquiries • To comply with legal obligations applicable to us • [Add each specific purpose]

3. Categories of Personal Data
List the types of personal data that will be collected and processed. Be specific about each category rather than using vague terms.

Sample Text

The personal data we collect and process includes: • Name and contact information (email address, phone number, postal address) • Account credentials (username, password hash) • Transaction and payment information • Device and usage data (IP address, browser type, access timestamps) • [Add each specific data category]

4. Retention Period
Inform Data Principals how long their data will be retained. The DPDPA requires erasure once the purpose is fulfilled or consent is withdrawn, unless retention is required by law.

Sample Text

Your personal data will be retained only for as long as necessary to fulfil the purposes described in this notice, or as required by applicable law. Upon fulfilment of the purpose or withdrawal of your consent, we will erase your personal data within [specify timeframe, e.g., 30 days], unless retention is required under any applicable law.

5. Third-Party Sharing
Disclose any third parties with whom personal data will be shared, including Data Processors. Explain the purpose of sharing and any safeguards in place.

Sample Text

We may share your personal data with: • Service providers who process data on our behalf (Data Processors) for [specify purposes] • Regulatory authorities as required by applicable law • [Specify any other third parties] All Data Processors are contractually obligated to process your data only as instructed by us and to implement appropriate security measures.

6. Cross-border Transfers
If personal data will be transferred outside India, disclose this fact and the destination countries. The DPDPA permits transfers only to countries not restricted by the Central Government.

Sample Text

Your personal data may be transferred to and processed in [specify countries/territories]. These transfers are made in compliance with the Digital Personal Data Protection Act, 2023, and are limited to jurisdictions permitted by the Central Government of India.

7. Rights of Data Principals
Inform Data Principals of their rights under the DPDPA, including the right to access information, correction, erasure, and grievance redressal.

Sample Text

Under the Digital Personal Data Protection Act, 2023, you have the right to: • Access a summary of your personal data being processed and the processing activities • Correct inaccurate or misleading personal data, and update or complete incomplete data • Erase your personal data, subject to legal retention requirements • Nominate another individual to exercise your rights in the event of your death or incapacity • Lodge a complaint with our Grievance Officer or the Data Protection Board of India

8. Grievance Redressal
Provide clear contact details for your Grievance Officer or grievance redressal mechanism, including response timelines.

Sample Text

If you have any concerns about how we process your personal data, you may contact our Grievance Officer: Name: [Grievance Officer Name] Email: [email address] Address: [postal address] We will acknowledge your grievance within [timeframe] and aim to resolve it within [timeframe]. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India.

9. Withdrawal of Consent
Explain clearly how Data Principals can withdraw their consent and the consequences of doing so. Withdrawal must be as easy as giving consent.

Sample Text

You may withdraw your consent at any time by [specify mechanism, e.g., clicking the 'Withdraw Consent' option in your account settings, emailing us at [email], or contacting our Grievance Officer]. Please note that withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. Upon withdrawal, we will cease processing your personal data for the purposes for which consent was given and erase the data within [timeframe], unless retention is required by law.

Explore More

Disclaimer: The information on this page is for educational purposes only and does not constitute legal advice or solicitation.