Consent notice design: the screen nobody drew
The consent notice is the only part of India's data framework a shopper will ever read. Treat it as copy and layout, not as a paste from the privacy policy.
- Rule 3 of the DPDP Rules, 2025 requires the notice to be understandable independently of anything else you publish. Burying it in the privacy policy is the common failure.
- The notice needs an itemised list of the data and the specific purpose, plus the route to withdraw consent, exercise rights and complain to the Board.
- Section 5(3) gives the shopper the option to read it in English or any of the 22 Eighth Schedule languages, so the notice has to be content, not a hard-coded template string.
- Keep the marketing permission unticked and separate from the order, and store what was agreed with the notice version, language and timestamp.
A consent notice is drafted by a lawyer, shipped by a developer, and met by the customer as forty words of grey text between the phone number field and the pay button. That is the whole problem. It is the only part of India’s data framework a shopper will ever read: a design and copy surface, not a legal artefact you paste in.
The Digital Personal Data Protection Rules, 2025 carry a notification dated 13 November 2025, described by the Press Information Bureau as notified on 14 November 2025. Rule 1 puts rule 3, the notice rule, into force eighteen months from the date of publication of that gazette, and the commencement notification issued alongside it, G.S.R. 843(E), puts sections 5 to 7 of the Act, apart from section 6(9), on the same clock. Enough time to build this properly, not enough to build it twice. This is operational guidance and not legal advice.
The notice is not the privacy policy
Rule 3(a) requires the notice to be presented and be understandable independently of any other information the Data Fiduciary makes available. Independently is the load-bearing word. A line reading “by continuing you accept our Privacy Policy” is a cross reference, not a notice that stands on its own.
The policy keeps its job as the reference document: long, complete, rarely read. The notice is the short thing at the point of collection saying what is taken and why. Collapsing the two is the most common failure on Indian storefronts.
What the notice has to carry
Rule 3(b) asks for a fair account, in clear and plain language, of what a person needs in order to give specific and informed consent. At a minimum: an itemised description of the personal data, and the specified purposes, with a specific description of the goods or services being provided or the uses being enabled.
Itemised is the demanding word. “Your details” fails. “Name, mobile number, delivery address and email” passes. So does naming the purpose as delivering the order and handling returns, rather than improving your experience.
Rule 3(c) then asks for the link, and any other means, by which the person can withdraw consent, exercise her rights and complain to the Board. Section 6(4) sets the withdrawal standard: the ease of doing it has to be comparable to the ease with which consent was given. If consent is one tap, withdrawal cannot be an email to support.
English plus 22 languages is a build decision
Section 5(3) of the Act gives the person the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution, and section 6(3) says the same for the consent request. The Ministry of Home Affairs lists 22 languages in the Eighth Schedule, so the option set is English and 22 others.
Two things this is not. Not an instruction to translate your catalogue. And not satisfied by a browser widget guessing at your English string on the fly.
For a storefront built in English, the notice text has to leave the template and become content. One key, twenty three values, served against a language choice the shopper makes and that survives to checkout. Have them translated once by a human. They change rarely, which is fortunate: they are the strings you can least afford to get wrong.
Fulfilment and marketing are two separate asks
Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose. The Act’s own illustration is a telemedicine app asking for service data and the phone contact list, where consent is read down to what the service needs.
Section 7(a) sits alongside it as a legitimate use, covering the specified purpose for which a person voluntarily provided her data and has not indicated she does not consent. Whether a given flow on your site falls there or needs consent is a call for counsel against your real data flows.
The design consequence does not wait on that call. The marketing permission has to stand on its own. Pre-ticked is not a clear affirmative action, and bundling the campaign opt-in into the order box breaks specific and unconditional at once. Section 6(2) says any part of a consent that infringes the Act is invalid to the extent of the infringement, so a pre-ticked box may buy you a list you cannot rely on. The funnel-wide version of that argument is in our dark patterns audit. It also helps to settle internally that order, dispatch and refund messages are service communication, not campaigns, a split we set out in order to refund notifications.
Where it sits without wrecking conversion
On signup, put the notice directly above the submit control. Three or four lines, itemised, in the type size of the form labels. The marketing checkbox goes below it, unticked, on its own line. Not a modal, and not a link.
Guest checkout is harder, because the page is optimised to the pixel and there is no account to lean on. Attach the notice to the field it explains rather than stacking a block at the top, so the address explanation sits at the address. Keep the marketing ask as one unticked line near the order button, and let the order complete cleanly when it is ignored.
The conversion fear is mispriced. What costs you orders is a wall of text, a forced modal or a required tick. A short line does not.
Keeping a record of what was agreed and when
If somebody asks in eighteen months what a customer agreed to, “the checkbox was on the page” is not an answer. Store, per customer and per consent event, the purpose, the version of the notice shown, the language, the timestamp and the surface. Version the string so a record points at exact wording, not at whatever is live today.
Be careful with retention figures you may have read. The Rules do set a records duty of at least seven years, but the First Schedule places it on registered Consent Managers, not on every brand collecting consent on its own storefront. For a brand it is an evidentiary matter rather than a stated period, so agree the horizon with your counsel.
One last separation to make at build time. This is the notice a person reads and the permission a person gives. Consent for analytics and tracking is a different design problem with different consequences for reporting, and we treat it separately in consent, privacy and tracking design.