What the notice has to do
When you ask for consent, you give the person a notice first or at the same time. It should say what personal data you collect and the specific purpose, how they can withdraw consent, how they can exercise their rights, and how they can complain to the Board. It has to be clear and plain, and readable on its own, without the person having to piece it together from other documents.
The person can ask to read the notice in English or in any of the 22 languages in the Eighth Schedule of the Constitution. For a D2C brand that takes orders over WhatsApp in Gujarati and Hindi, an English only privacy policy behind a link is unlikely to meet that test.
What makes consent valid
Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. A pre-ticked box or a line buried in terms of service does not meet that bar.
Bundling is the common trap. An edtech app that makes students accept marketing calls in order to see their exam results is asking for consent that is not free or specific. Separate the purposes and let people say yes to each one.
Withdrawal has to work in practice
A Data Principal can withdraw consent at any time, and it should be as easy as giving it. After that you stop processing for that purpose, and you have your processors stop too, within a reasonable time.
Many consent programmes fail at this point. The banner records the withdrawal, but the CRM, the SMS vendor and the analytics tool never hear about it. Withdrawal is an operational task that has to reach every system.
Consent is not always the right basis
Section 7 lists legitimate uses where you can process without consent, such as complying with a legal obligation or responding to a medical emergency. Using consent where a legal duty applies can mislead people, because they cannot really refuse.
When the duties apply
The notice and consent duties of Data Fiduciaries apply in Phase 3, around 13 May 2027 as notified, unless amended. Consent Managers, which can collect and manage consent on a person's behalf, are covered from Phase 2, around 13 November 2026.
Where TrustOS fits
TrustOS links each notice to the purposes in your data inventory, so a notice changes when a purpose changes. Notices can be published in the 22 Eighth Schedule languages, and consent records are tamper evident, with the notice version the person saw.
When someone withdraws, TrustOS creates the follow up work for each connected system and processor, and keeps the confirmation. Your lawyers decide what the notice says; TrustOS does not replace legal advice.
Official sources
- MeitY: Data protection framework (the Act, the Rules and notifications)
- India Code: Digital Personal Data Protection Act, 2023
This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.