DPDP Consent Notice Sample: The Notice You Will Have to Send Clients

A client asks for your privacy notice. The honest answer is a shrug and a link to a policy nobody reads.

Here is a DPDP consent notice sample you can adapt, and the six mistakes to avoid when you write one.

The short answer

A DPDP consent notice is a standalone, plain-language notice given before a firm asks for personal data. It must list the personal data, the purpose, how to withdraw consent, how to exercise rights and how to complain to the Data Protection Board. The main duties apply from about 13 May 2027, unless the government shortens the period.

Start now, so the notice is ready when the duty starts. Our guide on what changes by May 2027 sets out the wider timeline.

Before you write it, decide who gives the notice

The firm that decides why the data is used generally carries the notice duty. A firm that only processes data for another party is in a different position. Our guide on data fiduciary or processor explains the split.

A sample notice you can adapt

Replace the bracketed text with your firm's details. Check every line against what your firm actually collects.

Your data, and how we use it

We collect your PAN, Aadhaar, bank statements and salary slips to prepare your income tax return for tax year 2026-27. We use them only for that purpose. We keep tax records for [retention period] or as the law requires.

You can withdraw your consent at any time by writing to [name] at [email address]. You can ask us to show, correct or erase your data. You can complain to the Data Protection Board. For our grievance contact, write to [email address].

This notice is available in other languages on request.

Six mistakes, and the fix for each

1. The notice sits inside the engagement letter. The Act asks for a standalone notice, and a clause buried in a long letter fits that poorly. Fix: a one-page notice with its own heading, given as a separate document.
2. The wording is legal and vague. Fix: short sentences, plain words and one example for each use.
3. "Client data" is listed instead of the data. Fix: name PAN, Aadhaar, bank statements, salary slips and medical bills for 80D claims. Advocates hold other kinds of papers too, covered in DPDP for advocates.
4. The purpose is too wide. "To provide services" tells the client nothing. Fix: name each use, such as the income tax return, the GST return or the audit file.
5. Withdrawal has no address. Fix: name one person and one email address for withdrawing consent.
6. There is no complaint route. Fix: say how to complain to the Data Protection Board, and give your own grievance contact.

What the notice must contain

Advisors hold KYC and nominee papers, so their notice needs extra lines. See DPDP for financial advisors. The daily habits behind a weak notice are covered in DPDP problems for CA firms.

How do you collect signed forms without the chase?

Reposha, DPDP-ready document management for professional firms, keeps each Client's signed consent form in that Client's folder. Send the Client one upload link for any signed form. The Client uploads from a phone or laptop, with no account, and can use English or Hindi pages. Each file can be up to 25 MB.

On Reposha, every open and download is logged. Only staff with access to that Client can see the file.

Start at reposha.com.

Questions people ask

General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.

Written by Premanshu, Founder, PreceptsAI