# DPDP consent notice drafting template

Version: [VERSION]
Effective date: [DATE]
Data Fiduciary: [LEGAL NAME]

> Educational starting point, not legal advice. Adapt this document to the processing that actually occurs, applicable sector rules, later notifications and your approved legal position. Delete all instructions in square brackets before use.

## 1. Who is asking for consent

[State the legal name of the Data Fiduciary and a concise description of the product, service or interaction.]

Questions about this processing can be sent to:

- Contact role: [DPO, IF APPLICABLE, OR AUTHORISED BUSINESS CONTACT]
- Contact method: [EMAIL / FORM / POSTAL ADDRESS]
- Grievance channel: [URL OR INSTRUCTIONS]

## 2. What personal data is involved and why

Present each purpose separately. Use terms the intended reader understands without opening another document.

| Purpose ID | Specified purpose | Personal data involved | Required or optional | What happens if declined |
|---|---|---|---|---|
| [PURPOSE-001] | [ONE SPECIFIC PURPOSE] | [ITEMISED DATA OR MEANINGFUL CATEGORIES] | [REQUIRED / OPTIONAL] | [PLAIN-LANGUAGE CONSEQUENCE] |

[Repeat the row for each genuinely separate purpose. Do not bundle unrelated purposes into one choice.]

## 3. Your choice

[Describe the clear affirmative action. Do not use silence, inactivity or a pre-selected option as consent.]

- [ ] I agree to [PURPOSE-001] using the personal data listed above.

## 4. How to withdraw consent

You may withdraw consent through [PATH OR CONTROL]. The withdrawal path is [DESCRIBE STEPS] and is intended to be as easy as giving consent.

After withdrawal, processing based on that consent will cease within [OPERATIONAL SERVICE LEVEL], including instructions to relevant processors, unless processing is required or authorised by law. Explain any immediate product consequence in plain language: [CONSEQUENCE].

## 5. Rights and grievance handling

Explain how the individual can:

- request access information;
- request correction, completion, updating or erasure where applicable;
- submit a grievance;
- use the published nomination process; and
- complain to the Data Protection Board after using the grievance route, where applicable.

Channel: [URL / EMAIL / INSTRUCTIONS]

Identifiers needed to locate the relationship: [MINIMUM NECESSARY IDENTIFIERS]

## 6. Language and accessibility

This notice and consent request are available in [LANGUAGES]. Record the language version presented with the consent event.

## Internal implementation record — do not show as notice copy

| Control | Implementation value |
|---|---|
| Notice version and approved wording | [VALUE] |
| Purpose ID | [VALUE] |
| Systems activated by consent | [VALUE] |
| Processors activated by consent | [VALUE] |
| Retention trigger | [VALUE] |
| Withdrawal event destination | [VALUE] |
| Evidence owner | [VALUE] |
| Approval date and approver | [VALUE] |
| Test date and result | [VALUE] |