Consent notices for beneficiaries: sample wording in plain language
A DPDP consent notice tells a person, before you collect their data, what you’re collecting, why, and how they can say no later. Under Rule 3 of the DPDP Rules, 2025 it has to stand on its own, use plain language and itemise the data. This post gives you copy-ready wording for the four places nonprofits collect most data. It is item P1 on our DPDP Rules 2025 compliance checklist for NGOs, which covers the other 23.
What Rule 3 asks for, in one table
| Rule 3 requirement | What it means on a form |
|---|---|
| Understandable on its own | Not buried in terms and conditions or a link to a 12-page policy |
| Plain language, fair account | Words a first-generation learner's parent would follow when read aloud |
| Itemised description of personal data | List the fields: "name, age, phone number, village, school", not "your details" |
| Specified purpose and the service it enables | "To enrol you in the livelihood training and track your attendance" |
| A link or other means to withdraw, exercise rights and complain to the Board | A phone number, WhatsApp number or web link, plus a line on the Data Protection Board |
| Withdrawal as easy as giving consent | If consent took one tick, withdrawal can't need a written letter |
Section 5 of the Act also lets people ask for the notice in English or any language in the Eighth Schedule of the Constitution. For field programmes, plan translation into the languages your participants actually read, not just Hindi and English.
Sample 1: programme enrolment form (paper or app)
How we use your information [Organisation name] will collect your name, age, gender, phone number, village and the name of your self-help group. We use this only to enrol you in the [programme name] training, record your attendance and send you session reminders by SMS. Only our programme staff and our software provider [vendor] can see it. We will not share it with anyone else without asking you, unless the law requires us to. We will keep it until [two years after the programme ends] and then delete it. You can ask to see, correct or delete your information, or withdraw your consent, at any time by calling or WhatsApping [number] or speaking to your facilitator. Withdrawing will not affect any support you are entitled to under another scheme. If you are unhappy with our reply, you can complain to the Data Protection Board of India. ☐ I agree to [Organisation name] using my information as described above. Notice version: ENR-v1.2, [date]
Two details matter more than they look. The version number lets you prove later which notice someone saw. And the retention period must be one you will actually apply, so agree it with your finance and programme teams before printing.
Sample 2: read-aloud field script (low literacy)
Many participants won’t read a form. A read-aloud script, with consent recorded in your app against the script version, is more honest than a signature on a page nobody read.
“Before we start, I want to explain what we write down. We will note your name, age, phone number and village. We use it to register you for the health camp and to call you about your follow-up visit. Only our health team sees it. We keep it for one year after the camp. If you change your mind, call this number on the card, and we will stop using it and delete it. Is that all right with you?”
The field worker records: yes or no, date, script version, worker ID. Leave the person a printed card with the number. If they say no, they still get the service, unless the data is truly needed to provide it, in which case say so plainly.
Sample 3: WhatsApp intake or chatbot
Keep the first message short and put the detail one tap away:
“Hi, this is [Organisation]. To register you for [programme], we’ll ask for your name, age and district. We use this only for [purpose] and keep it for [period]. Reply STOP anytime to withdraw. Full notice: [link]. Reply YES to continue.”
The link must open a standalone notice that meets Rule 3, not your general privacy policy.
Sample 4: donation page
“We collect your name, email, phone, PAN and address to process your donation, issue your 80G receipt and meet our legal reporting duties. With your permission, we’ll also send you updates about our work. ☐ Yes, send me updates (optional). Unsubscribe anytime from any email.”
Keep the marketing tick-box separate and unticked. The receipt is a legal duty; the newsletter is a choice.
The mistake we see most: bundled photo consent
Programme enrolment and “we may use your photo and story in our reports and fundraising” are two different purposes. Under the Act, consent has to be specific and can’t be a condition of a service that doesn’t need it. Ask separately, at a separate moment, ideally after the person has seen how the photo will be used. Record it separately too.
For children, a parent or guardian must give consent and you must check that they are an identifiable adult. That has its own process, covered in our guide to verifiable parental consent.
Where to store consent
A notice only works if you can show, a year later, who agreed to which version. That belongs in the same record as the beneficiary, inside your MIS or CRM: consent status, notice version, channel, date and withdrawal date. A separate “consent spreadsheet” drifts out of date within a month.
Next step
Notices are one of 24 items. Book your ZolaShield assessment → to see which of your collection points need new wording first, with a scored risk report and a 180-day plan in two weeks.