Is it mandatory to provide DPDP consent notices in Indian languages?

Yes, as an option for the customer. The Act requires a Data Fiduciary to give each Data Principal the option to access the notice and the consent request in English or in any language listed in the Eighth Schedule to the Constitution, which covers 22 languages. These provisions commence on 13 May 2027. A business that serves customers in several states can meet the requirement by maintaining approved translations of each notice, a visible language selector at every consent touchpoint and a record of the version each customer saw.

Does a business have to offer all 22 languages for every notice?

The Act states no minimum number of languages, and the research for this article found no official clarification on the point as of 14 October 2026. The wording gives the customer the option to access the notice in any scheduled language, so the safest design target is availability of all 22 languages, delivered in stages that begin with the languages customers use most. A business that adopts a narrower reading should record the legal opinion behind it and the process for producing another language on request.

Do consent requests need to be multilingual as well as notices?

Yes. Section 5(3) covers the notice and Section 6(3) covers the consent request itself, so both carry the language option. The consent request must also use clear and plain language and provide contact details of a Data Protection Officer where applicable, or of another person authorised to respond to the customer. In practice, the notice and the consent screen should appear together in the language the customer chose, so that the customer reads one consistent version.

Do SMS and WhatsApp consent messages need translated versions?

Yes, when the message is a notice or a consent request and the customer has chosen a language other than English. Regional language SMS templates are registered on the DLT platform as Unicode templates, and the message sent must match the registered text. WhatsApp does not translate templates for a business, so each language is submitted and approved as its own template. A single register that links each template to the notice version it carries keeps these channels aligned.

What records show that a customer saw the notice in their chosen language?

A consent record should carry the notice version identifier, the language displayed, the timestamp, the channel, the consent action and the withdrawal route offered. Section 6(10) requires the Data Fiduciary to prove that notice was given and consent was obtained in line with the Act and Rules when consent is questioned, so these fields give legal and audit teams one source of evidence. This article provides general information and is not legal advice. Consult qualified legal counsel for advice on your specific situation.

Multilingual Consent Notices Under DPDP: Language Requirements Explained

Multilingual consent notices under DPDP explained: Eighth Schedule languages, a coverage register, and audit records.

The Digital Personal Data Protection Act, 2023 sets out the rights of Data Principals and places duties on Data Fiduciaries, including the duty to offer multilingual notices and consent requests, and these duties must be complied with by 13 May 2027. From 13 May 2027, the Act requires every Data Fiduciary to give each Data Principal the option to access the notice and the consent request in English or in any language specified in the Eighth Schedule to the Constitution. The leadership teams need to identify the initial releases' languages and allocate responsibility for the approved translations to the right team. A third decision covers how consent records will show the language each customer saw. Settled early, these decisions can help your organisation reach customers across states with valid consent and keep one consistent record across digital and physical channels.

The Act applies the language option to both the notice and the consent request. This is a guide to the legal obligations, the issues for careful consideration and a best practice approach that business and technology teams will consider when looking at provision of notice and obtaining consent, in the event that the business has to justify it, on a challenge.

What Do the DPDP Act and Rules Require for Notice Language?

The items below come from the Act and the Digital Personal Data Protection Rules, 2025. Each one is a legal obligation.

A notice must accompany or precede every consent request (Section 5(1)).
The Data Fiduciary must give the customer the option to access the notice in English or any Eighth Schedule language (Section 5(3)).
Every consent request must use clear and plain language and carry the same language option, together with contact details of a Data Protection Officer where applicable or of another authorised person (Section 6(3)).
The notice must be understandable independently of other published information. Its content must itemise the personal data and the specified purpose, along with the goods or services the processing enables (Rule 3(a) and 3(b)).
The notice must give a communication link and any other means to withdraw consent with comparable ease, exercise rights and complain to the Data Protection Board (Rule 3(c)).
The business must prove, when consent is questioned, that it gave notice and obtained consent as the Act and Rules require (Section 6(10)).

Three dates matter. The Rules were notified by the Government on 13 November 2025, and Rule 4, which covers the registration of Consent Managers, comes into force on 13 November 2026. Rule 3 and Sections 5 and 6 (except Section 6(9)) come into force on 13 May 2027, which is 18 months after the Rules were published in the Official Gazette. For consent given before the commencement of the DPDP Act, Section 5(2) of the Act requires the Data Fiduciary to give a notice as soon as reasonably practicable, with the same option to access it in English or any Eighth Schedule language.

How Should You Read "Any Language Specified in the Eighth Schedule"?

The Eighth Schedule recognises 22 languages, from Hindi and Tamil to Bodo and Santali. The statute frames the duty as an option available to the customer. Nothing in the Act requires every notice to be published in all 22 languages from the first day. The research for this article also found no clarification from the Ministry of Electronics and Information Technology on how many languages a business must make available.

Two readings of the clause are possible. Under the broad reading, a customer who asks for any scheduled language receives the notice in that language. The narrower method connects coverage to the language the customer uses and clearly shows how a new language is made when someone asks for it. This approach would be wise to clear with counsel to determine which of these interpretations applies to the particular industry and note as such.

The best practice encourages creation for the widest possible interpretation and the release of languages in three tiers, to keep the number manageable. Tier one would be the languages currently used by customers for transactions, determined from CRM preferences and service ticket history. Tier two would be the languages for regions in which there are customers, and plans to open stores or launch products. And tier three would be the remaining Eighth Schedule languages, completed before the customers demand them.

Language Rules From RBI, TRAI and WhatsApp That Apply Alongside DPDP

DPDP supplies the baseline for notices and consent requests. A loan application journey, for instance, also meets RBI language rules, and the SMS or WhatsApp message that follows brings in telecom and platform conditions.

Banking and lending (RBI). RBI orders on Key Facts Statement dated 15 April 2024 require the statement to be written in a language that the borrower understands. Its contents have to be explained to the borrower, and an acknowledgement has to be obtained that the borrower has understood them. The RBI Non-Banking Financial Companies Responsible Business Conduct Directions, 2025, issued on 28 November 2025, also require every communication with the borrower to be in the vernacular language or a language that the borrower understands. As a recommended practice, a loan applicant who chooses a language for the statement should see the consent notice in the same language.
SMS (TRAI rules). Businesses register commercial SMS templates on a DLT platform, and the message sent must match the registered template. Platforms treat regional language templates as Unicode. Because a Unicode SMS holds 70 characters where standard text holds 160, the Hindi or Tamil version of a consent message can need a second segment that the English version never required. Service explicit and promotional templates must also link to a consent template.
WhatsApp (platform policy). Translation is left to the business, because WhatsApp does not translate templates. The business provides each language as a separate template for approval. The business selects the language of each message at the time of sending, and the customer must have opted in to the service before receiving a business-initiated message.

If a customer chooses Marathi on the web-based form and later receives the confirmation SMS in English, the journey spans two languages, which can be difficult for auditors to follow. Best practice would be to keep the same language throughout (notice, consent screen and reminder).

Three Workflows Where Language Gaps Tend to Appear

For example, on entering a mobile number on a tablet, a notice appears in English with the explanation given in Kannada to the customer. The notice remains in English on the system even if the person receiving the explanation understands the explanation in their own language. A potential solution is to have a language selector on the tablet, with the version of the notice and language preference saved with the number.

In a call centre, agents who request permission for a callback campaign should read from a script that has been approved in the customer's chosen language. Giving agents approved scripts in each language means that there will be consistent messaging, and the business can use the same document during any audit.

In mobile apps, a user who selects Bengali at registration and accepts consent on the Bengali interface should also reach a Bengali withdrawal page, because Rule 3(c) requires withdrawal to be as easy as giving consent.

A Language Coverage Register for Multilingual Consent Notices Under DPDP

A language coverage register is one shared table with a row for every customer touchpoint. Each row records the live languages and the notice version behind each, along with a named owner. Your marketing operations team can maintain the register while your legal team approves each notice version. Six steps build it.

Start with a list of every place that requests consent from a customer, on screen or in person.
Note the language signals you hold for each customer, such as a stated preference or the language of earlier service tickets.
Place each language in one of the three tiers described above.
Give each translated notice a version number, and name a translator and a legal reviewer for it.
Link every channel template to the notice version it carries. A DLT template and a WhatsApp template with its language code are the two common examples.
Set review triggers for a change in data collected or purpose, and for a revision of the English master.

Review the register every quarter, and approve every language again whenever the English master changes. A translation that lags the master leaves customers reading a different notice from the one the business approved.

Quality Checks for Translated Notices

A translated notice must meet the same Rule 3 standard as the English master. The review team should apply each of the following checks to every translated notice.

Use professional translator and a legal reviewer along with a standard glossary for terms such as Data Principal and purpose.
Keep the list of personal data items identical across every language.
Test each script on the devices customers use, including Devanagari and Urdu, which runs right to left.
Sample a back translation for each language at every revision.

Evidence to Keep for Each Language Version

If the Data Principal or the Board questions consent, Section 6(10) places the burden on the Data Fiduciary to prove that notice was given and that consent was obtained in accordance with the Act and the Rules. Records showing the language in which the notice was given to the Data Principal can help the Data Fiduciary discharge that burden before the Board. Recommended fields start with the notice version, its language and the timestamp. The channel and the consent action complete the core record, and two further fields record whether the customer selected the language or saw a default, and which withdrawal route was offered. Kept across all channels, these records can support audit readiness under DPDP.

Technology Support for Multilingual Consent at Scale

A DPDPA notice management tool holds the English master and each approved translation as linked versions, then logs the version a customer saw. The software allows you to have a language selector at every step of the journey, allowing you to roll out your customers' language of choice from sign-up to message. A consent platform also connects those records with a CRM and messaging tools, so, a withdrawal executed on the app, is likely to flow through to your SMS and WhatsApp lists.

Your team can use the criteria below as one shared checklist when evaluating multilingual consent notice software India has on offer.

Language coverage of all 22 Eighth Schedule languages, with a published release order.
Version control that links each translation to the consent records it produced.
Channel mapping for DLT and WhatsApp templates.
Rendering support for Indic scripts and for Urdu, which runs right to left.
Approval roles that separate the translator from the legal reviewer.
Export of audit evidence by language and channel.

How OneConsent Supports Language Coverage Across Notices and Channels

OneConsent's notice versioning and logging feature is created to couple every translated notice with the consent given to ensure an audit trail to report the version and language the customer viewed. Marketing and service teams can leverage these records to understand what each customer's consent status and language preference were prior to commencing a campaign.

Actions for Leadership Teams Before 13 May 2027

Review your touchpoint list and record the languages each one serves today.
Ask counsel for a written view on the Eighth Schedule option as it applies to your sector.
Name an owner for the English master notice and for each translation.
Verify that an approved SMS template and WhatsApp template exist for each language you plan to release.
Test a sample of consent records to see that each one carries the notice version and language.
Schedule a quarterly review of the language coverage register.

Preparing Your Multilingual Consent Notices Under DPDP

Meeting the language requirement involves translating the notice and also changing day-to-day procedures. An early strategic approach leaves the relevant teams plenty of opportunity to work well. There are, within the first week, two obvious steps to take: create a manifest of touchpoints; get advice on the interpretation from the lawyers. Then the register can be built – giving an owner and a version of each language, rolling out through the most common customer languages – by 13 May 2027.

Plan Your Multilingual Notice Programme With OneConsent

Teams that want a structured review of language coverage can work through it with the OneConsent team, alongside their legal advisers. Explore the OneConsent platform to see how DPDP compliance solutions bring notices, consent records and channel enforcement together. A working session can map your touchpoints against the register described here, and you can book a personalised demo when your team is ready.