Good vs bad consent notice, annotated
A consent notice, side by side
The same request done badly and well. Six things decide whether a DPDP consent notice actually holds — here is where each one lands.
Vague, catch-all purpose
“Our records and any other business purpose” isn’t a purpose. Consent has to name a specific use, so the person knows exactly what they’re agreeing to.
Pre-ticked and bundled
The box is already ticked and covers everything at once. Consent must be a free, specific action the person takes — not a default they have to undo.
No way to withdraw
There’s no way to take consent back and no one to contact. A notice should say how to withdraw and how to reach a grievance officer.
Specific, itemised purpose
One clear use, in plain words, with how long the data is kept. The person can see exactly what they’re agreeing to and for how long.
Unticked and specific
The box starts empty, so agreeing is a deliberate act — and it’s tied to that one purpose, not a bundle.
Easy to withdraw
It says how to withdraw consent and gives a contact, so the choice stays with the person after they’ve made it.
This is a mock. The firm name, email, and details shown are illustrative, not a real business.
Related Articles
Collecting personal data from your own customers?
These are the rights your business has to honour. See where you stand with a two-minute self-check — no sign-up, no data stored.
Run the compliance self-check →