Consent in Every Indian Language

Last updated: 24 October 2026

If a person can't read a consent notice, it tells them nothing. Much of the guidance on consent in India covers what the notice must say: the personal data, the purpose, how to withdraw. The DPDP Act also asks whether the person can read it in a language they choose.

The Act answers that in two places. Section 5(3) covers the notice. Section 6(3) covers the request for consent itself. Both point to the same list: English and the languages in the Eighth Schedule to the Constitution, which today holds 22 languages.

Language feeds into what makes consent valid, so it is worth settling before 13 May 2027.

What the DPDP Act says about language

Two sections of the Digital Personal Data Protection Act, 2023 deal with language.

Section 5(3) is about the notice. It reads: "The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution." Sub-section (1) is the notice that must accompany or precede a request for consent. Sub-section (2) is the notice owed to people who gave consent before section 5 came into force.

Source: Digital Personal Data Protection Act, 2023, s.5(3), shown below the opening line of s.5(1) (MeitY, Gazette pp. 4 to 5)

Section 6(3) is about the consent request. Every request for consent "shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution". The same sentence asks for the contact details of a Data Protection Officer, where applicable, or another authorised person. If you are deciding who that contact should be, see the role of a DPO.

Source: Digital Personal Data Protection Act, 2023, s.6(3), shown below the opening line of s.6(1) (MeitY, Gazette p. 5)

The DPDP Rules, 2025 add the content standard. Rule 3(b) says the notice must "give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent", including "an itemised description of such personal data" and the specified purpose. Rule 3(a) adds that the notice must "be presented and be understandable independently of any other information". The Rules don't mention language again.

So the language option applies to the notice, to the consent request, and to the notice owed to existing users. IQWorks' own DPDP Act guide for startups puts the duty plainly: "Users must have the option to read the notice in English or any language of the Eighth Schedule to the Constitution (section 5(3))."

The 22 languages of the Eighth Schedule

The Act doesn't list the languages itself. It points to the Eighth Schedule, which is part of the Constitution of India. The Legislative Department's edition, as on 1 May 2024, lists these 22: Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santhali, Sindhi, Tamil, Telugu and Urdu.

The list has grown over time. The footnotes in the same edition record how each later language came in.

Two notes on names. The Constitution (Ninety-sixth Amendment) Act, 2011 replaced "Oriya" with "Odia" from 23 September 2011, so older documents may still say Oriya. The Schedule spells Santhali with an "h". If your language picker uses other spellings, map them to the Schedule's names in your records.

Because the DPDP Act points to the Schedule for the list, any future amendment to the Schedule would change the set of languages a Data Principal can ask for. So keep the language list in one configurable place that you can update if the Schedule changes.

When the language duties apply

The Act came into force in stages. Under G.S.R. 843(E), published on 13 November 2025, sections 3 to 5 and sub-sections (1) to (8) and (10) of section 6 come into force eighteen months from publication. That brings both section 5(3) and section 6(3) into force on 13 May 2027.

Rule 3, on what the notice must contain, follows the same clock. Rule 1(4) says Rules 3, 5 to 16, 22 and 23 "shall come into force eighteen months after the date of publication", which is also 13 May 2027.

Section 5(2) matters for timing. Once section 5 comes into force on 13 May 2027, a Data Fiduciary must, "as soon as it is reasonably practicable", give a notice to people who consented before that date. Section 1(2) reads any reference in a provision to the commencement of the Act as "a reference to the coming into force of that provision". Section 5(3) covers that notice too, so existing users get the same language option as new ones.

Why language changes what consent means

Section 6(1) says consent "shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action". A person who taps "I agree" under text they cannot read has taken an affirmative action. Whether they were informed is harder to say.

Rule 3(b) ties the notice to that same standard: it has to give enough detail "to enable the Data Principal to give specific and informed consent". The itemised list of personal data and the stated purpose only do that job if the reader can follow them, and sections 5(3) and 6(3) let the reader choose the language.

If consent is challenged, a Data Fiduciary will want to show what the person saw, including the language. A consent record that holds only "accepted" and a timestamp says nothing about which version of the notice was on screen. Records that can be checked later are covered in tamper-evident consent and verifiable proof.

What the Act and Rules leave open

The text is short, so several questions have no written answer.

• Neither section 5(3) nor section 6(3) says whether each language version must exist before anyone asks, or whether it can be produced when a Data Principal picks a language.
• Section 6(3) asks for "a clear and plain language", and Rule 3(b) asks for "clear and plain language" in the notice. Neither says how a translation should be checked.
• The Act refers to languages and says nothing about scripts. Where a language is written in more than one script, you will have to choose.
• Nothing in section 5(3) or section 6(3) requires languages outside English and the Eighth Schedule. Nothing limits the option to a subset of the 22 or to the languages of one state either.
• The Act gives the option to the Data Principal. It doesn't say how the choice should appear on a cookie banner, a signup form or an app screen.

The Act and Rules don't settle these points, so take legal advice on how they apply to your product.

How to run multilingual notices in practice

A workable process treats every language version as part of one notice, with one owner and one version history.

1. Draft the source notice once, from your record of processing, with the itemised personal data and each purpose that Rule 3(b) asks for.
2. Produce each language version from that source, so a change to the source triggers a change to every version.
3. Have translations reviewed. The IQWorks startups guide warns: "Have translations reviewed, because machine translation of legal terms can mislead."
4. Version every language variant with the source, and retire old versions together.
5. Put the language choice where the Data Principal sees the notice and the consent request, since section 6(3) applies to the request as well.
6. Record the language and notice version each person saw alongside the consent itself.
7. Include the contact details section 6(3) requires in every language version.

Notices change after launch. A purpose gets narrowed, a data item is added, and the English text changes. If 22 translations are maintained by hand, some will lag behind. Generating or updating every version from one source, then reviewing it, keeps them aligned.

How IQWorks handles notice languages

At IQWorks, notice drafting and translation sit in ComplyIQ, and consent capture sits in ConsentIQ.

The ComplyIQ FAQ on notice languages says: "ComplyIQ supports all 22 scheduled Indian languages including Hindi, Bengali, Telugu, Marathi, Tamil, Gujarati, Kannada, Malayalam, and more." It adds: "Our AI generates notices and provides real-time streaming translation, with version control across all language variants." The consent management solution page lists, under ComplyIQ, "Translations into the 22 scheduled Indian languages, or eight European languages for GDPR".

Source: IQWorks, privacy programme automation solution page, iqworks.ai/solutions/privacy-program-automation-solution

On the consent side, the DPDPA vs PDPL comparison says: "ConsentIQ handles the consent side, including multilingual notices and verifiable proof of what was consented to." The consent management solution page lists, for ConsentIQ, "A digitally signed record of each consent, in a console that masks personal identifiers".

Frequently asked questions

How many languages does the DPDP Act cover for consent notices?

English plus the 22 languages in the Eighth Schedule to the Constitution. Section 5(3) gives the Data Principal the option to access the notice in English or any Eighth Schedule language, and section 6(3) gives the same option for the consent request. The Act points to the Schedule for its list of languages, so it follows any amendment to it.

Does the language option apply to the consent request or only the notice?

Both. Section 5(3) covers the notice under sections 5(1) and 5(2). Section 6(3) separately says every request for consent must be in clear and plain language, with the option to access it in English or any Eighth Schedule language. It also requires contact details for a Data Protection Officer, where applicable, or another authorised person.

When do the DPDP language requirements come into force?

On 13 May 2027. G.S.R. 843(E), published on 13 November 2025, brings sections 3 to 5 and sub-sections (1) to (8) and (10) of section 6 into force eighteen months after publication. Rule 1(4) of the DPDP Rules, 2025 brings Rule 3, on notice content, into force on the same eighteen-month timeline.

Do existing users need a notice in their language?

They need the notice, with the same language option. Section 5(2) says that where consent was given before section 5 came into force, the Data Fiduciary must give a notice as soon as it is reasonably practicable. Section 5(3) applies the language option to notices under both sections 5(1) and 5(2), so existing users can choose English or any Eighth Schedule language, as new users can.

Can a Data Fiduciary use machine translation for DPDP notices?

The Act and Rules don't address how translations are produced. Section 6(3) and Rule 3(b) both ask for clear and plain language, and Rule 3(b) asks for enough detail to enable specific and informed consent. A reviewed translation is the safer way to meet that standard.

The short version

Section 5(3) and section 6(3) of the DPDP Act let every Data Principal read the notice and the consent request in English or any of the 22 Eighth Schedule languages, from 13 May 2027. Build the language list from the Schedule, generate every version from one source, review the translations and record which version each person saw. If you are preparing notices and consent requests for 13 May 2027, book a demo of ComplyIQ and ConsentIQ.

Related reading

Verifying a child's age and guardian consent under DPDP and how consent management platforms compare for DPDP compliance.