{"slug":"india-dpdp-consent-and-notice","id":"AIPT-OBL-0049","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0049","title":"Process personal data only with valid consent or a legitimate use, after notice","short_title":"Consent and notice","category":"privacy_data_protection","summary":"Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.\n","practical_action":"Inventory training and inference data sources and document the consent or legitimate use for each.","is_binding":true,"applies_from":null,"section":null,"source_reference":"Sections 4 to 7","official_source_url":"https://www.meity.gov.in/data-protection-framework","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["finance_and_credit","generative_ai"],"applicability":[{"description":"All Data Fiduciaries.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"Consent records and notices","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A controls on data for AI systems","note":"Original editorial mapping.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","relationship":"satisfies","note":"Legal basis and notice recorded for each training and inference data source.","confidence_level":"high","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai"},{"slug":"data-governance-and-dataset-documentation","title":"Data governance and dataset documentation","kind":"process","relationship":"supports","note":"Dataset documentation records consent status per source.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation"}],"url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice","policy":{"slug":"india-dpdp-act","title":"Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025","status":"partially_applicable","jurisdiction":"india","url":"https://aipolicytracker.org/policies/india-dpdp-act"}}