Buried in Section 5(3) of the DPDP Act 2023 is the requirement most compliance checklists skip: every Data Principal has the option to access your privacy notice "in English or any language specified in the Eighth Schedule to the Constitution" — 22 languages. Here's what that means in practice, and what it doesn't.
What the Provision Actually Says
Section 5(3) attaches to the notice obligation of Section 5(1): the notice that accompanies every consent request must give the customer the option to access it in English or an Eighth-Schedule language. Two things follow. First, the choice of language belongs to the customer, not to you. Second, the obligation is about genuine accessibility — a notice the customer cannot read cannot produce the "informed" consent Section 6 demands.
Do You Really Need 22 Translations?
The pragmatic reading — and the one consistent with the Act's plain-language purpose — is that you must serve the languages your customers actually use. A Coimbatore retailer whose customers speak Tamil and English needs those two done well; maintaining a Bodo translation no customer will ever request does nothing for compliance in substance. What you cannot do is ignore the provision because translation is inconvenient: if a meaningful part of your customer base reads Hindi or Kannada, an English-only notice is a live gap.
The Operational Playbook
- Identify your real language set. Two to four languages cover most SMB customer bases.
- Translate the notice properly. Reviewed, plain-language translations — Rule 3's "clear and plain language" standard applies in every language you serve. Start from our notice-writing guide.
- Serve the right version automatically. Detect or ask; don't make customers hunt for a language toggle buried in a footer.
- Keep versions in sync. When the notice changes, every language version changes together — a stale translation is a wrong notice.
- Record the language served. Your consent record should say which language the customer consented in — that's your accessibility evidence.
Why This Is the Provision Worth Taking Seriously
India transacts in Indian languages — voice notes, WhatsApp orders, counter conversations. The businesses that treat Section 5(3) as a checkbox will serve English legalese to customers who tap through it uncomprehending, and hold consent records that prove exactly that. The businesses that serve real multilingual notices get something better than compliance: customers who actually understood what they agreed to. That's the thesis behind EasyDP's multilingual notices — your customers' own Indian languages across web, WhatsApp and offline, with the language logged on every consent.
References & Sources
- Ministry of Electronics & IT — The Digital Personal Data Protection Act, 2023 (Sections 5(1), 5(3), 6).
- The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) — Rule 3 (notice).
- Constitution of India — Eighth Schedule (22 scheduled languages).
General information, not legal advice. Verify obligations against the notified text for your specific business.