DPDP Multilingual Consent: The 22-Language Rule and How to Implement It
Short answer: DPDP multilingual consent means giving every person the option to read your privacy notice and your consent request in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution. Sections 5(3) and 6(3) of the Digital Personal Data Protection Act, 2023 (DPDP Act) set this rule. In addition, the organisation must be able to prove which version the person saw when they agreed.
Most teams treat DPDP multilingual consent as a translation task. However, the Act treats it as part of what makes consent valid. This guide explains what the law says, how DPDP multilingual consent works inside a real consent flow, where teams usually go wrong, and how to evaluate tools that claim to support it. The substantive consent and notice obligations commence on 13 May 2027, so there is still time to build it properly.
What is DPDP multilingual consent?
DPDP multilingual consent is the practice of offering notices and consent requests in the language a Data Principal chooses. The Data Principal is the person the data is about. The Data Fiduciary is the business that decides why and how the data is processed.
In practice, DPDP multilingual consent has three parts. First, the person must be able to pick a language. Second, the notice and the consent request must be available in that language. Third, the business must record the language and the exact text version that was shown. Without that record, the business cannot meet its burden of proof later.
What the DPDP Act says about language
Two provisions matter here. Section 5(3) of the DPDP Act says the Data Fiduciary shall give the Data Principal “the option to access the contents of the notice” in English or any language specified in the Eighth Schedule to the Constitution.
Similarly, Section 6(3) says every request for consent must be “presented to the Data Principal in a clear and plain language”. It must also give her the option to access that request in English or any Eighth Schedule language.
Two further provisions raise the stakes. Section 6(10) places the burden of proof on the business. If a dispute arises, the Data Fiduciary must prove that it gave notice and that consent followed the Act. Meanwhile, Rule 3 of the DPDP Rules, 2025 requires the notice itself to be clear and plain. It must also give an itemised description of the personal data and the specified purpose. For a plain-English walkthrough of the short answer, see our FAQ on which language a DPDP notice must be in.
Legal requirement vs recommendation: the language option is a legal requirement. Detecting the browser language, storing the text version and reviewing translations are our practical recommendations. They are how most teams show they met the requirement.
Which languages count?
The Eighth Schedule to the Constitution lists 22 languages. Together with English, that gives 23 options. The 22 languages are Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu and Urdu.
The Act says “any language”, so you cannot pick a short list and stop there. That said, many businesses will see most choices come from a handful of languages in their region. Therefore, a sensible DPDP multilingual consent plan is to ship all 22, then review the most used versions first and most often.
How DPDP multilingual consent works in practice
Under the hood, DPDP multilingual consent is a versioning problem as much as a language problem. Every notice has a master version, usually in English. Each translation is a child version that is locked to that master. When the master changes, every translation must be refreshed before it goes live.
A working flow usually has five steps:
- Language choice. The page suggests a language from the browser or app setting. However, the person can always switch.
- Versioned notice. The system loads the notice for that language, tied to a master version number.
- Consent capture. The consent request appears in the same language, with one unticked choice per purpose.
- Consent record. The record stores the person, the purposes, the time, the language code and the text version ID.
- Proof on request. Later, you can show exactly what the person read, in the language they chose.
A practical example
Consider a lending app with most users in Maharashtra. A user opens the app with her phone set to Marathi. As a result, the app shows the notice in Marathi first. She reads it, ticks the purpose for loan processing, and leaves the marketing purpose unticked. The consent record stores “mr”, notice version 4.2, and both purpose choices.
Six months later, she complains that she never agreed to credit bureau checks. Because the record holds the Marathi text version, the lender can show the exact sentence she saw. Without that record, the lender would only have an English template and a timestamp. That is a much weaker position under Section 6(10).
Machine translation and “clear and plain language”
AI translation makes DPDP multilingual consent affordable across all 22 languages. However, the Act asks for clear and plain language, not just any translation. A literal translation of dense legal English can still be hard to follow.
For this reason, a practical workflow looks like this. First, simplify the English master before you translate it. Next, run machine translation for all languages. Then, have a fluent reviewer check the highest-traffic languages and every high-risk purpose, such as data sharing or children’s data. Finally, lock each reviewed version and log who approved it.
This is a recommendation, not a statutory checklist. Even so, it gives you evidence that you took reasonable care. The Act does not name a translation method.
Where the language option applies beyond the consent banner
Teams often limit DPDP multilingual consent to the cookie banner. In reality, several other touchpoints carry notice or consent content:
- Standalone notices in apps, web forms and onboarding flows. See our DPDP privacy notice template for the Rule 3 structure.
- Consent withdrawal screens, since Section 6(4) says withdrawal must be as easy as giving consent.
- Rights and grievance portals, where people ask to access, correct or erase data.
- Offline and assisted channels, such as branch forms and call centres.
Strictly, Sections 5(3) and 6(3) cover the notice and the consent request. Extending the same language to withdrawal, rights and breach messages is our recommendation. After all, a person who consented in Tamil will struggle to withdraw in English.
Comparing approaches to DPDP multilingual consent
Broadly, businesses choose between three approaches. The right one depends on how many channels you run and how often your notices change.
| Approach | Best for | Main risk |
|---|---|---|
| Manual translation files | One website, notices that rarely change | Versions drift and proof is hard |
| Generic consent tool with add-on languages | Cookie consent on global sites | Often misses Eighth Schedule coverage |
| DPDP-native consent platform | Many channels and frequent changes | Needs set-up and review time |
If you are comparing DPDP multilingual consent tools, ask each vendor four direct questions. Does it cover all 22 Eighth Schedule languages? Does each consent record store the language and text version? Can a person switch language at any point? Does withdrawal work in the same language? Our guide to DPDP compliance software covers the wider evaluation.
Pros and cons of platform-led DPDP multilingual consent
Pros:
- All languages stay in sync with one master notice.
- Each consent record carries its language and version, so proof is ready.
- Withdrawal and rights requests can reuse the same language.
Cons:
- Machine translation still needs human review for key languages.
- Set-up takes effort, especially for offline channels.
- A platform does not make a business compliant on its own. Your purposes, notices and processes still decide that.
Common mistakes with DPDP multilingual consent
The same mistakes appear again and again:
- Translating only the banner. The full notice stays in English, so the person still cannot understand it.
- No version link. Translations are not tied to the English master, so they drift after updates.
- Forcing a language. The app picks a language from the location and hides the switch.
- Not storing the language. The consent record has a timestamp but no language code or text version.
- Treating it as a website task. Call centres and branch forms get left out.
Each of these weakens the consent artefact you would rely on in a dispute.
How we measure success
To track DPDP multilingual consent, we suggest a small set of indicators rather than a single score. These are the measures we would use. We do not publish benchmark numbers for them here, because results vary by business.
- Coverage: the share of consent touchpoints that offer all 22 languages plus English.
- Proof completeness: the share of consent records that store a language code and text version.
- Freshness: the time between a master notice change and all translations going live.
- Review depth: the share of high-traffic languages checked by a fluent reviewer.
- Parity: whether withdrawal and rights requests work in every language that consent does.
Frequently asked questions
How many languages must a DPDP notice be available in?
The person must have the option of English or any of the 22 languages in the Eighth Schedule to the Constitution. In effect, that means up to 23 options. The Act does not let you choose a subset.
Does the consent request also need to be multilingual?
Yes. Section 6(3) gives the person the option to access the consent request in English or any Eighth Schedule language, in addition to the notice under Section 5(3).
Is machine translation enough?
The Act does not ban it for DPDP multilingual consent. However, the text must be clear and plain. Therefore, we recommend simplifying the English master first and having fluent reviewers check your most used languages.
Do we need to store the language in the consent record?
The Act does not list record fields. Even so, Section 6(10) puts the burden of proof on you. Storing the language code and text version is the most direct way to meet it.
When do these obligations apply?
The DPDP Rules were notified on 13 November 2025. Rule 3 on notices commences eighteen months later, on 13 May 2027, along with the core consent obligations.
Does ProtectComply guarantee DPDP compliance?
No tool can guarantee compliance on its own. ProtectComply provides the consent, notice and record-keeping tooling. Your purposes, decisions and processes still determine compliance.
Summary and next step
In short, DPDP multilingual consent is a legal requirement with a proof problem attached. Offer all 22 Eighth Schedule languages plus English, keep every translation tied to a master version, and store the language and version in every consent record. Then extend the same language to withdrawal and rights requests.
ProtectComply’s consent module includes 22-language auto-translation for notices, banners and rights responses. It also keeps consent records with provenance. See how the consent features work, browse the product modules, or request a walkthrough against your current notices.
Published by Jupinder Singh Bedi, CEO and Co-Founder, ProtectComply. SEO: Yatin Chaudhary. Legal references: Digital Personal Data Protection Act, 2023, Sections 5, 6 and 6(10); Digital Personal Data Protection Rules, 2025, Rules 1 and 3; Eighth Schedule to the Constitution of India. This article is general information, not legal advice.