Feature · notice and translation
Section 5(3) is one of the clauses in the DPDP Act with no European ancestor. It gives the data principal the right to be given the notice in English or in any language specified in the Eighth Schedule to the Constitution — twenty-two of them. That is a product requirement disguised as a legal one, and it is the requirement most platforms built for GDPR simply do not have an answer for.
Part of
Translation runs on the notice the generator produces. The module covers drafting, clause grounding, versioning and publication.
Worth stating plainly because the error is common: the languages of India are listed in the Eighth Schedule to the Constitution. The First Schedule lists the States and Union Territories. A notice page that cites the wrong Schedule is a small error with a large signal attached, because it suggests nobody checked.
The Eighth Schedule list, as the platform implements it, is: Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu and Urdu. Twenty-two, plus English as the source language, which is where the twenty-three you will see in the configuration comes from.
Translation is neither one call per language nor one call for everything. Languages go to the model in batches of four or five, each a structured-output request that returns the batch keyed by ISO code with the translated name and description. A batch is accepted only when every language in it came back; a language the model skipped stays marked as needing translation and is retried on the next run, rather than being quietly filled with English. The call site is provider-agnostic, so the same path runs against whichever model provider a deployment is configured for.
The instruction the model is given is more interesting than the mechanism. It is told to hold the legal register rather than simplifying it, and specifically not to soften the words that carry legal meaning — consent, process, share, withdraw. It is told which script each language takes, because the naive failure is to render Konkani in Kannada script or Manipuri in Latin. And it is told to leave certain tokens alone: DPDP, India, DPO, API stay as they are rather than being helpfully localised into something unsearchable.
Every translated row carries a hash of the source text it was produced from. Before a re-translation runs, the existing rows are checked against the hash of the current source; if they match, nothing is called. Re-saving a purpose whose text differs only in surrounding whitespace does not re-translate anything.
The same column does a second job. A row that a human has edited is marked as no longer machine-translated, and every subsequent automatic run skips that language entirely. This is the rule that makes reviewed translations worth commissioning: once your Tamil counsel has corrected the Tamil notice, no later automated pass can overwrite it.
Machine translations go live when they are generated. There is no staging state, no reviewer sign-off and no hold. What exists instead is the protection described above — a human edit is permanent and is never clobbered — plus a staleness flag on policy documents so you can see which translations were produced from text that has since changed.
Whether that is acceptable depends on the surface. For a cookie purpose description it usually is. For the notice on a financial product in a language your legal team does not read, commission a review and edit the row; the edit locks. Pretending a review gate exists when it does not would be the worse option.
Translation coverage is not uniform across the platform, and a page that claims it is would be wrong. The list below is what the code does today.
Fallback is per row and per language rather than per page. If the Odia translation of one purpose is missing, that purpose renders in English and the rest of the page stays in Odia — and the response carries a flag saying which of the two you are looking at.
That flag is the part worth insisting on. A preference centre that silently substitutes English under a Tamil heading has produced a page that looks translated and is not, which is exactly the outcome §5(3) is trying to prevent. And when the model is unavailable entirely, the English row is seeded deterministically from the internal notice text so publication is never blocked by an outage.
Script and font come first. Ol Chiki for Santali and Meetei Mayek for Manipuri are not in most default system font stacks, and a page that serves them without a webfont serves boxes. Test on a low-end Android device, not a designer's laptop.
Length comes second. Devanagari and Bengali renderings of the same sentence run longer than the English, and a banner laid out to fit English accept and reject labels will wrap or clip in Marathi. Fixed-height banners are where this shows up.
And a caution about the quality of what the packs contain. Our own public consent page's language packs carry a header saying they are machine-translated and have not had legal review, that the Kashmiri pack currently carries Urdu text and the Manipuri pack Bengali text, and that four packs were removed for being close to identical to Hindi or English. That is an honest note in our own code and it belongs on this page rather than in a comment nobody outside the team reads.
The obligation is framed as the data principal's right to be given the notice in English or in any Eighth Schedule language, so the practical answer is that you must be able to serve the language asked for rather than pre-publishing twenty-two static pages. Generating them ahead of time and serving by language preference is the straightforward way to be able to answer any request, which is why the platform translates before anyone asks rather than when they do.
No. Editing a translation marks that row as human-authored, and every later automatic run skips that language. This is deliberate — a reviewed translation is expensive, and a pipeline that could silently replace it would make commissioning one pointless.
That purpose renders in English while the rest of the page stays in the chosen language, and the response carries a flag marking it as a fallback rather than a translation. Falling back silently would produce a page that looks localised and is not, which is the outcome the language obligation exists to prevent.
Not today. Notices, consent purposes, banner copy, the preference centre and generated policies are; replies to access, correction and erasure requests are not — there is no translation step in that path. Where a request arrives in a regional language, the reply is drafted by a human today.
Describes how ProtectComply implements one obligation under the DPDP Act, 2023 and the DPDP Rules. General information, not legal advice.
Priya Gupta — Priya writes on compliance operations at ProtectComply, including data principal rights, grievance handling and sector-specific programmes.
Draft the §5(3) notice from your organisation profile and have the Eighth Schedule versions written from it.
Generate a notice →