Feature · notice and translation

A notice nobody can read is not a notice

Section 5(3) is one of the clauses in the DPDP Act with no European ancestor. It gives the data principal the right to be given the notice in English or in any language specified in the Eighth Schedule to the Constitution — twenty-two of them. That is a product requirement disguised as a legal one, and it is the requirement most platforms built for GDPR simply do not have an answer for.

Priya Gupta

Part of

AI Policy Generator

Translation runs on the notice the generator produces. The module covers drafting, clause grounding, versioning and publication.

It is the Eighth Schedule, not the First

Worth stating plainly because the error is common: the languages of India are listed in the Eighth Schedule to the Constitution. The First Schedule lists the States and Union Territories. A notice page that cites the wrong Schedule is a small error with a large signal attached, because it suggests nobody checked.

The Eighth Schedule list, as the platform implements it, is: Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu and Urdu. Twenty-two, plus English as the source language, which is where the twenty-three you will see in the configuration comes from.

Batched calls, strict JSON, and a batch that must come back whole

Translation is neither one call per language nor one call for everything. Languages go to the model in batches of four or five, each a structured-output request that returns the batch keyed by ISO code with the translated name and description. A batch is accepted only when every language in it came back; a language the model skipped stays marked as needing translation and is retried on the next run, rather than being quietly filled with English. The call site is provider-agnostic, so the same path runs against whichever model provider a deployment is configured for.

The instruction the model is given is more interesting than the mechanism. It is told to hold the legal register rather than simplifying it, and specifically not to soften the words that carry legal meaning — consent, process, share, withdraw. It is told which script each language takes, because the naive failure is to render Konkani in Kannada script or Manipuri in Latin. And it is told to leave certain tokens alone: DPDP, India, DPO, API stay as they are rather than being helpfully localised into something unsearchable.

The hash that stops you paying for whitespace

Every translated row carries a hash of the source text it was produced from. Before a re-translation runs, the existing rows are checked against the hash of the current source; if they match, nothing is called. Re-saving a purpose whose text differs only in surrounding whitespace does not re-translate anything.

The same column does a second job. A row that a human has edited is marked as no longer machine-translated, and every subsequent automatic run skips that language entirely. This is the rule that makes reviewed translations worth commissioning: once your Tamil counsel has corrected the Tamil notice, no later automated pass can overwrite it.

There is no approval queue, and you should know that

Machine translations go live when they are generated. There is no staging state, no reviewer sign-off and no hold. What exists instead is the protection described above — a human edit is permanent and is never clobbered — plus a staleness flag on policy documents so you can see which translations were produced from text that has since changed.

Whether that is acceptable depends on the surface. For a cookie purpose description it usually is. For the notice on a financial product in a language your legal team does not read, commission a review and edit the row; the edit locks. Pretending a review gate exists when it does not would be the worse option.

What is translated, and what is honestly not

Translation coverage is not uniform across the platform, and a page that claims it is would be wrong. The list below is what the code does today.

  • Consent purpose names and descriptions — machine-translated into eighteen of the twenty-two. Bodo, Dogri, Maithili and Santali are held back until the consent page has its own interface text in those languages, so nobody is offered a switch into a page that is still in another language.
  • Notice titles and bodies — the same eighteen, through the same pipeline.
  • The hosted preference centre's own chrome — hand-authored in all twenty-three, with right-to-left rendering for Urdu, Kashmiri and Sindhi.
  • Cookie banner copy and the signup consent step — packs for all twenty-three.
  • Generated privacy policies — translated into all twenty-two, run in the background because a full document is several model calls, and written in one batch so a half-translated document is never persisted.
  • The live embedded widget's own button and heading text — English only. Purpose and notice copy inside it is localised; the chrome around it is not.
  • Data principal request replies — not translated; there is no translation step anywhere in that path.

Fallback, and the flag that admits to it

Fallback is per row and per language rather than per page. If the Odia translation of one purpose is missing, that purpose renders in English and the rest of the page stays in Odia — and the response carries a flag saying which of the two you are looking at.

That flag is the part worth insisting on. A preference centre that silently substitutes English under a Tamil heading has produced a page that looks translated and is not, which is exactly the outcome §5(3) is trying to prevent. And when the model is unavailable entirely, the English row is seeded deterministically from the internal notice text so publication is never blocked by an outage.

The problems nobody warns you about

Script and font come first. Ol Chiki for Santali and Meetei Mayek for Manipuri are not in most default system font stacks, and a page that serves them without a webfont serves boxes. Test on a low-end Android device, not a designer's laptop.

Length comes second. Devanagari and Bengali renderings of the same sentence run longer than the English, and a banner laid out to fit English accept and reject labels will wrap or clip in Marathi. Fixed-height banners are where this shows up.

And a caution about the quality of what the packs contain. Our own public consent page's language packs carry a header saying they are machine-translated and have not had legal review, that the Kashmiri pack currently carries Urdu text and the Manipuri pack Bengali text, and that four packs were removed for being close to identical to Hindi or English. That is an honest note in our own code and it belongs on this page rather than in a comment nobody outside the team reads.

Questions teams ask about this

Do we have to publish the notice in all twenty-two languages?

The obligation is framed as the data principal's right to be given the notice in English or in any Eighth Schedule language, so the practical answer is that you must be able to serve the language asked for rather than pre-publishing twenty-two static pages. Generating them ahead of time and serving by language preference is the straightforward way to be able to answer any request, which is why the platform translates before anyone asks rather than when they do.

Will a machine-translated notice be overwritten if we have it professionally reviewed?

No. Editing a translation marks that row as human-authored, and every later automatic run skips that language. This is deliberate — a reviewed translation is expensive, and a pipeline that could silently replace it would make commissioning one pointless.

What does a visitor see if a translation is missing for one purpose?

That purpose renders in English while the rest of the page stays in the chosen language, and the response carries a flag marking it as a fallback rather than a translation. Falling back silently would produce a page that looks localised and is not, which is the outcome the language obligation exists to prevent.

Are data principal request responses translated too?

Not today. Notices, consent purposes, banner copy, the preference centre and generated policies are; replies to access, correction and erasure requests are not — there is no translation step in that path. Where a request arrives in a regional language, the reply is drafted by a human today.

Describes how ProtectComply implements one obligation under the DPDP Act, 2023 and the DPDP Rules. General information, not legal advice.

Priya Gupta — Priya writes on compliance operations at ProtectComply, including data principal rights, grievance handling and sector-specific programmes.

Generate a notice, then read it in Marathi

Draft the §5(3) notice from your organisation profile and have the Eighth Schedule versions written from it.

Generate a notice →