====================================================================
STARTING TEMPLATE from dpdprules.org
Consent request wording

Practical recommendation, not legal advice. Have your legal counsel
review and adapt this before use. Bracketed text marks what you must
fill in or decide.

Provisions tracked: section 6(1) and 6(3) of the DPDP Act 2023
(consent and the consent request), section 5 (notice). These sit in
the commencement group due eighteen months from the notification
gazette; the computed date 13 May 2027 is interpretation until
officially confirmed. Verified source references:
https://dpdprules.org/act/6 and https://dpdprules.org/act/5
====================================================================

Use this wording at the point where you ask for consent. The request
must be accompanied or preceded by your privacy notice.

--------------------------------------------------------------------

[Organisation name] asks for your consent to process the following
personal data:

  [itemised list, matching section 2 of your privacy notice]

for the following specified purposes only:

  [list each purpose, matching section 3 of your privacy notice]

Only the personal data necessary for these purposes will be
processed.

Your consent is your free choice. Saying no will not affect
[the service or benefit that does not depend on this data]. You can
withdraw your consent at any time, as easily as you give it, at
[link]. Withdrawal will not affect processing already carried out on
your consent.

Read the full privacy notice: [link to notice]

Questions about this request or your personal data:
[contact details of your Data Protection Officer, or of the person
authorised to respond to communications from Data Principals about
exercising their rights]

  [ ] I agree to the processing described above.
      [Use an unticked box, button press or equivalent clear
      affirmative action. Silence, inactivity or a prefilled box is
      unlikely to qualify as a clear affirmative action.]

--------------------------------------------------------------------
Checklist before you ship this request
--------------------------------------------------------------------

1. Free: no bundling of consent with unrelated terms and no
   detriment for refusing data that the purpose does not need.
2. Specific: each purpose is named; no "and other business
   purposes".
3. Informed: the notice reaches the person with or before this
   request and itemises the data and purposes.
4. Unconditional: access to goods or services is not conditioned on
   consent to processing that they do not need.
5. Unambiguous, with a clear affirmative action: the person must do
   something active to agree.
6. Limited: the request covers only the personal data necessary for
   the specified purposes.
7. The contact details of your Data Protection Officer, or of the
   person authorised to respond to communications from Data
   Principals about exercising their rights, are shown.