What must the notice say before consent is taken?

The notice must be clear, standalone and in plain language, and must be available in English or any language in the Eighth Schedule to the Constitution at the individual's choice. It must describe the personal data being collected and the purpose of processing, explain how the individual can exercise their rights, how consent can be withdrawn, and how to complain to the Data Protection Board. Good practice, reflected consistently across sector guidance, is to itemise the notice: what categories of data are collected, each purpose, where the data is stored and for how long, which third parties it is shared with, and the withdrawal and grievance routes. A notice that requires the reader to hunt for any of these is unlikely to support valid consent.