India's DPDP notice and consent, at your WooCommerce checkout.
From May 2027, a business that asks people in India for consent to use their personal data must first give them a clear, itemised notice, and let them withdraw consent as easily as they gave it. Our tools build that notice from your shop's own data and record consent at checkout and registration.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) is put into practice by the DPDP Rules 2025, published on 13 November 2025 (Gazette of India No. 760). Rules 3 and 5 to 16, which include the notice, children's data, retention, the customer's rights and grievances, apply eighteen months after publication: from 13 May 2027 by our count (one law firm counts 14 May 2027).
A request for consent must come with or after a notice (section 5). Rule 3 says the notice must be understandable on its own and give, in clear and plain language, an itemised description of the personal data, the purpose of each use, and how the customer can withdraw consent as easily as they gave it, exercise their rights and complain to the Data Protection Board of India.
Consent must be free, specific, informed and unambiguous, with a clear affirmative action (section 6(1)). Customers can ask for a summary of their data, correction, erasure and grievance redressal, and can nominate someone to act for them (sections 11 to 14). Rule 14(3) asks you to publish a period of at most 90 days for responding to grievances. The notice must be available in English or a language of the Eighth Schedule to the Constitution (section 5(3)).
The Act also covers shops outside India that offer goods or services to people in India (section 3(b)). Whether and how it applies to your shop, and which data you must keep, are questions for your lawyer.
The notice given by the Data Fiduciary to the Data Principal shall— … give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum, — (i) an itemised description of such personal data; and (ii) the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, such processing;
DPDP Notice Pro is sold here as an add-on to our free DPDP Notice and Consent plugin for WooCommerce. Neither is available yet: the free plugin is built and waiting for a legal review and its WordPress.org submission, and the Pro add-on is not on sale. Use Notify me and we will email you when they are.
W
WooCommerce Built — awaiting store submission
DPDP Notice and Consent for WooCommerce (free plugin)
Notice and consent for India's DPDP Act 2023 and DPDP Rules 2025 at WooCommerce checkout and registration, with a consent log and withdrawal page. Free, GPL.
Built and waiting for a legal review and its submission to the WordPress.org plugin directory. The WordPress.org directory reviews one plugin per author at a time, so it goes in after Kündigungsbutton is approved. DPDP Notice Pro, sold here, builds on it.
Rights-request workflow with deadlines, CSV/PDF exports and WooCommerce erasure, a Hindi notice, consent reports and retention reminders for WooCommerce shops selling to customers in India.
Free: proposes an itemised notice from your shop's checkout fields, payment and shipping methods and registration settings. Nothing is shown to customers until you check and publish it.
Free: shows the notice above one unticked checkbox per purpose at the Checkout block, the classic checkout and registration, for customers with an Indian address or for everyone.
Free: logs each consent per purpose with the notice version, and gives customers a "Your data rights" page to withdraw as easily as they consented.
Pro: a rights-request workflow with deadlines, CSV and PDF exports and WooCommerce erasure, the notice in Hindi, consent reports and retention reminders.
What it doesn't do
Collect verifiable parental consent for children (rule 10). It offers an optional 18+ confirmation only.
Report personal data breaches (rule 7) or act as a Consent Manager (rule 4).
Translate the notice into languages other than English and Hindi. The Hindi text has not yet been reviewed by a native speaker.
Decide whether the Act applies to you or which data you must keep: your lawyer does.
