Does the DPDP notice have to be in 22 languages? What section 5(3) actually says

A claim keeps appearing in vendor decks and compliance blogs: DPDP notices "must be presented in English or any of the 22 languages", or bluntly, "your privacy notice has to be in 22 languages". The actual provision says something narrower and more interesting, and the difference decides whether you are running a translation readiness programme or a 22 language publishing project.

What section 5 requires before the language question arises

Section 5(1) requires that every request for consent under section 6 be accompanied or preceded by a notice from the Data Fiduciary telling the Data Principal three things: the personal data and the purpose for which it is proposed to be processed, the manner in which she may exercise her rights under section 6(4) and section 13, and the manner in which she may complain to the Data Protection Board. Section 5(2) extends this to consent collected before the Act commences: a comparable notice must go out as soon as reasonably practicable, and processing may continue unless and until consent is withdrawn.

That is the notice. Then comes the subsection everyone paraphrases.

The language subsection, verbatim

"The Data Fiduciary shall give the Data Principal the option to access the contents of the notice referred to in sub-sections (1) and (2) in English or any language specified in the Eighth Schedule to the Constitution."

Read it slowly, because every word is doing work.

Whose option it is. The duty on the Data Fiduciary is to give the Data Principal the option. The choice of language belongs to the individual reading the notice, not to the organisation writing it. A fiduciary that publishes its notice in English alone and calls that "English or any of the 22 languages, and we picked English" has inverted the sentence.

What the option covers. The option is to access the contents of the notice. The person must be able to read what the notice says, in full, in the language they opt for. It is an access guarantee attached to the notice contents, not a formatting instruction about how the notice is first presented.

What it does not say. The text does not say the notice must be presented in every listed language simultaneously, and it does not say the fiduciary may satisfy the provision by choosing any one language from the list. Operationally, the plain reading is this: whichever of the listed languages a Data Principal opts for, you must be able to serve the notice contents in that language.

Where the number 22 comes from

The DPDP Act and the DPDP Rules never state a number. The words are "in English or any language specified in the Eighth Schedule to the Constitution", full stop. As widely published background about the Constitution of India, and not something found anywhere in the DPDP documents themselves, the Eighth Schedule currently lists 22 languages. The legal anchor is the reference to the Schedule, so if the Schedule ever changes, the notice obligation follows it automatically. Precision here is not pedantry: pinning your compliance documentation to "22 languages" hardcodes a constitutional fact the DPDP text deliberately left as a reference.

The consent request carries the same option

Section 6(3) requires every request for consent to be presented in clear and plain language, "giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution", together with the contact details of a Data Protection Officer where applicable or another authorised contact. So the language capability you build is used twice: once for the section 5 notice and once for the consent request itself. Build it as one system.

Rule 3 sets the quality bar in every language

Rule 3 shapes what the notice must be wherever it appears: presented and understandable independently of any other information, written in clear and plain language, giving a fair account sufficient for specific and informed consent, including at minimum an itemised description of the personal data and the specified purposes with a specific description of the goods, services or uses enabled, plus the communication link and any other means to withdraw consent with comparable ease, exercise rights and complain to the Board.

Nothing in Rule 3 is English only. A translated notice that drops the itemised data description, compresses the purposes, or loses the withdrawal link fails Rule 3 exactly as an English notice would. Translation is not summarisation.

What this means for an app or a website

In practice, giving the option looks like ordinary product work. A language selector on the notice and consent screens, or honouring the account or device language with a visible way to switch, is the natural mechanism. Behind it, keep the notice as structured content so that when a purpose changes, every language version updates together; a stale translation is a wrong notice, and section 5 does not have a good language exception.

Which languages to prepare first is a business call. The statute gives the individual the option across the whole list, so plan your pipeline for the full list, but sequencing by the languages your users actually read is a recommendation grade decision the text leaves to you. The text ranks nothing; it only guarantees the option.

The vendor phrasing, corrected politely

"Must be presented in English or any of the 22 languages" is an understandable compression, but it makes two quiet substitutions: it turns give the option to access into present, and it hands the choice implied by "or any" to the fiduciary instead of the Data Principal. The stronger variant, "must be in 22 languages", overshoots in the other direction by inventing a simultaneous publication duty. Compliance planning should run on the words: give each person the option, and be ready to honour whichever language they pick.

When this bites

Section 5 sits in the eighteen month commencement group of notification G.S.R. 843(E) paragraph (c), and Rule 3 sits in the eighteen month group of Rule 1(4). Both compute to 13 May 2027, interpretation until officially confirmed. Multilingual notice readiness is slow, unglamorous work, which is exactly why the preparation window exists.

What to do

Draft the master notice with the privacy notice generator; it assembles the Rule 3 elements from your inputs so translations start from a complete skeleton. Then run your current notice, and the structure of each translated version, through the privacy notice checker, which maps every gap to the exact provision. The official texts live at Section 5 and Rule 3.