Imagine a banking app that asks for permission through a pop-up bundling several policies. “Accept” is a bright green button, “Decline” is a faint grey link, and most people tap Accept without reading. Consent has technically been collected, but it may not be valid.
That is the heart of UX compliance under the Digital Personal Data Protection DPDP Act 2023. Consent must be free, informed, specific, unconditional and unambiguous, given by a clear affirmative action. Whether a user can actually meet that standard depends on what the screen looks like. Privacy is no longer only a job for the legal team; it is a design responsibility.
What UX compliance means
It means designing products so every data interaction follows privacy law while staying simple and transparent. That covers consent collection, privacy notices, cookie preferences, sharing permissions, account settings, withdrawal, deletion requests and user rights. Users should be able to tell what is collected, why, how it is used, who receives it, how long it is kept and how to withdraw.
Why it matters
Under the Act, the individual is the Data Principal and the organisation is the Data Fiduciary. If people cannot reasonably understand what they are agreeing to, the consent is questionable, and a confusing interface becomes a compliance risk. Typical culprits are hidden options, pre-selected checkboxes, dense legal language, forced acceptance, bundled permissions, dark patterns and difficult withdrawal.
Four design rules that follow from the Act
Give a clear notice first. Before asking for consent, explain the data collected, the purpose, the person’s rights, how to complain and who to contact. Use simple language, bullet points, progressive disclosure, icons and layouts that work on a phone.
Make consent an active choice. Good patterns include clicking an agree button, picking preferences and switching on optional permissions. Poor ones include pre-ticked boxes, consent buried in the Terms of Service and automatic opt-in.
Keep to the purpose. Say exactly why you need each item. A mobile number is collected to send transaction alerts, not just “to improve your experience”.
Make withdrawal as easy as consent. Emailing support, waiting five working days, filling in a PDF or clicking through several confirmation pages fails the test. One-click withdrawal, a simple privacy dashboard, instant confirmation and an audit log pass it.
Dark patterns
Dark patterns push people into decisions they would not otherwise make, which undermines the idea that consent is freely given. Watch for:
- Confirmshaming: decline text that makes the user feel they do not care about privacy
- Hidden decline: a prominent Accept with an invisible Reject
- Forced consent: access to the service tied to unnecessary data collection
- Extra steps: one click to accept, several to refuse
- Misleading colour: green for continue, grey for privacy
A consent screen that works
It should answer five questions: what data, why, for how long, can I change my mind, and where can I learn more. Say plainly what is collected (email, phone, location), the purpose (service delivery, fraud prevention, marketing), the retention period, how to withdraw, and where to find the privacy policy, support contact and grievance route.
Privacy dashboards
Instead of burying controls in account settings, give users one dashboard showing active consents and purposes, consent history, third-party sharing, withdrawal and deletion controls, data download, complaint submission and an activity log.
Principles that hold up
Be transparent in everyday words, such as “We use your email to send account updates”. Keep it simple enough to grasp in seconds. Support screen readers, mobile users, older users and people with low literacy. Keep controls consistent across website, app and customer portal. Let people edit preferences, withdraw, download data and delete their account.
Common mistakes
Twenty-page privacy policies at registration, legal jargon, repeated prompts that cause consent fatigue, settings buried deep in menus, and designs that break on mobile. Since most Indian users reach services on smartphones, design mobile-first.
Measure it
Track privacy UX alongside legal compliance: acceptance and withdrawal rates, time taken to withdraw, dashboard use, deletion request turnaround, complaints, notice readability, accessibility and audit success.
Checklist
- Write short, plain-language notices.
- Collect only what the stated purpose needs.
- Get explicit consent through an affirmative action.
- Avoid pre-selected boxes and dark patterns.
- Give Accept and Decline equal prominence.
- Make withdrawal as easy as consent.
- Offer a central privacy dashboard.
- Keep complete, time-stamped audit logs.
- Make privacy screens mobile-friendly and accessible.
- Review consent flows regularly.
The takeaway
Compliance has to show up in the interface, not just in legal documents and back-end controls. A privacy-first design helps people make informed choices, lowers regulatory risk and builds trust.