Tamra Patra
4notify India · The Copper-Plate Edicts
EDICT · UIDAI · DigiLocker · MeitY · TRAI NCPR
Tamra Patra
TP-IN-005
Date
2026-05-27
Status
In force
Category
Privacy and identity

Aadhaar / UIDAI eKYC, DigiLocker, DPDP Act 2023 consent and TRAI NCPR (DND): the consent framework for transactional and commercial delivery

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first cross-sectoral data protection law and creates the office of the Data Protection Board of India. For commercial communication you need a documented purpose and a verifiable consent; for transactional you need a lawful basis. Add to that UIDAI's Aadhaar / eKYC framework (with masked Aadhaar mandatory off the UIDAI server), DigiLocker for citizen documents, and the TRAI NCPR (the National Customer Preference Register — India's DND). 4notify records the lawful basis on every envelope and verifies consent at the API edge, before despatch.

EmailSMSWebhook
Preamble

Whereas, by virtue of the powers vested by the Digital Personal Data Protection Act, 2023, the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and the TRAI Act, 1997, and in furtherance of the TCCCPR 2018 NCPR regime, this edict is issued upon consent management in electronic delivery.

Statutory basis
Digital Personal Data Protection Act, 2023

India's first cross-sectoral data protection statute; defines Data Fiduciary, Data Principal, and the office of the Data Protection Board of India.

Aadhaar Act, 2016 and UIDAI Regulations

Aadhaar / eKYC framework, masked Aadhaar mandate (last 4 digits only), and offline KYC.

TCCCPR 2018 — NCPR / DND Schedule

TRAI's National Customer Preference Register — Full DND and category-DND enforcement.

Implementation
01

Lawful basis recorded per envelope

Every envelope carries one of the DPDP lawful bases (consent, legitimate use, employment, compliance with law). The basis is locked to the Template registration.

02

Commercial consent verification

For commercial messages the consent record is verified at the API edge; envelopes without permission are blocked before despatch. Consent token is stored with a timestamp.

03

TRAI NCPR (DND) filter pre-TSP

Promotional traffic is filtered against the NCPR at the API edge — Full DND, category-DND and time-window DND (21:00–09:00 IST) are honoured before the TSP.

04

Aadhaar masking on every envelope

If an Aadhaar number is present on the envelope, only the last 4 digits travel; the full 12-digit Aadhaar is hashed (SHA-256 + salt) and resolved locally by the data fiduciary.

Delivery envelope
json
{
  "event": "delivery.consent_envelope",
  "data_fiduciary_id": "IN-DF-12345",
  "lawful_basis": "consent",
  "consent": {
    "record_id": "DPDP-2026-001234",
    "consent_date": "2025-09-14T10:42:00+05:30",
    "purpose": "service_alerts",
    "withdrawal_link_present": true
  },
  "ncpr_check": "passed",
  "aadhaar_last_4": "1234",
  "aadhaar_hash": "sha256:salt:7f2a9b...",
  "delivery": { "channel": "email", "template_id": "1207168760000567890" }
}
Sample message
EmailSubject: Your marketing preference is updated

Dear customer, From today, your marketing consent is withdrawn. You will no longer receive promotional messages, but you will continue to receive transactional alerts (order confirmations, delivery updates). To exercise your other rights under the Digital Personal Data Protection Act, 2023, write to: [email protected]

Compliance checklist
  • Data Fiduciary record configured (DPDP Act)
  • Consent record retained for every commercial delivery
  • TRAI NCPR (DND) filter applied at the API edge
  • Aadhaar masked or hashed at the envelope; never the full 12 digits in clear
The 4notify difference

4notify is the only A2P provider that records the DPDP lawful basis on every envelope, applies the TRAI NCPR filter pre-TSP, and masks Aadhaar at the envelope across all four operators (Jio, Airtel, Vi, BSNL).

Frequently asked questions
Does the DPDP Act apply to SMS as well as email?

Yes — the DPDP Act covers all electronic processing of personal data: SMS, email, push, messaging. Every commercial channel needs a lawful basis.

What if the data fiduciary hasn't registered a consent artefact?

4notify blocks commercial delivery at the API edge until a valid consent token is supplied; transactional delivery (lawful basis: compliance with law / contract) is unaffected.

Issued
4notify Office of Operations
2026-05-27 · TP-IN-005

Start free

14 days, no card. English-language support on weekdays.

Other edicts in this edition