Consent
The Data Principal’s free, specific, informed, unconditional and unambiguous agreement to processing, shown by a clear affirmative action.
Consent is a person's own, informed, free choice to let an organisation use her personal data for a stated purpose. Under the DPDP Act it must be shown by a clear action and she must be able to take it back as easily as she gave it.
Meaning of Consent
Consent must be limited to the personal data necessary for the stated purpose. It must be asked for with a notice, in clear and plain language, with the option to use English or an Eighth Schedule language. A person must be able to withdraw it as easily as it was given. Pre-ticked boxes, silence and bundled terms do not qualify.
Section 4 of the DPDP Act allows personal data to be processed only for a lawful purpose, and only on one of two grounds: the Data Principal's consent, or one of the certain legitimate uses in Section 7. Section 6 then says what counts as consent. It must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to the personal data necessary for the specified purpose. Each word is doing work, and a consent that fails one of them is weak.
Several parts of Section 6 deserve attention. Under Section 6(2), any part of a consent that itself infringes the Act, the Rules or another law is invalid to that extent. Section 6(3) requires the request in plain language with an option for English or an Eighth Schedule language, along with contact details of a Data Protection Officer or another authorised person. Section 6(4)–(6) cover withdrawal and what the Fiduciary must do afterwards, and Section 6(7)–(9) bring in registered Consent Managers.
A difference from the GDPR is worth knowing. The European law has six lawful bases, including legitimate interests, and consent is only one. The DPDP Act has no general legitimate-interest ground. Outside the closed list in Section 7, consent is the route for private organisations, which makes it much more central in India. That is why getting the notice, the interface and the records right matters for almost every business that touches customer data.
Consent is also not the same as a contract term or a click on "I agree to the Terms". Buried acceptance of a long document does not show agreement to a specific processing purpose. Nor is consent forever: it lasts for the stated purpose, and when the purpose is served or consent is withdrawn, Section 8(7) expects erasure unless a law requires retention. Where a child or a person with a lawful guardian is involved, Section 9 requires verifiable consent from the parent or guardian.
Examples of Consent
A user ticks an unchecked box next to "Send me offers by WhatsApp". Buying the product does not depend on it. That is valid consent for marketing.
A shopper ticks an unticked box labelled "Send me offers on WhatsApp" at checkout. Her order goes through whether or not she ticks it. The retailer logs the time, the notice version and the purpose, and stops WhatsApp messages the same day she turns the setting off.
An app asks adult learners to allow use of their quiz results to recommend courses. The prompt describes this in two lines and offers "Allow" and "Not now" with equal prominence. Declining does not affect access to the lessons already paid for.
A clinic asks a patient to agree to share her records with a partner lab for a specific test. She signs a one-page form naming the lab and the purpose. The clinic does not extend that agreement to the lab's own marketing, which would need a separate request.
Why Consent matters
Section 6(10) puts the burden of proof on the Data Fiduciary. If consent is questioned in a proceeding before the Board, the organisation must show that a notice was given and consent was obtained in accordance with the Act. Without records, the practical position is weak, whatever the organisation believes happened at the point of sign-up.
Consent defects usually fall under the residual penalty of up to ₹50 crore in the Schedule to Section 33, and they can sit alongside other findings such as security or breach failures. Beyond penalties, weak consent means marketing lists, analytics models and partner data-sharing built on a foundation that can be challenged, which is expensive to unwind after the fact. For individuals, real consent is the practical form of control over their own data.
How it works in practice
- 1Map every purpose for which you process personal data and decide, purpose by purpose, whether it rests on consent or on a Section 7 ground. Document the reasoning so that it can be reviewed.
- 2Design the request around one purpose at a time. Use an unticked box or an explicit button, plain wording and a notice that itemises the data. Do not make a service depend on consent for something it does not need.
- 3Record each consent: who, what text and notice version, which purposes, when, through which channel, and the outcome. Store it so it can be retrieved by person and by purpose.
- 4Build withdrawal into the same channels as collection, such as a settings toggle or a reply keyword, and make downstream systems, including processors, stop on withdrawal within a reasonable time as Section 6(6) requires.
- 5Review consents periodically against changing purposes. When a purpose changes materially, ask again rather than relying on the earlier agreement.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying on "by using this site you agree". Continued browsing is not a clear affirmative action. Ask through a deliberate step tied to a named purpose.
Bundling marketing consent with account creation so that people cannot sign up without it. Consent must be free and unconditional for anything not necessary to deliver the service.
Assuming that old consents carry over without checking. Section 5(2) requires a fresh notice to existing consent holders as soon as reasonably practicable once the provisions commence, so legacy databases need a plan.
Keeping no proof. Because Section 6(10) puts the burden on you, a consent you cannot demonstrate is treated, in practice, like one you never obtained.
Compliance tips
Keep consent as narrow as the purpose. Asking for more data than a purpose needs conflicts with the "necessary for the specified purpose" limit in Section 6(1).
Make the withdrawal path as short as the consent path and test it with real users; if consent took one tap, withdrawal should not take five screens.
Treat consent records as business-critical logs: back them up, protect them with access controls, and plan retention that matches the dispute and audit periods you actually face.
Common questions about Consent
Is consent always required under the DPDP Act?
No. Section 4 allows processing on consent or on a certain legitimate use listed in Section 7, such as voluntary provision for a specified purpose, legal obligations, medical emergencies and employment purposes. The Act has no general legitimate-interest ground, so outside those listed cases consent is usually the route for private organisations.
Can consent be withdrawn at any time?
Yes. Section 6(4) gives the right to withdraw consent at any time, as easily as it was given. Withdrawal does not make earlier processing unlawful, but the Fiduciary must cease processing within a reasonable time and have its processors stop, unless a law requires or authorises the processing.
Who has to prove that consent was obtained?
The Data Fiduciary. Section 6(10) says that where consent is the basis of processing and a question arises in a proceeding, the Fiduciary bears the burden of proving that a notice was given and consent was obtained in accordance with the Act. Good records are therefore part of compliance.