Deemed Consent
A term from earlier draft laws for situations where consent is presumed. The final Act uses "certain legitimate uses" instead.
Deemed consent is an older idea where an organisation could assume a person agreed to certain data uses. The final DPDP Act dropped the term and replaced it with a closed list of certain legitimate uses in Section 7.
Meaning of Deemed Consent
You may still see "deemed consent" in commentary. Under the Act as passed, there is no general presumption of consent. Processing without consent is possible only for the specific legitimate uses listed in Section 7.
The phrase "deemed consent" came from earlier drafts of India's data protection law, notably the 2022 draft bill, where it described situations such as public interest, employment or fraud prevention in which a person was treated as having agreed. The Digital Personal Data Protection Act, 2023 does not use it. Instead, Section 4 offers two grounds: consent, or certain legitimate uses, and Section 7 lists those uses.
That change is more than a label. Under deemed consent, a person was presumed to agree. Under Section 7 the law allows the use in listed circumstances without regard to anyone's agreement, and also does not allow broad purposes such as "reasonable purposes" or "fraud prevention" as grounds in themselves. Each Section 7 clause has its own words and boundaries, and the list is closed, so there is no room to argue that something should be deemed consented.
Articles, vendor sheets and training decks still say "deemed consent", often as shorthand for Section 7. That is understandable, but it can mislead. A reader may think that using a service amounts to deemed consent for marketing, analytics or sharing. It does not: the Act contains no presumption of consent from conduct, and silence or continued use is not a clear affirmative action under Section 6(1).
It also differs from GDPR terms. The GDPR has no deemed consent either; it relies on separate bases such as contract and legitimate interests. When comparing frameworks, map the substance of each processing activity to its own law instead of translating labels across.
Examples of Deemed Consent
A blog post says "deemed consent covers all service-related data". Check that against Section 7, which is narrower.
A product manager proposes sharing user transaction patterns with a partner because users "deemed consent" by signing up. The privacy lead checks Section 7, finds no matching clause, and asks for a specific, separate consent request instead.
A vendor deck describes attendance tracking as deemed consent. The school's counsel reads it again and finds the use can be supported as data voluntarily provided for a specified purpose, so the deck is corrected to cite Section 7(a).
A call centre script says "by staying on the line you agree to offers". The compliance team withdraws it, because remaining on a call is not a clear affirmative action, and replaces it with a clear question at the end.
Why Deemed Consent matters
Teams that rely on "deemed consent" as a concept may design flows with no consent step because they believe the law will presume it. If the use is not within a Section 7 clause, the processing has no lawful ground under Section 4 and falls within the residual penalty of up to ₹50 crore, and any consents collected on the basis of vague assumptions can be challenged.
Correct terminology helps compliance across the business. Contracts, policies and internal training should refer to Section 7 uses by clause, since that makes the actual legal test visible. It also avoids a false sense of safety when a product manager says "it is deemed consent, so we are fine".
How it works in practice
- 1Search your policies, contracts, data-processing agreements and training material for "deemed consent" and replace the phrase with the relevant Section 7 clause or with consent under Section 6.
- 2For every flow that currently has no consent step, ask which clause of Section 7 justifies it, and write down the answer. If none applies, add a consent step or stop the processing.
- 3Brief product, marketing and sales teams that using a service or continuing to browse does not create consent for additional uses.
- 4Review vendor documents: if a processor says it relies on deemed consent for your customers' data, ask it to identify the legal ground relied on under the DPDP Act.
- 5Update your internal glossary so legal and engineering use the same vocabulary, and revisit it as the Rules come into force on 13 May 2027.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the term as a legal ground. The DPDP Act has no deemed consent; use the Section 7 clause or Section 6 consent.
Assuming that a customer relationship implies agreement to marketing. Marketing needs its own consent.
Copying contract templates written for the 2018 or 2022 drafts. Update them to the Act as passed and the Rules of 2025.
Reading legitimate uses as wider than they are. Each clause has its own scope, and the list is closed.
Compliance tips
Use precise language: "Section 7(a) voluntary provision" says far more than "deemed consent".
When in doubt, ask for explicit consent; it is simpler to defend than an uncertain reading of a clause.
Check third-party advice against the Act's text and the Rules, as older commentary may refer to draft provisions that were changed.
Common questions about Deemed Consent
Does the DPDP Act recognise deemed consent?
No. The term appeared in earlier draft bills, but the Act as passed does not use it. Section 4 allows processing on consent or on certain legitimate uses, and Section 7 lists those uses. There is no general presumption of consent from conduct or silence.
Is deemed consent the same as legitimate uses?
They overlap in practice, since some situations once described as deemed consent are now covered by Section 7 clauses, but the legal idea differs. Section 7 allows processing for listed purposes without consent; it does not treat the person as having agreed, and it is narrower than the old drafts.
Can continued use of an app count as consent?
Generally not. Section 6(1) needs a clear affirmative action and specific, informed agreement. Continuing to use an app is not an act directed at a particular purpose. Processing that the service truly needs may fit Section 7(a), but extra uses need explicit consent.