Consent under the DPDP Act: notices, withdrawal and Consent Managers
What "free, specific, informed, unconditional and unambiguous" consent means in practice, how to write a compliant notice, and how withdrawal and Consent Managers work.
Consent sits at the centre of the DPDP Act. For most commercial processing — marketing, personalisation, analytics, sharing with partners — it is the only practical legal basis available. Yet the standard the Act sets is far higher than the pre-ticked boxes and buried "by continuing you agree" banners many Indian websites still use.
This article explains what valid consent looks like under Sections 5 and 6 of the Act and the 2025 Rules, how to write a compliant notice, how withdrawal must work, and where Consent Managers fit in.
What makes consent valid
Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the personal data necessary for the specified purpose. Each word does real work:
- Free — the person has a genuine choice. Bundling consent to marketing with access to a core service undermines this.
- Specific — tied to a defined purpose, not "any purpose our business may have".
- Informed — preceded by a notice the person can actually understand.
- Unconditional — not extracted as the price of something unrelated.
- Unambiguous, by affirmative action — a tick, a toggle, a tap on "I agree". Silence, inactivity and pre-ticked boxes do not count.
The Act adds that any part of a consent request that infringes the Act is invalid to that extent. You cannot, for example, ask a user to "consent" to waive their right to complain to the Board.
The data minimisation test
Consent can only cover data that is necessary for the stated purpose. The illustration in the Act is useful: a telemedicine app that asks for consent to access a user's contact list, when it only needs their health details to provide a consultation, is asking for more than is necessary — and the consent to the contact list is invalid.
In practice, run each field on every form through a simple question: if we did not collect this, could we still deliver the purpose we are describing? If yes, it either needs its own separate, optional consent or it should not be collected at all.
Writing a compliant notice
Every consent request must be accompanied or preceded by a notice. Under the Act and the Rules, the notice should be presented independently of other information, be clear and plain, and give at minimum:
- An itemised description of the personal data being collected.
- The specified purpose of processing, and a description of the goods, services or uses the processing enables.
- A communication link to withdraw consent with the same ease with which it was given.
- How the person can exercise their rights and use your grievance mechanism.
- How they can complain to the Data Protection Board.
Individuals must be able to read the notice in English or in any of the 22 languages listed in the Eighth Schedule of the Constitution. For a consumer business operating across India, offering at least the major regional languages of your user base is the sensible minimum.
Good practiceUse a layered design: a short, scannable summary at the point of collection ("We'll use your phone number to send delivery updates. Optional: offers by WhatsApp."), linked to the full itemised notice.
Legacy data: consent given before the Act
If you processed personal data on the basis of consent obtained before the Act came into force, you must give those individuals a notice "as soon as reasonably practicable" describing the data and purpose, their rights and how to complain. You may continue processing until the person withdraws consent.
This catches many organisations by surprise. Your existing CRM, newsletter list and customer database all count. Plan a re-notice campaign — and treat it as a chance to clean out records you no longer have a reason to hold.
Withdrawal must be as easy as giving consent
A Data Principal can withdraw consent at any time, and the Act requires that withdrawal be comparable in ease to giving it. If consent took one tap in your app, withdrawal cannot require an email to a support inbox and a five-day wait.
Once consent is withdrawn, you must stop processing within a reasonable time and cause your processors to stop too, unless processing without consent is required or authorised by law. Withdrawal does not make past processing unlawful — but you bear the consequences of continuing afterwards.
- Put a "Manage consent" control in the same place the original consent was captured.
- Propagate withdrawal automatically to marketing tools, ad audiences and data-sharing feeds.
- Keep an auditable log of when consent was given, for what, and when it was withdrawn.
Proving consent: the burden is on you
Where a dispute arises, the Data Fiduciary must prove that a notice was given and that consent was obtained in line with the Act. "Our sign-up form had a checkbox" is not evidence. You need a record that ties a specific person to a specific version of the notice, the specific purposes accepted, a timestamp and the capture channel.
| Field to log | Why it matters |
|---|---|
| Data Principal identifier | Links consent to a person without storing more data than needed |
| Notice version and language | Shows exactly what the person was told |
| Purposes accepted / declined | Supports purpose-specific consent |
| Timestamp and channel | Web, app, call-centre, in-store tablet |
| Withdrawal events | Proves you honoured changes |
Consent Managers
The Act creates a new kind of intermediary: the Consent Manager, registered with the Data Protection Board, which lets an individual give, manage, review and withdraw consent across many Data Fiduciaries through one accessible, interoperable platform. The Rules set eligibility conditions — including being a company incorporated in India with adequate technical, operational and financial capacity — and duties to act in a fiduciary capacity towards users, avoid conflicts of interest and keep records of consents.
Under the phased rollout, the Consent Manager provisions take effect twelve months after the Rules were notified. Data Fiduciaries are not obliged to integrate with a Consent Manager, but if a person gives consent through one, you must honour it — so your consent infrastructure should be built to accept consent signals from external platforms as well as your own forms.
A consent readiness checklist
- Map every point where you collect personal data: web forms, apps, call-centre scripts, events, offline forms later digitised.
- Separate mandatory data (needed for the service) from optional data (needs its own consent).
- Rewrite notices in plain language with an itemised list and purposes; prepare translations.
- Remove pre-ticked boxes, bundled consents and "continue means agree" patterns.
- Build a consent log and a one-click withdrawal path that flows through to all downstream systems.
- Send notices to your legacy database and suppress anyone who withdraws.
In the next article, we look at what happens after consent: how to handle access, correction, erasure and grievance requests from Data Principals at scale.
