Consent Under DPDP: When, How, and What Makes It Valid

Constitutional Law Digital Personal Data Protection Act, 2023 DPDP
Veritect
Veritect AI
Deep Research Agent
7 min read

Executive Summary

Consent is the cornerstone of India's Digital Personal Data Protection Act, 2023. Understanding consent requirements is essential for all organizations processing personal data:

  • Consent standard: Free, specific, informed, unconditional, unambiguous
  • Notice requirement: Mandatory before or at time of consent collection
  • Withdrawal right: Data Principal can withdraw consent anytime
  • Deemed consent: Limited situations where explicit consent not required
  • Consent Manager: New intermediary for consent management

This guide provides a comprehensive analysis of consent requirements under DPDP Act.

1. Statutory Framework

DPDP Act Section 6 establishes:

"A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose—(a) for which the Data Principal has given her consent."

Characteristic Meaning
Free No coercion, pressure, or conditioning
Specific For defined, particular purposes
Informed With full knowledge via notice
Unconditional Not tied to unrelated services
Unambiguous Clear affirmative action

2. Notice Requirements

Before seeking consent, Data Fiduciary must provide notice containing:

Element Detail
Personal data Categories being collected
Purpose Specific purposes for processing
Rights Data Principal rights
Grievance mechanism How to raise complaints
Cross-border If data transferred outside India

Notice Format

Requirement Specification
Language Clear, plain language
Accessibility Easy to understand
Standalone Not buried in terms
Visibility Prominent presentation
Languages Including scheduled languages

Affirmative Actions

Valid Invalid
Active checkbox ticking Pre-ticked checkboxes
Written signature Silence or inactivity
Digital signature Implied consent
Explicit verbal confirmation Bundled consents
Click-through acceptance Take-it-or-leave-it
Principle Application
Purpose-specific Separate consent for each purpose
Unbundled Not tied to service provision
Modular Can accept some, reject others
Recorded Evidence of what was consented

Right to Withdraw

Aspect Requirement
Availability Must be provided
Ease As easy as giving consent
Effect Processing must stop
Timeline Within reasonable time
Past processing Remains lawful

Withdrawal Mechanism

Element Specification
Clear option Visible withdrawal mechanism
No penalty No adverse consequences
Confirmation Acknowledge withdrawal
Data handling Erasure unless retention required

Section 7 - Certain Legitimate Uses

Consent deemed given for specific purposes:

Category Examples
Voluntary provision Data given for specified purpose
State functions Government services, permits, licenses
Court/legal obligation Compliance with judgments, laws
Medical emergency Life-threatening situations
Employment Employee data processing
Public interest As notified by Government

State Functions

Processing permitted without explicit consent for:

  • Subsidies, benefits delivery
  • Licenses, permits, certificates
  • Government services
  • Regulatory functions

Employment Context

Permitted Conditions
Employee records Related to employment
Payroll processing Employment purpose
Background checks At commencement
Performance data Employment-related

Special Requirements

Requirement Specification
Age threshold Below 18 years
Parental consent Verifiable parental/guardian consent
Prohibited processing Behavioral monitoring, tracking
Verification Age and guardian verification
Method Validity
Parent's registered account Verified
Credit card verification Potentially valid
Knowledge-based verification May be insufficient
Video verification High assurance

New Intermediary Category

Aspect Specification
Role Single point for consent management
Function Give, manage, review, withdraw consent
Registration With Data Protection Board
Accountability To Data Principal
Service Description
Consent aggregation Central consent dashboard
Consent history Records of consents given
Easy withdrawal Single-click withdrawal
Audit trail Complete consent history
Situation Action Required
New purpose Fresh consent for new use
Material change Re-consent after notice
Expanded processing Consent for additional activities
Third-party sharing Consent for new recipient
Trigger Approach
Significant time gap Consider refreshing consent
Changed circumstances Update consent
Regulatory change Review compliance

Documentation Requirements

Element Retention
Consent given Date, time, method
Notice provided Version presented
Scope consented Purposes accepted
Withdrawal Date, scope of withdrawal

Record Keeping

Best Practice Implementation
Immutable logs Blockchain or secure database
Version control Track notice versions
Audit capability Demonstrate compliance
Retention period As per processing duration
Practice Issue
Pre-ticked boxes Not affirmative action
Bundled consent Not specific/granular
Complex notices Not informed
No withdrawal option Violates right
Consent walls Not free/unconditional

Compliance Risks

Risk Consequence
Invalid consent Processing unlawful
Missing records Cannot demonstrate compliance
Difficult withdrawal Regulatory penalty
Inadequate notice Consent vitiated

11. Compliance Checklist

  • Notice provided before/at consent collection
  • All required notice elements included
  • Plain language used
  • Affirmative consent mechanism
  • Granular options available
  • Consent recorded with timestamp
  • Easy withdrawal mechanism
  • Withdrawal confirmation process
  • Consent records maintained
  • Purpose limitation enforced
  • Re-consent triggers identified

Children's Data

  • Age verification mechanism
  • Parental consent workflow
  • Prohibited processing blocked
  • Enhanced safeguards implemented

12. Key Takeaways for Practitioners

  1. Affirmative Action Required: Pre-ticked boxes and silence are not valid consent mechanisms.

  2. Notice is Prerequisite: Consent without proper notice is invalid.

  3. Granularity Matters: Bundled, all-or-nothing consent likely invalid.

  4. Withdrawal Must Be Easy: At least as easy as giving consent.

  5. Deemed Consent is Limited: Only specific statutory situations qualify.

  6. Children Need Special Care: Verifiable parental consent is mandatory.

  7. Records Are Essential: Document consent for regulatory defense.

Conclusion

Consent under DPDP Act requires organizations to fundamentally rethink data collection practices. The emphasis on informed, specific, and freely-given consent means that traditional approaches—bundled consents, pre-ticked boxes, and complex notices—will not suffice. Organizations must implement robust consent management systems, maintain comprehensive records, and provide easy withdrawal mechanisms. The introduction of Consent Managers offers a new solution for simplifying consent management for Data Principals while creating compliance infrastructure for Data Fiduciaries.

Written by
Veritect. AI
Deep Research Agent
Grounded in millions of verified judgments sourced directly from authoritative Indian courts — Supreme Court & all 25 High Courts.
About Veritect

AI research & drafting, purpose-built for Indian litigation.

Veritect indexes 5 million+ judgments from the Supreme Court of India and all 25 High Courts, 1,000+ Central and State bare acts, and 50,000+ statutory sections — including the new BNS, BNSS, and BSA codes.

Built for Indian courts. Trusted by litigation practices from solo chambers to full-service firms.

Try Veritect free