DPDP Consent Management: Technical Systems for Indian Businesses

Consent Under Section 6 Is a Legal Instrument

The DPDP Act 2023 establishes consent as the primary lawful basis for processing personal data in India. Section 4 permits processing on only two grounds: consent under Section 6, or one of the nine “certain legitimate uses” listed in Section 7.

Consent is a statutory ground, and a consent failure falls in the Schedule’s residual tier, with penalties of up to ₹50 crore. Every Indian business that collects customer data must build consent management into its operational infrastructure.

What Constitutes Valid Consent Under the DPDP Act

The Act defines consent with precision. A consent request must satisfy all of the following conditions to be legally valid:

• Free: The Data Principal must not be coerced, pressured, or denied a service for refusing consent. Bundled consent (accept all or get nothing) does not meet this standard.
• Specific: Consent must be tied to a defined purpose. Blanket consent covering “all future uses” is not valid.
• Informed: The Data Principal must be told what data will be collected, why it will be processed, and who will process it. Vague descriptions do not qualify.
• Unconditional: Consent cannot be tied to conditions unrelated to the data processing purpose.
• Clear and plain language: The consent notice must be written in language the Data Principal can reasonably understand. Legal jargon buried in a terms-of-service document does not satisfy this requirement.

Section 6(1) of the DPDP Act states: “The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose.”

A consent that fails any of these conditions is not valid consent under Section 6(1), and processing that rests on it has no lawful ground.

Consent Collection Mechanisms

The Act does not mandate a specific technical implementation. It mandates outcomes. Your consent collection system must:

1. Present a clear consent notice before or at the point of data collection. The notice must state the categories of data being collected and the purpose for each category.
2. Capture an affirmative action from the Data Principal. Pre-ticked boxes, silence, and inactivity do not constitute consent. The individual must actively agree.
3. Separate consent by purpose. If you collect data for order fulfilment and for marketing, those are two distinct purposes requiring two distinct consent actions.
4. Offer the notice in Indian languages. Section 5(3) gives the Data Principal the option to read the notice in English or any language in the Eighth Schedule to the Constitution, and Section 6(3) gives the same option for the consent request.

Consent for Existing Data

Where a Data Principal consented before the Act commenced, Section 5(2) requires the fiduciary, as soon as it is reasonably practicable, to send her a notice: the personal data and the purpose it was processed for, how to withdraw consent and seek grievance redressal, and how to complain to the Board. Section 5(2)(b) then lets the fiduciary continue processing until she withdraws. The Act asks for that notice, not for fresh consent.

Consent Withdrawal: The Right You Cannot Restrict

Section 6(4) of the Act grants every Data Principal the right to withdraw consent at any time. The withdrawal process must be as straightforward as the consent process itself.

This means:

• If consent was given through a single click, withdrawal must be achievable through a comparable action. A withdrawal process that requires sending a physical letter or clicking through five support screens is non-compliant.
• Processing stops within a reasonable time. Section 6(6) requires the fiduciary to cease processing, and make its processors cease, within a reasonable time of the withdrawal, unless a law requires or authorises the processing. Section 8(7) then requires erasure unless retention is necessary to comply with a law.
• Consequences fall on the Data Principal. Under Section 6(5) she bears the consequences of withdrawing (a personalised service may end), and the withdrawal does not make earlier processing unlawful. Tell her what will change; never use it to talk her out of withdrawing.

A withdrawal route that takes more steps than the consent did is hard to square with the comparable-ease test in Section 6(4).

Record-Keeping Requirements

Section 6(10) puts the burden on the fiduciary: where consent is the basis of processing and a question arises in a proceeding, the fiduciary must prove that notice was given and consent was given in line with the Act and the Rules. The record that discharges that burden holds:

• What consent was given for (the specific purpose)
• When consent was obtained (timestamp)
• How consent was captured (the mechanism and notice presented)
• Whether consent has been withdrawn, and when

When the Data Protection Board inquires into a complaint, the fiduciary that cannot produce this record cannot discharge Section 6(10).

India already has a consent record of this shape in financial services. Under the RBI’s Account Aggregator Directions, 2025, an Account Aggregator’s consent travels as a standardised consent artefact that names the customer, the information requested, the purpose, the recipients, and the consent’s creation and expiry dates, signed by the Account Aggregator. The DPDP Act prescribes no fields, but a consent record is well served by the same ones plus the notice version shown.

The Act does not prescribe a storage format. A record that can be edited without leaving a trace is weak evidence, which is why timestamped, cryptographically signed records are the practical choice.

Consent Managers: A New Regulated Category

The DPDP Act introduces the concept of a Consent Manager, a registered intermediary that helps Data Principals manage their consent across multiple Data Fiduciaries. Consent Managers must be registered with the Data Protection Board and meet technical and operational standards set by the government.

Section 6(7) lets a Data Principal give, manage, review or withdraw consent through a Consent Manager, and Section 6(8) makes the Consent Manager accountable to her. The Act places no duty on a fiduciary to connect to one. A fiduciary whose customers use a Consent Manager will still receive withdrawals and changes through it, so the consent store should accept an instruction from an authorised channel as well as from its own screens.

What Your Systems Must Support

Based on the Act’s requirements, every Data Fiduciary needs infrastructure that handles:

1. Consent capture with purpose-specific granularity
2. Consent storage with cryptographic integrity and timestamps
3. Consent withdrawal that stops processing within a reasonable time, across every processor
4. Audit trail generation for regulatory inspection
5. Rights fulfilment triggered by consent state changes (deletion on withdrawal)

Building this from scratch for every application is expensive and error-prone. The substantive Rules obligations become enforceable on 13 May 2027. The DPDP compliance checklist provides a structured approach to identifying gaps before that date.

Assess Your Consent Infrastructure

Start with the free DPDP Gap Assessment to understand where your current consent processes fall short, and receive a prioritised action plan for closing those gaps.

Sources: DPDP Act 2023, Sections 4 to 8; RBI (Non-Banking Financial Companies - Account Aggregator) Directions, 2025, paragraph 17.