DPDP consent: what it actually has to look like

Consent is the part of the data protection regime that companies most often get wrong, because it is treated as a checkbox rather than as a design problem. India's Digital Personal Data Protection Act, 2023 sets a consent standard that will look familiar to anyone who has worked with Europe's General Data Protection Regulation, and the Digital Personal Data Protection Rules, 2025, notified in November 2025, give businesses a transition period before most of the operational obligations bite. That window is shorter than it sounds, because fixing consent usually means changing products, onboarding flows and databases, not just privacy policies. This note sets out what the Act actually requires of a valid consent, where current practice falls short, and when consent is not the right basis to rely on at all.

The standard: what Section 6 requires

Section 6 of the Act requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. Each of those words removes something that is common practice today. Free rules out making a service conditional on data the service does not need. Specific rules out one blanket permission covering every future use. Informed means the person has seen a proper notice before agreeing. Unconditional and unambiguous rule out silence, inactivity and acceptance buried inside a longer document. The GDPR uses almost the same language in Article 4(11) and Article 7, and European regulators and courts have spent several years testing it, which makes their decisions a useful guide to how an Indian regulator is likely to read the same words. Section 6(3) of the Indian Act adds a point that is easy to miss: any part of a consent that infringes the Act is invalid to that extent, so a consent form that asks for too much does not simply fail on the excess, it leaves the business unable to show which parts of its processing were validly authorised.

The notice comes first

Section 5 requires every request for consent to be accompanied or preceded by a notice. The notice must describe the personal data to be collected and the purpose of processing, explain how the person can withdraw consent and exercise their rights, and explain how they can complain to the Data Protection Board of India. It must also be available in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution, at the person's option. The Rules add that the notice must be understandable on its own, rather than cross-referring to a privacy policy or a set of terms, and must give an itemised description of the data and the purposes. Two consequences follow. A single privacy policy linked from a website footer will not, on its own, satisfy the notice requirement for each consent the business collects. And businesses holding personal data collected on the basis of consent before the Act came into force are required under Section 5(2) to give a notice for that data too, as soon as reasonably practicable, which makes a legacy data audit a necessary first step rather than an optional one.

Bundled, pre-ticked and buried

Three design patterns account for most invalid consents, in India as elsewhere. Bundling asks for agreement to several unrelated purposes in one action, such as accepting the terms of service, marketing emails and data sharing with partners with a single click; under the Act each purpose needs its own specific consent, and consent to processing that is not necessary for the service cannot be a condition of receiving it. Pre-ticked boxes treat inactivity as agreement, which the Court of Justice of the European Union held invalid under European law in Planet49, and which cannot meet the Indian requirement of a clear affirmative action. Burying places the operative consent inside a long document the person has no realistic reason to read. California's privacy regulations go a step further and expressly provide that agreement obtained through dark patterns, interfaces designed to subvert or impair choice, does not count as consent. The practical test is straightforward: if the person would be surprised to learn what they agreed to, the consent is unlikely to survive scrutiny, whatever the terms of service say.

Withdrawal, and what happens to the data afterwards

Section 6(4) requires that withdrawing consent be as easy as giving it. A consent collected with one tap in an app cannot be withdrawn only by writing to a postal address or navigating five screens of account settings. Withdrawal does not make earlier processing unlawful, as Section 6(5) confirms, but it does require the business to stop processing and, under Section 8(7), to erase the data and cause its processors to erase it, unless retention is required by law. That is an engineering requirement as much as a legal one, and it is the one most product teams discover late, because personal data tends to sit in backups, analytics tools, CRM systems and vendor platforms long after the primary database has been cleaned. The Act also allows individuals to give, manage and withdraw consent through a registered consent manager, which means businesses should expect some consent to arrive, and be withdrawn, through an interoperable platform rather than their own interface. A consent architecture that cannot trace where each person's data has gone will struggle to honour a withdrawal properly, whichever route it arrives through.

When consent is not the right basis

Consent is not the only lawful basis under the Act, and relying on it where another basis fits creates avoidable fragility, because consent can always be withdrawn. Section 7 sets out certain legitimate uses that do not require consent, including where a person voluntarily provides data for a specified purpose and has not indicated that they do not consent to its use, compliance with a legal obligation, medical emergencies, and specified purposes of employment. A business processing salary data to run payroll, for example, is on firmer ground under the employment basis than under a consent that the employee could revoke the next day. At the other end of the scale, Section 9 imposes stricter rules for children, defined as anyone under 18: verifiable consent from a parent or lawful guardian is required, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited, subject to exemptions the Rules provide. The stakes are significant. The Schedule to the Act provides for penalties of up to ₹200 crore for breaches of the obligations relating to children and up to ₹250 crore for failing to take reasonable security safeguards, and a business that cannot demonstrate valid consent may find that the processing it built its product on had no lawful basis at all.