Consent Under the DPDP Act: Requirements, Notices and Withdrawal
· Sri Tulasi Tech Labs
Consent is the main legal basis for processing personal data under the DPDP Act. Getting it right is one of the first steps of any compliance programme.
What makes consent valid
Consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the personal data necessary for the specified purpose. In practice:
- No pre-ticked boxes or consent hidden in long terms — the person must actively agree.
- One purpose, one consent — bundling unrelated purposes (for example, delivery and marketing) into a single “I agree” is risky.
- Only what is necessary — consent cannot be stretched to cover data the purpose does not need.
- Any part of a consent that breaches the Act is invalid to that extent.
The notice comes first
Every request for consent must be accompanied or preceded by a notice that tells the Data Principal, in clear and plain language:
- the personal data to be processed and the specific purpose;
- how they can withdraw consent and exercise their rights;
- how they can make a complaint to the Data Protection Board.
The notice must be understandable on its own and available in English or any language in the Eighth Schedule to the Constitution. Where people consented before the Act took effect, a notice must be given as soon as reasonably practicable.
Withdrawal must be as easy as giving consent
A Data Principal may withdraw consent at any time, and withdrawing must be as easy as giving it — if consent was a single click, withdrawal should not require a written letter. After withdrawal, the Data Fiduciary and its processors must stop processing within a reasonable time, unless the processing is required or authorised by law. Withdrawal does not make earlier processing unlawful.
Consent Managers
People may give, manage and withdraw consent through a Consent Manager registered with the Board — a single dashboard for consents across organisations. Organisations should be ready to accept consent through these platforms.
Keep proof
If there is a dispute, the Data Fiduciary must prove that notice was given and consent obtained. Keep records of what each person saw and agreed to, and when.
Consent checklist
- Map every point where you collect personal data.
- Write a clear notice for each purpose.
- Replace pre-ticked boxes with an active choice.
- Give an equally easy way to withdraw.
- Record consents and withdrawals.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.