Glossary
What is consent under DPDP?
Consent is one of the two grounds for processing personal data under the DPDP Act. Section 6 sets a high bar for it.
Definition
Under s.6 of the DPDP Act, 2023, consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and limited to the personal data necessary for the specified purpose. It comes with a notice (s.5), can be withdrawn at any time as easily as it was given (s.6(4)), and the Data Fiduciary must be able to prove it (s.6(10)).
What it means
Consent is one of two grounds for processing under s.4; the other is a legitimate use under s.7. Each word in s.6 matters: the Data Principal must act to agree, the request must name the purpose, and it may ask only for the personal data needed for that purpose.
Consent can be given directly to the Data Fiduciary, or through a Consent Manager (s.6(7)). See consent under section 6 for the full duty.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.4 | Process with consent or for a legitimate use |
| s.5, Rule 3 | A notice with every request for consent |
| s.6 | The consent standard |
| s.6(4) | Withdraw at any time, as easily as given |
| s.6(6) | Stop processing, and have processors stop, within a reasonable time after withdrawal |
| s.6(10) | The Data Fiduciary must prove notice and consent |
| s.9(1), Rules 10 and 11 | Verifiable consent for children and persons with disability who have a lawful guardian |
Common misconceptions
- “All processing needs consent.” Not always: s.7 lists legitimate uses that do not.
- “Deemed consent still applies.” The 2023 Act replaced the 2022 draft's deemed consent with legitimate uses (s.7).
- “Consent once given lasts forever.” It can be withdrawn at any time (s.6(4)), and processing must then stop within a reasonable time (s.6(6)).
- “Consent must go through a Consent Manager.” A Data Principal may use one (s.6(7)); direct consent remains possible.
Related terms
The information that comes with every request for consent (s.5, Rule 3).
Legitimate usesThe listed grounds for processing without consent (s.7).
Verifiable consentChecked consent of a parent or lawful guardian (s.9(1), Rules 10 and 11).
Consent ManagerA Board-registered single point of contact for managing consent (s.2, Rule 4).
In TruePrivacy
Consent management keeps purposes, a consent record per person and purpose, an event log of every grant, withdrawal, rejection and update, consent receipts and a preference page, with reject-all required for DPDP. The consent banner ships interface text in English and all 22 Eighth Schedule languages; you write and review your own notice text.
What makes consent valid under DPDP?
s.6 requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the personal data necessary for the specified purpose, and given against a notice (s.5).
Can consent be withdrawn?
Yes, at any time, and as easily as it was given (s.6(4)). Rule 3 also requires withdrawal to be comparably as easy as giving consent.
Who has to prove that consent was given?
The Data Fiduciary. Under s.6(10) it must be able to prove that notice was given and consent obtained.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin