Section 6
DPDP consent notices that hold up
The consent notice is what a person sees at the moment you ask for consent. Get it right and record it, and you can prove consent later.
Short answer
A consent notice is the notice shown at the moment you ask for consent, and s.5 requires every consent request to come with, or be preceded by, a notice. Rule 3 requires it to be understandable on its own in plain language, itemise the data and purposes, and link to withdrawal, rights and the Board, with withdrawal as easy as giving consent (s.6(4)). Record which notice version each person saw and what they chose, because s.6(10) puts the burden of proving notice and consent on you.
Consent notice vs privacy notice
| Aspect | Consent notice | Privacy notice |
|---|---|---|
| When it appears | At the moment you ask for consent, before or with the request (s.5) | Always available on your website and app |
| Scope | The data and purposes this request covers | Every purpose, including legitimate uses (s.7) |
| Length | Short, focused on one decision | Complete, often layered |
| Key action | Accept or reject each purpose; link to withdraw | Read, then use the links to rights and complaints |
| Evidence | A consent record per person, purpose and notice version | Published versions with dates |
The consent notice must meet Rule 3 on its own. A link to the privacy notice adds detail; it does not replace the itemised data and purposes the consent notice shows.
What the consent notice must show
- An itemised description of the personal data this request covers (Rule 3)
- Each specified purpose, itemised, with the goods, services or uses it enables (Rule 3)
- A link to withdraw consent, with withdrawal comparably as easy as giving consent (Rule 3, s.6(4))
- A link to exercise rights under the Act (Rule 3)
- A link to complain to the Board (Rule 3)
- Clear, plain language that is understandable on its own (Rule 3)
- The option to read it in English or any Eighth Schedule language (s.5(3))
The consent itself must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose (section 6).
Steps to build the consent moment
- 01One decision per purpose
Give each purpose its own choice. Bundling marketing with service delivery risks consent that is not specific or unconditional (s.6).
- 02No pre-ticked boxes
Consent needs a clear affirmative action, so the person must tick, toggle or tap (s.6).
- 03Give reject equal weight
Show accept and reject side by side with equal prominence, so the choice is free (s.6).
- 04Ask only for what the purpose needs
Section 6 limits consent to the personal data necessary for the specified purpose.
- 05Offer languages
Let people switch the notice into their language from the consent screen (s.5(3)).
- 06Record the decision
Store the record described below before processing starts.
- 07Put withdrawal next to consent
Offer withdrawal where people gave consent, such as account settings or a preference page, and stop processing within a reasonable time after withdrawal (s.6(6)).
Web and mobile patterns
- Web: a consent banner for cookies and trackers, with purposes that match what your site actually loads. Scan the site to find them.
- Mobile apps: a native consent screen at first use, and again before any new purpose, rather than a link to a long policy.
- Forms and checkout: an unticked checkbox for each optional purpose, next to the field that collects the data.
- Through a Consent Manager: a Data Principal may give, manage, review or withdraw consent through a registered Consent Manager (s.6(7)); consenting directly to you remains possible.
What to record
| Field | Why it matters |
|---|---|
| Person or pseudonymous ID | Links the record to the Data Principal without copying more data than needed |
| Purpose | Consent is specific to each purpose (s.6) |
| Notice version and language | Shows what the person was told (s.5, s.6(10)) |
| Action and timestamp | Shows a clear affirmative action and when it happened (s.6) |
| Channel | Web, app, form or Consent Manager |
| Later events | Withdrawals and updates, so you know the current status (s.6(4)) |
Keep each consent record while you rely on the consent, and for as long afterwards as you may need to prove it. Set that period with counsel.
How TruePrivacy helps
Consent management keeps a consent record per person and purpose, an event log of every grant, withdrawal, rejection and update, and consent receipts. A preference page lets people change their choices, and reject-all is required for DPDP.
The consent banner runs on the web, with SDKs for iOS, Android and React Native, and ships interface text in English and all 22 Eighth Schedule languages. A website tracker scan finds trackers to turn into purposes. Related tools: the consent checklist and the privacy notice generator.
What is the difference between a consent notice and a privacy notice?
The consent notice appears when you ask for consent and must meet Rule 3 on its own. The privacy notice is the full public account of all your processing.
Can consent be bundled with terms of service?
Consent must be free, specific, informed, unconditional and unambiguous (s.6). Bundling an optional purpose with service terms risks failing that standard, so give each purpose its own choice.
How do we prove consent under DPDP?
Keep a record of the person, purpose, notice version, language, action and time. Under s.6(10) the Data Fiduciary must prove that notice was given and consent obtained.
Must withdrawal be as easy as giving consent?
Yes. Section 6(4) lets a Data Principal withdraw at any time, and Rule 3 requires withdrawal to be comparably as easy as giving consent.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin