Section 6
Consent management under the DPDP Act
Consent under the DPDP Act is given per purpose and can be withdrawn at any time. TruePrivacy keeps the record that shows both.
Sample workspace
Consent record DP-••4821
- Loan applicationGiven
- Credit bureau checkGiven
- Marketing emailsWithdrawn
Event log
- Consent given for three purposes
- Receipt issued
- Marketing emails withdrawn on preference page
Short answer
Under s.6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the personal data necessary for the specified purpose. The Data Principal can withdraw it at any time, as easily as it was given (s.6(4)), and the Data Fiduciary must be able to prove notice and consent (s.6(10)). TruePrivacy keeps a consent record per person and purpose, with an event log of every grant, withdrawal, rejection and update.
What consent management does
Define each purpose you ask consent for. Consent is recorded per person and per purpose, so it stays specific.
Every grant, withdrawal, rejection and update is logged against the person and the purpose.
Receipts form part of the evidence that consent was given, for s.6(10).
Data Principals review and change their choices on a preference page.
Banners set up for DPDP require a reject-all option.
A web banner script and SDKs for iOS, Android and React Native. See cookie consent.
How consent is captured and withdrawn
- 01Define purposes
List each specified purpose in plain language. Keep the list in one place so purpose limitation holds across notices, consent and retention.
- 02Show the notice with the request
Every consent request comes with a notice (s.5). You write and review the notice text; the banner interface text ships in English and all 22 Eighth Schedule languages.
- 03Record the choice
Each grant or rejection is stored per person and purpose, with a receipt and an entry in the event log.
- 04Honour withdrawal
The person withdraws on the preference page and the withdrawal is logged. Your teams then make sure your systems and processors stop processing within a reasonable time (s.6(6)).
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Consent that is free, specific, informed, unconditional and unambiguous, with a clear affirmative action | s.6(1) | Consent recorded per person and per purpose; DPDP banners require reject-all |
| A notice with every consent request | s.5, Rule 3 | Banner interface text in English and 22 Eighth Schedule languages; you write the notice text. See notices |
| Withdraw at any time, as easily as consent was given | s.6(4), Rule 3 | Preference page and a logged withdrawal event |
| Stop processing after withdrawal, and have processors stop | s.6(6) | Records when consent was withdrawn, for your systems and processors to act on |
| Prove notice and consent | s.6(10) | Event log, consent receipts and an audit trail exportable as CSV |
What consent management does not do
TruePrivacy is not a registered Consent Manager. A Consent Manager registers with the Board under Rule 4 and is accountable to the Data Principal (s.6(8), s.6(9)); the application form is not published yet. See Consent Managers and Rule 4.
Stopping processing after a withdrawal happens in your systems and your processors' systems. TruePrivacy records the withdrawal and when it happened; make sure each system acts on it.
Works with
The notice that comes with every consent request, and email campaigns for existing users.
Cookie consentBanner, tracker scan and SDKs that feed purposes into consent.
Purpose limitationOne list of purposes across consent, notices, processing records and retention.
Privacy centerA branded portal where people manage preferences and submit requests.
Does DPDP consent have to be per purpose?
Yes. Section 6(1) limits consent to the personal data necessary for the specified purpose, and Rule 3 asks the notice to itemise the purposes. TruePrivacy records consent per person and purpose.
How easy must withdrawal be?
Section 6(4) lets a Data Principal withdraw at any time, as easily as consent was given, and Rule 3 asks for the same. The preference page and privacy center give people a place to do it.
Is consent the only ground for processing?
No. Section 4 allows processing for a lawful purpose with consent (s.6) or for certain legitimate uses (s.7). Read legitimate uses before relying on one.
Is TruePrivacy a Consent Manager?
No. TruePrivacy is software a Data Fiduciary uses to record consent. A Consent Manager is registered with the Board under Rule 4 and acts for the Data Principal.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin