DPDP Consent Notice Checklist

Short answer

Under s.6(1), consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the personal data necessary for the specified purpose. Each request needs a notice that meets s.5 and Rule 3, withdrawal must be as easy as giving consent (s.6(4)), and children's data needs verifiable parental consent (s.9(1), Rule 10). This checklist turns those duties into 24 checks you can tick in your browser.

24 checks in five groups. Tick each one you can show evidence for. Your ticks stay in your browser. Educational, not legal advice and not a certification.

0 of 24 checked

Purpose and data

The purpose is lawful, and consent is the right ground for it rather than a legitimate uses.4, s.7You ask only for the personal data necessary for the specified purposes.6(1)Each purpose is asked for on its own, not bundled with otherss.6(1)

The notice

A notice comes with every consent requests.5The notice is understandable on its own, in clear and plain languageRule 3It itemises the personal data and the specified purposeRule 3It itemises the goods, services or uses the processing enablesRule 3It gives the means, with a link, to withdraw consentRule 3It gives the means to exercise rights under the Act and to complain to the BoardRule 3The Data Principal can read it in English or any Eighth Schedule languages.5(3)People whose data you collected before commencement get a notice as soon as reasonably practicables.5(2)

The consent action

Consent is given by a clear affirmative action, such as ticking an empty box or tapping Agrees.6(1)Boxes are not pre-ticked, and silence or inactivity is not treated as consents.6(1)Consent is not tied to conditions unrelated to the purposes.6(1)Each consent is recorded with the person, purpose, notice version and time, so you can prove its.6(10)

Withdrawal and after

Withdrawing consent is as easy as giving it, and available at any times.6(4), Rule 3Processing stops within a reasonable time after withdrawal, including at your processorss.6(6)Personal data is erased once consent is withdrawn, unless a law requires you to keep its.8(7)Your design leaves room for people who choose to give or withdraw consent through a registered Consent Managers.6(7)

Children and guardians

You can tell whether a user may be under 18 before you collect their personal datas.9You get verifiable consent of a parent, checking the parent is an identifiable adults.9(1), Rule 10For a person with disability, you verify the lawful guardian's appointment before accepting consents.9(1), Rule 11There is no tracking, behavioural monitoring or targeted advertising directed at childrens.9(3)Any Rule 12 exemption you rely on is documented and checked with counselRule 12

What the checklist covers

Five groups: purpose and data, the notice, the consent action, withdrawal and after, and children and guardians. Each check carries its citation, so a reviewer can trace it back to section 6, s.5, s.8, s.9 or the Rules.

Use it on a live flow, a design or a new feature before launch. It works for web and app flows alike.

How to use it

01Pick one flow
For example sign-up, checkout or an in-app permission. Run the checklist once per flow, not once for the whole product.
02Tick each check with evidence
Note a screenshot or record for each tick, so the review can be repeated. Sample: consent record CNS-1042 on example.com.
03Fix and re-check
Treat every unticked item as a task. Re-run the checklist after each change to the flow or the notice.

What the checklist does not do

Educational, not legal advice

The checklist is educational, not legal advice and not a certification. Ticking every box does not by itself make a flow compliant. It does not cover processing under a legitimate use (s.7) or your sector regulator's directions; check those with counsel.

How TruePrivacy helps

Consent management keeps a consent record per person and purpose, an event log of every grant, withdrawal, rejection and update, consent receipts and a preference page: evidence for s.6(10).

Parental consent records the guardian's decision with a timeline and evidence. The website tracker scan finds trackers and categorises them so they can become consent purposes.

Sources

Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025

Updated 4 Nov 2026. Educational information, not legal advice.

Questions, answered

Educational, not legal advice.

All DPDP FAQs

What makes consent valid under the DPDP Act?

Section 6(1) requires consent that is free, specific, informed, unconditional and unambiguous, with a clear affirmative action, limited to the personal data necessary for the specified purpose.

Are pre-ticked boxes allowed under DPDP?

The Act requires a clear affirmative action (s.6(1)). A pre-ticked box is not an action by the person, so design for an empty box they tick themselves.

Must people be able to withdraw consent?

Yes. Under s.6(4) a Data Principal can withdraw consent at any time, as easily as it was given, and under s.6(6) processing must stop within a reasonable time.

Do people have to use a Consent Manager?

No. Under s.6(7) a Data Principal may give, manage, review or withdraw consent through a Consent Manager, so consenting directly to you remains possible.

Consent notice checklist