ConsentXDPDPA is now in force in India. Run a free privacy scan on your site. Scan now
ConsentXDPDPA Section 6 explained: the standard of valid consent, the requirement that withdrawal be as easy as giving consent, and the Consent Manager model.
Consent under Section 6 must be free, specific, informed, unconditional and unambiguous, and signalled by a clear affirmative action. Pre-ticked boxes, bundled all-or-nothing consent, or implied consent from continued browsing do not meet this bar.
Consent is also limited to the personal data necessary for the specified purpose. Asking for more than you need, or reusing data for a new purpose without fresh consent, breaks the limitation.
A data principal can withdraw consent at any time, and the Act requires that withdrawing be as easy as giving consent was. A buried, multi-step or support-ticket-only withdrawal does not meet the as-easy-as standard.
On withdrawal you must cease the related processing, and ensure your processors do too, within a reasonable time. A persistent, obvious control that actually halts the trackers and processing it covers, not just flips a flag, is what compliance looks like in practice.
The Act introduces the Consent Manager, a registered, accountable intermediary through which a person can give, manage, review and withdraw consent across services from one place. Designing your consent records to be interoperable, rather than locked to a proprietary format, helps you fit this model as it matures.
This page is a plain-English summary of the Digital Personal Data Protection Act, 2023 for general information and is not legal advice. Confirm your obligations with qualified counsel.
DPDPA-native consent, Section 9 age-gate and verifiable receipts. Start free or take the DPDPA quiz.