DPDPA Section 6: Consent and withdrawal
DPDPA Section 6 explained: the standard of valid consent, the requirement that withdrawal be as easy as giving consent, and the Consent Manager model.
The standard of valid consent
Consent under Section 6 must be free, specific, informed, unconditional and unambiguous, and signalled by a clear affirmative action. Pre-ticked boxes, bundled all-or-nothing consent, or implied consent from continued browsing do not meet this bar.
Consent is also limited to the personal data necessary for the specified purpose. Asking for more than you need, or reusing data for a new purpose without fresh consent, breaks the limitation.
Withdrawal must be as easy as giving
A data principal can withdraw consent at any time, and the Act requires that withdrawing be as easy as giving consent was. A buried, multi-step or support-ticket-only withdrawal does not meet the as-easy-as standard.
On withdrawal you must cease the related processing, and ensure your processors do too, within a reasonable time. A persistent, obvious control that actually halts the trackers and processing it covers, not just flips a flag, is what compliance looks like in practice.
Consent Managers
The Act introduces the Consent Manager, a registered, accountable intermediary through which a person can give, manage, review and withdraw consent across services from one place. Designing your consent records to be interoperable, rather than locked to a proprietary format, helps you fit this model as it matures.
This page is a plain-English summary of the Digital Personal Data Protection Act, 2023 for general information and is not legal advice. Confirm your obligations with qualified counsel.
Meet this DPDPA requirement with ConsentX
DPDPA-native consent, Section 9 age-gate and verifiable receipts. Start free or take the DPDPA quiz.
DPDPA Section 6 questions
What makes consent valid under the DPDP Act?+
It must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose.
How easy must consent withdrawal be?+
As easy as giving consent. After withdrawal, the fiduciary and its processors must stop the related processing within a reasonable time.
What is a Consent Manager under Section 6?+
A registered intermediary that lets a data principal give, manage, review and withdraw consents in one place; it is accountable to the data principal and registered with the Board.