Consent is the backbone of the Digital Personal Data Protection Act, 2023. For most businesses it is the main legal basis for collecting and using personal data — and if your consent is not valid, the processing that rests on it is not lawful. Here is what the Act actually requires, in plain terms.
The legal standard: Section 6
Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Each word does work:
- Free — not coerced, and not bundled so that a person must agree to unrelated processing to get a service.
- Specific — tied to a defined purpose. One blanket 'I agree to everything' does not cover every future use.
- Informed — given after a clear notice (see Section 5) describing the data and the purpose.
- Unconditional and unambiguous — no hidden strings, and no guessing; the person must do something positive.
- Clear affirmative action — a deliberate tick, tap or signature. Pre-ticked boxes, silence, inactivity or 'continuing to browse' are not consent.
Consent must be limited to what is necessary
The Act says consent is limited to the personal data necessary for the specified purpose. If a person agrees to more than is needed, the agreement is only valid to the extent it is necessary — collecting a phone number 'just in case' is not covered by consent given for delivery.
The itemised-notice rule
Consent rides on the notice. Section 5 requires that, before or at the time of seeking consent, you give the person an itemised description of the personal data and the purpose of processing, plus how to withdraw consent, how to exercise their rights, and how to complain to the Data Protection Board. A good privacy notice and a good consent request are two halves of the same thing.
Withdrawal must be as easy as giving
A Data Principal can withdraw consent at any time, and the Act requires that withdrawing be as easy as giving it. If signing up took one tap, opting out cannot take ten emails. On withdrawal, you must stop the processing within a reasonable time, and ensure your processors do the same — though it does not undo processing already lawfully done.
Existing data and the transition
The Act also reaches data you collected before it applied: where you continue to rely on consent for data gathered earlier, you must give a fresh notice so the person can make an informed choice and withdraw. With the DPDP Rules, 2025 now notified and major obligations phasing in by 14 May 2027, re-papering old consents is a common first project.
When you may not need consent: legitimate uses
Section 7 lists 'legitimate uses' where consent is not the basis — for example, where a person voluntarily gives data for a purpose and has not objected, certain employment purposes, and specified state functions. These are narrower than they look; most ordinary marketing, profiling and data-sharing still needs consent.
Common mistakes to avoid
- Pre-ticked boxes or 'by using this site you agree' banners.
- Bundling unrelated purposes into one checkbox.
- Asking for consent without an itemised notice of data and purpose.
- Making withdrawal hard to find, or ignoring it once given.
- Keeping no record of what each person saw and agreed to.
That last point matters: under the Act, the burden is on you to show that valid consent was obtained. A defensible record — what notice was shown, which purposes, when, and the person's choice — is what turns 'we think we're compliant' into evidence.
How DPDP Bridge helps
DPDP Bridge turns these consent rules into working software. Our consent management and verifiable consent receipt tools capture free, specific, informed and unambiguous consent against an itemised notice, make withdrawal one click, and keep a tamper-evident record you can produce if the Data Protection Board ever asks. Take the free assessment to see exactly what your consent flows need.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.