Consent Management
Consent is the cornerstone of the DPDP Act. Understanding consent requirements and leveraging Consent Managers is essential for lawful data processing.
What Constitutes Valid Consent?
Free
Consent must be given freely without coercion or undue influence
Specific
Consent must be specific to the purpose for which data is processed
Informed
Data Principal must be fully informed about processing activities
Unconditional
Consent cannot be bundled with other services as a condition
Unambiguous
Clear affirmative action indicating agreement is required
Consent Manager (Rule 4)
A Consent Manager is a registered entity that enables Data Principals to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
Registration Requirements
Entity Requirements
Technical Requirements
Operational Requirements
Withdrawal of Consent
Data Principals have the right to withdraw consent at any time with the same ease as giving consent.
- Must be as easy as giving consent
- Takes effect from time of withdrawal
- Does not affect prior processing
Upon withdrawal, Data Fiduciaries must:
- Stop processing immediately
- Erase personal data within specified time
- Ensure processors also erase data
Strengthen Your Compliance Posture
Explore complementary certifications that work together to provide comprehensive security and compliance coverage.