They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
SECTION 6 · FIVE VALIDITY ATTRIBUTES
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineConsent is the cornerstone of the DPDP Act. Understanding consent requirements and leveraging Consent Managers is essential for lawful data processing.
Section 6 requires consent to be free, specific, informed, unconditional, and unambiguous — and withdrawal must be as easy as giving it.
5Validity attributes
₹2 CrConsent Manager net worth
1,000+Audits delivered
DPDP Act 2023 · Section 6 + Rule 4, DPDP Rules 2025 · Last reviewed June 2026
Direct Answer
What makes consent valid under the DPDP Act?
Under the DPDP Act 2023, consent is the primary lawful basis for processing personal data, and Section 6 requires it to be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. The DPDP Rules 2025 add the Consent Manager — a Board-registered platform under Rule 4 that lets individuals give, manage, review, and withdraw consent in one interoperable place — with the right to withdraw consent as easily as it was given.
Key Takeaways
- Valid consent must be free, specific, informed, unconditional, and unambiguous (Section 6) — pre-ticked boxes and bundled consent do not qualify.
- Consent must follow a clear, plain-language notice describing the data, purpose, and how to exercise rights and withdraw.
- A Consent Manager (Rule 4) is a Board-registered, interoperable platform for managing consent across data fiduciaries. Registration requires ₹2 crore net worth and no conflict of interest.
- The right to withdraw consent is guaranteed and must be as easy as giving it. On withdrawal, processing stops and data is erased unless legally retained.
Section 6
What Constitutes Valid Consent?
Free
Consent must be given freely without coercion or undue influence
Specific
Consent must be specific to the purpose for which data is processed
Informed
Data Principal must be fully informed about processing activities
Unconditional
Consent cannot be bundled with other services as a condition
Unambiguous
Clear affirmative action indicating agreement is required
At a Glance
Consent Requirements at a Glance
Each attribute of valid consent under Section 6, what it means in practice, and a common way organizations get it wrong.
| Attribute | What it means | Common failure |
|---|---|---|
| Free | Given without coercion, pressure, or undue influence | Denying a service unless unrelated marketing consent is also given |
| Specific | Tied to each distinct purpose of processing | A single blanket tick-box covering many unrelated purposes |
| Informed | Preceded by clear notice of what data, why, and rights | Consent buried in dense terms with no plain-language notice |
| Unconditional | Not bundled as a condition for an unrelated service | Forcing analytics consent to access core functionality |
| Unambiguous | Indicated by clear affirmative action | Pre-ticked boxes or inferring consent from silence |
Rule 4
Consent Manager (Rule 4)
A Consent Manager is a registered entity that enables Data Principals to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
- Register with the Data Protection Board of India
- Maintain technical capability for interoperability
- Provide accessible and transparent consent management
- Enable Data Principals to give, manage, review, and withdraw consent
- Maintain accurate records of all consents
- Act only on instructions of Data Principal
- Not have any conflict of interest
- Provide consent audit trail when requested
Registration Requirements
Entity Requirements
- Company incorporated in India
- Net worth of at least ₹2 crore
- No criminal convictions for directors
Technical Requirements
- Interoperable platform
- Secure consent storage
- User-friendly interface
- Audit trail capability
Operational Requirements
- 24/7 availability
- Grievance redressal mechanism
- Data protection measures
- Regular compliance audits
Section 6(4)
Withdrawal of Consent
Data Principals have the right to withdraw consent at any time with the same ease as giving consent.
- Must be as easy as giving consent
- Takes effect from time of withdrawal
- Does not affect prior processing
Upon withdrawal, Data Fiduciaries must:
- Stop processing immediately
- Erase personal data within specified time
- Ensure processors also erase data
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on valid consent, Consent Managers, withdrawal, and records.
What makes consent valid under the DPDP Act?
Under Section 6 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and unambiguous, signalled by a clear affirmative action. It must be preceded by a notice describing the personal data collected, the purpose, and how to exercise rights and withdraw consent. Pre-ticked boxes, bundled consent, and inferring consent from silence are not valid.
What is a Consent Manager under the DPDP Act?
A Consent Manager is an entity registered with the Data Protection Board that gives data principals a single, interoperable platform to give, manage, review, and withdraw consent across multiple data fiduciaries. Rule 4 of the DPDP Rules 2025 sets the registration and operating conditions, including a minimum net worth of ₹2 crore, interoperability, and no conflict of interest.
Can a data principal withdraw consent at any time?
Yes. The DPDP Act guarantees the right to withdraw consent at any time, and withdrawal must be as easy as giving it. Withdrawal takes effect from that point and does not invalidate processing already carried out lawfully. On withdrawal, the data fiduciary must stop processing and ensure it and its processors erase the personal data unless retention is legally required.
Do I still need consent if I already comply with GDPR?
Often, yes, and more frequently than under the GDPR. The DPDP Act is consent-centric and does not recognise a legitimate-interest basis, so several activities that rely on legitimate interest under the GDPR will need consent (or a narrow legitimate use) under DPDP. Existing GDPR consent mechanisms are a strong starting point but usually need re-engineering.
How should consent records be maintained?
Data fiduciaries should keep an auditable record of each consent — what was consented to, when, the notice shown, and any withdrawal — so they can demonstrate a valid basis for processing if the Data Protection Board asks. Where a Consent Manager is used, it maintains an interoperable consent audit trail that the data principal can access.
Continue your DPDP research
- DPDP Act compliance hub — the full guide to the Act and Rules 2025.
- DPDP compliance consulting in India — consent flow design and end-to-end implementation.
- DPDP penalty calculator — model the cost of consent and other defaults.
- Tranquility Cybersecurity credentials & proof.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
Data Principal Rights
Access, correction, erasure and grievance redressal rights.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
DPDP vs GDPR
Side-by-side comparison for companies subject to both regimes.
Read morePrivacy
GDPR Compliance
The EU's data protection regulation for any company with EU users.
Read morePrivacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read moreDPDP course · Module 2 of 8
Previous · Module 11.9 The DPDP Rules 2025, rule by ruleCourse map8 modules · 79 lessons · 24 readyNext · Module 33.1 What every data fiduciary must do
Next in the course: 2.4 Five words that make consent valid, tested. Saundhi Chauhan is writing it.