DPDP Consent
Management

Under Section 6 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and unambiguous, signalled by a clear affirmative action. It must be preceded by a notice describing the personal data collected, the purpose, and how to exercise rights and withdraw consent. Pre-ticked boxes, bundled consent, and inferring consent from silence are not valid.

A Consent Manager is an entity registered with the Data Protection Board that gives data principals a single, interoperable platform to give, manage, review, and withdraw consent across multiple data fiduciaries. Rule 4 of the DPDP Rules 2025 sets the registration and operating conditions, including a minimum net worth of ₹2 crore, interoperability, and no conflict of interest.

Yes. The DPDP Act guarantees the right to withdraw consent at any time, and withdrawal must be as easy as giving it. Withdrawal takes effect from that point and does not invalidate processing already carried out lawfully. On withdrawal, the data fiduciary must stop processing and ensure it and its processors erase the personal data unless retention is legally required.

Often, yes, and more frequently than under the GDPR. The DPDP Act is consent-centric and does not recognise a legitimate-interest basis, so several activities that rely on legitimate interest under the GDPR will need consent (or a narrow legitimate use) under DPDP. Existing GDPR consent mechanisms are a strong starting point but usually need re-engineering.

Data fiduciaries should keep an auditable record of each consent — what was consented to, when, the notice shown, and any withdrawal — so they can demonstrate a valid basis for processing if the Data Protection Board asks. Where a Consent Manager is used, it maintains an interoperable consent audit trail that the data principal can access.