Consent and notice under the DPDP Act: a practical guide
Reviewed against the law as of 28 September 2026
What valid consent and notice look like under the DPDP Act 2023: the five conditions, notice contents, languages, withdrawal and legitimate uses.
Under the DPDP Act, an organisation may process personal data only for a lawful purpose, and only with consent or for a legitimate use (section 4). For most customer-facing processing, that means consent, and consent must be preceded by a notice.
The five conditions for valid consent
Section 6(1) says consent must be:
- Free: not forced or made a condition of something unrelated.
- Specific: for a stated purpose, not a blanket permission.
- Informed: given after a clear notice.
- Unconditional: not bundled with other terms.
- Unambiguous: given by a clear affirmative action, such as ticking an empty box.
It must also be limited to the personal data necessary for the specified purpose. Any part of a consent that goes beyond this, or infringes the Act, is invalid to that extent.
What the notice must say
Every request for consent must be accompanied or preceded by a notice. Under the Act and the Rules, it should be understandable on its own, independently of other information, and include:
- an itemised description of the personal data collected;
- the specific purpose of processing, and the goods, services or uses it enables;
- how to withdraw consent, with a link or means as easy as the one used to give it;
- how to exercise rights and use grievance redressal;
- how to complain to the Data Protection Board.
People must be able to read the notice and the consent request in English or any language in the Eighth Schedule to the Constitution.
Withdrawal
A person can withdraw consent at any time, and withdrawing must be as easy as giving it. After withdrawal, you must stop processing within a reasonable time, and make your processors stop, unless another lawful basis applies. Withdrawal does not make earlier processing unlawful.
In practice, withdrawal is where systems fail: a marketing platform, a CRM and an analytics tool may each hold a copy. Track withdrawals until every downstream system confirms.
Proving consent
If there is a dispute, the burden of proof is on you to show that notice was given and consent obtained. Keep a ledger that records, for each person and purpose: when consent was given or withdrawn, through which channel, and against which version of the notice.
Consent Managers
A Consent Manager is a registered, India-based platform through which people can give, manage, review and withdraw consent across organisations. Their framework applies from November 2026. If a person gives consent through a Consent Manager, you must honour it and withdrawals made through it.
Legitimate uses: when consent is not needed
Section 7 lists situations where consent is not required, including:
- data a person voluntarily provides for a specified purpose, where they have not objected to its use;
- performing a legal obligation or complying with a court order;
- responding to a medical emergency, epidemic or disaster;
- employment purposes, such as preventing corporate espionage or providing benefits;
- certain functions and benefits provided by the State.
The list is closed. There is no general "legitimate interests" ground as in GDPR.
Children and persons with disability
For a child, consent must come from a parent or lawful guardian and be verifiable. For a person with a disability who cannot take legal decisions even with support, the lawful guardian consents. See children's data under DPDP.
A practical checklist
- One notice per purpose, in plain language, with an itemised data list.
- Unticked checkboxes, separate from terms of service.
- A withdrawal link in every account and every marketing message.
- A consent ledger tied to notice versions.
- Withdrawal propagated to every processor, with confirmation.
- A review whenever a new purpose appears: new purposes need new consent or a legitimate use.
TrustNiq keeps a consent ledger with notice versions, tracks withdrawals until each downstream system confirms, and flags data used for purposes its notice does not cover. See how it works.
Frequently asked questions
Can we bundle consent into our terms and conditions?
No. Consent must be specific to a purpose and limited to the data necessary for it. A single acceptance of long terms that covers unrelated purposes is unlikely to meet the Act's conditions.
Do we need fresh consent from existing customers?
Where consent was given before the Act's commencement, the Act requires you to give a notice as soon as reasonably practicable, and you may continue processing until the person withdraws consent.
Do we need consent for employee data?
Processing for employment purposes is one of the legitimate uses in section 7, so consent is not required for those purposes. Other uses of employee data may still need consent.
Sources
- Digital Personal Data Protection Act, 2023, sections 4 to 7meity.gov.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.