What valid consent looks like under the DPDP Act

Sehmat team · 6 October 2026

Under the DPDP Act, valid consent is “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (s.6(1)). It covers only the data needed for the purpose you state, and it must follow a clear notice. The person must be able to withdraw it as easily as they gave it (s.6(4)).

In practice, that means a short notice in a language the person can read, a separate choice for each purpose, a real action such as a tick or a signature, and a record you can show later.

Key points

Consent must be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action (s.6(1)).
It is limited to the personal data necessary for the specified purpose (s.6(1)).
Any part of a consent that breaks the law is invalid to that extent (s.6(2)).
A notice must come with or before the request (s.5(1)). From 13 May 2027, Rule 3 sets its minimum contents.
Withdrawal must be as easy as giving consent (s.6(4); Rule 3(c)(i)).
If there is a dispute, the organisation must prove that notice was given and consent was received (s.6(10)).

What do the six words in s.6(1) mean in practice?

Free

The person has a real choice. Do not pressure them, and do not bundle an unrelated purpose with the service they came for.

Specific

Consent attaches to a stated purpose. “For our programs and other purposes” is not specific. Ask for each purpose separately when they are truly different.

Informed

The person knows what data you will use and why before they agree. That is the job of the notice.

Unconditional

Do not attach conditions that have nothing to do with the purpose. The Act’s own example concerns an insurance app. A customer consents to (i) processing for issuing her policy and (ii) waiving her right to complain to the Board. Part (ii) is invalid (s.6(2)).

Unambiguous, with a clear affirmative action

Silence, a pre-ticked box or “by continuing you agree” is unlikely to count as a clear action. A tick the person makes, a typed name, a signature or an OTP is.

Limited to what is necessary

The Act’s example is a telemedicine app that also asks for the phone’s contact list. The contact list is not needed for telemedicine. So the consent covers only the telemedicine processing (s.6(1), illustration).

What must the notice say?

Section 5(1) says the notice must tell the person what personal data you will process and why. It must also say how to withdraw consent, how to use her rights, and how to complain to the Board. From 13 May 2027, Rule 3 adds that the notice must:

be understandable on its own, without reference to other documents (Rule 3(a));
use clear and plain language (Rule 3(b));
give an itemised description of the personal data (Rule 3(b)(i));
state each specified purpose and the goods, services or uses it enables (Rule 3(b)(ii));
give a link to your website or app, and any other means, to withdraw consent, exercise rights and complain to the Board (Rule 3(c)).

The notice and the consent request must be available in English or any of the 22 languages in the Eighth Schedule to the Constitution (s.5(3), s.6(3)). The request must also give the contact details of your Data Protection Officer or another person who can answer questions (s.6(3)).

How easy must withdrawal be?

Section 6(4) says the person can withdraw “at any time, with the ease of doing so being comparable to the ease with which such consent was given.” If consent took one tap on a link, withdrawal should not need a letter and a visit.

After withdrawal, you and your Data Processors must stop processing within a reasonable time, unless a law requires or allows you to continue (s.6(6)). Withdrawal does not make earlier processing unlawful (s.6(5)).

If someone consented before the Act started, you can keep processing until they withdraw. You must still give them a notice “as soon as it is reasonably practicable” (s.5(2)). It must cover the data, the purpose, how to withdraw, how to use their rights and how to complain to the Board. Email, an in-app message or any other effective method will do, as the Act’s illustration shows.

Start with your largest and most active groups of people. Make the notice the start of a clean record, with a withdrawal link that works.

Why keep proof?

Section 6(10) puts the burden on you. If a question arises in a proceeding, you must prove that a notice was given and consent was received in line with the Act and Rules. A tick in a database is weak proof on its own. Stronger proof shows what the person saw, in which language, when, through which channel, and how they agreed.

The notice makes sense on its own and uses plain language.
Each data item is listed.
Each purpose is stated, with what it enables.
Unrelated purposes have separate choices. Nothing is pre-ticked.
Only the data needed for the purpose is asked for.
The person takes a clear action to agree.
The form is offered in English and the languages your people read.
A contact person for questions is named.
Withdrawal, rights and Board complaint routes are linked.
Withdrawal is as easy as giving consent.
You keep the notice version, language, time, channel and method of agreement.
People who consented before the Act have been sent a notice.

How Sehmat helps

Each notice is versioned at publish. Each consent is stored with the exact notice version and language shown, a proof PDF with an integrity code and an ISO/IEC TS 27560-style receipt.
People can agree by tick, typed name, drawn signature, OTP, video or voice.
Withdrawal takes effect at once from the person’s My consents page or link, for one purpose or all.
When a form changes, Sehmat asks people to consent again, sends reminders and renews consent before it expires.

Sources

This article is general information, not legal advice.