Consent under the DPDP Act is valid only if it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for a specified purpose. That is Sec. 6(1). It is one of two lawful grounds for processing. The other is the list of "certain legitimate uses" in Sec. 7, which need no consent at all.
This page walks through both, and how the notice under Rule 3 fits in. The notice itself has its own page: what a DPDP consent notice must contain.
The two grounds: consent and legitimate uses
Sec. 4(1) lets a person process personal data only in accordance with the Act and for a lawful purpose, either one for which the Data Principal has given consent, or for certain legitimate uses. Sec. 4(2) defines a lawful purpose as any purpose not expressly forbidden by law.
In practice, record one primary ground per purpose and keep the evidence for it. If you choose consent, every duty in Sec. 6 follows. If you choose a legitimate use, Sec. 6 does not apply to that processing, but Sec. 8 still does.
The six tests in Sec. 6(1)
The words are cumulative, so consent has to pass all of them. The glosses below are our reading of the words, not text from the Act.
- Free: not obtained by pressure or by making an unrelated service depend on it.
- Specific: tied to a stated purpose, not a general permission.
- Informed: given after the Data Principal has seen the notice.
- Unconditional: not bundled with terms that go beyond the purpose.
- Unambiguous, with a clear affirmative action: the Data Principal must do something. Silence and pre-ticked boxes do not meet this.
- Limited to necessary data: consent covers only the personal data necessary for the specified purpose.
The Act's own illustration under Sec. 6(1) makes the last test concrete. A telemedicine app asks for consent to process data for telemedicine services and also for access to the phone's contact list. The user agrees to both. Because the contact list is not necessary for telemedicine, her consent is limited to the telemedicine purpose.
Two further provisions shape what valid means. Sec. 6(2) makes any part of a consent that infringes the Act, the Rules or another law invalid to that extent. The illustration is an insurer asking the customer to waive her right to complain to the Board: that part is invalid. And Sec. 6(3) requires every request for consent to be in clear and plain language, with an option to read it in English or any Eighth Schedule language, and with the contact details of a Data Protection Officer where applicable, or of another person authorised to respond to rights requests.
Notice comes first, and Rule 3 sets its content
Sec. 5(1) requires every consent request to be accompanied or preceded by a notice covering the personal data and its purpose, how the Data Principal can exercise her rights under Sec. 6(4) and Sec. 13, and how to complain to the Board.
Rule 3 of the DPDP Rules, 2025 adds the detail. The notice must:
- be presented and be understandable independently of any other information the Fiduciary has made available;
- give a fair account in clear and plain language, including at the minimum an itemised description of the personal data and the specified purposes, with a specific description of the goods or services or uses to be enabled;
- give the link to the Fiduciary's website or app and describe other means to withdraw consent (with ease comparable to giving it), exercise rights, and complain to the Board.
The consequence for design is that a single "I agree to the privacy policy" checkbox is hard to reconcile with specific consent for several purposes. Each purpose needs to be visible and separately answerable. Rule 3 commences on 13 May 2027 under Rule 1(4).
Withdrawal, and what happens to the data
Sec. 6(4) gives the right to withdraw at any time. The two ease tests are the ones to build against: if consent took one tap, withdrawal cannot take an email and a week.
Sec. 6(5) says the Data Principal bears the consequences of withdrawing, and the withdrawal does not affect the legality of processing done before it. The Act's illustration is an e-commerce user who withdraws: the platform may stop letting her place orders but may not stop the processing needed to deliver goods already ordered and paid for.
Sec. 6(6) then puts two duties on the Fiduciary. Within a reasonable time it must cease processing, and it must cause its Data Processors to cease as well, unless processing without consent is required or authorised by law. Sec. 8(7) adds erasure on withdrawal, unless retention is necessary for compliance with a law. Withdrawal therefore has to reach your processors, which is a systems problem as much as an interface one.
The nine legitimate uses in Sec. 7
Sec. 7 lets a Data Fiduciary process personal data without consent for these uses:
- (a) the specified purpose for which the Data Principal voluntarily provided her data, where she has not indicated that she does not consent to that use;
- (b) the State providing a prescribed subsidy, benefit, service, certificate, licence or permit, subject to the conditions in that clause;
- (c) a State function under law, or in the interest of sovereignty and integrity of India or security of the State;
- (d) fulfilling a legal obligation to disclose information to the State;
- (e) compliance with a judgment, decree or order under Indian law, or an order on a contractual or civil claim under law outside India;
- (f) a medical emergency involving a threat to life or immediate threat to health;
- (g) medical treatment or health services during an epidemic, outbreak or public-health threat;
- (h) safety or assistance during a disaster or breakdown of public order; and
- (i) employment, and safeguarding the employer from loss or liability.
Clause (a) is the one most private businesses touch. Its illustration is a pharmacy customer who gives her number so the pharmacy can send a payment receipt: that purpose needs no separate consent. If she later says she no longer wants the service, the processing stops, per the real-estate broker illustration. Clause (a) covers only the purpose she provided the data for; using the same number for marketing is a different purpose and needs its own ground.
Clause (i) lets an employer process data for employment purposes without consent, which is why HR processing is mostly outside the consent machinery. Sec. 8 duties still apply.
Proving consent and using a Consent Manager
Sec. 6(10) puts the burden on you. Where consent is the basis and the question arises in a proceeding, the Data Fiduciary must prove that a notice was given and consent was given in accordance with the Act and Rules. In practice that means keeping a record per purpose: the notice version shown, the time, the choice, and any later withdrawal. A Data Principal can also give, manage, review or withdraw consent through a registered Consent Manager under Sec. 6(7).
Existing consents are not wiped on commencement. Sec. 5(2) requires a notice as soon as reasonably practicable to people who consented earlier, and allows processing to continue until she withdraws.
For the product that records these events, see consent management. The dates are in DPDP Rules 2025: what commences when, the roles in DPDP Act definitions, and the person's rights after consent in rights of a Data Principal.