The qualities of valid consent
Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must be limited to the data needed for the specified purpose. In the Act's example, a telemedicine app cannot rely on consent to read the phone's contact list, because telemedicine does not need it.
Sources: Act s.6(1)
Invalid parts of consent
Any part of a consent that infringes the Act, the Rules or another law is invalid to that extent. In the Act's example, an insurer asks a buyer to waive her right to complain to the Board. That part of the consent is invalid.
Sources: Act s.6(2)
Withdrawal and what follows
Where consent is the basis, the person may withdraw at any time, and withdrawing must be as easy as giving. Withdrawal does not make earlier processing unlawful, and she bears its consequences: a shop may stop taking her new orders but must still deliver goods already paid for.
After withdrawal, the Fiduciary must, within a reasonable time, stop processing and make its Processors stop too, unless the Act or another law requires or authorises processing without consent. It must also erase the data, unless a law requires it to be kept (lesson 6).
Sources: Act s.6(4)Act s.6(5)Act s.6(6)Act s.8(7)
Proving consent
If consent is questioned in a proceeding, the Data Fiduciary must prove that it gave a notice and that consent was given in line with the Act and Rules. In practice this means keeping a record of each notice version and each consent event.
Sources: Act s.6(10)
Consent Managers
A person may give, manage, review or withdraw consent through a Consent Manager. Under Rule 4, an applicant meeting Part A of the First Schedule applies to the Board. The Board may inquire, then register it and publish its details, or reject it with reasons.
Part A conditions include being a company incorporated in India, with a net worth of at least Rs 2 crore and sound finances and management. It also needs independent certification that its interoperable platform meets the Board's standards. The Board may suspend or cancel a registration after a hearing.
Part B duties include being unable to read the data it passes on, and keeping records of consents, notices and sharing for at least seven years. It must not sub-contract its obligations. It must act in a fiduciary capacity, avoid conflicts of interest, and get Board approval before any change of control.
Sources: Act s.6(7)Act s.6(9)Rules r.4Rules First Schedule
Key points
- Consent must be free, specific, informed, unconditional and unambiguous.
- Invalid clauses fall away to the extent they break the law.
- Withdrawing must be as easy as giving.
- The Fiduciary carries the burden of proving notice and consent.
- Consent Managers: Indian company, Rs 2 crore net worth, Board registration.
In practice
A checklist for your organisation.
- Use unticked boxes or clear buttons; never assume consent from silence.
- Put the withdraw option where the consent was first given.
- Send withdrawal signals to every Processor and record the stop date.
- Store each consent with the notice version the person saw.
- Before relying on a Consent Manager, check the Board's published register.
Check what you learned
5 questions. Choose an answer to see why it is right.
0 of 5 answered
Question 1 of 5
Which words describe valid consent in section 6(1)?
Show the answer
B. Free, specific, informed, unconditional and unambiguous
Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action.
Act s.6(1)Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action.
Act s.6(1)Question 2 of 5
An insurance consent form includes a waiver of the right to complain to the Board. What is the effect?
Show the answer
A. The waiver part is invalid
Section 6(2) makes the infringing part invalid; the Act's insurer illustration says the waiver of the right to complain is invalid.
Act s.6(2)Section 6(2) makes the infringing part invalid; the Act's insurer illustration says the waiver of the right to complain is invalid.
Act s.6(2)Question 3 of 5
How easy must withdrawal of consent be?
Show the answer
B. Comparable to the ease of giving consent
Section 6(4) requires the ease of withdrawing to be comparable to the ease with which consent was given.
Act s.6(4)Section 6(4) requires the ease of withdrawing to be comparable to the ease with which consent was given.
Act s.6(4)Question 4 of 5
What minimum net worth must a Consent Manager applicant have?
Show the answer
B. Rs 2 crore
Part A of the First Schedule requires the applicant's net worth to be not less than two crore rupees.
Rules First Schedule Part A item 4Part A of the First Schedule requires the applicant's net worth to be not less than two crore rupees.
Rules First Schedule Part A item 4Question 5 of 5
For how long, at minimum, must a Consent Manager keep its record of consents?
Show the answer
C. Seven years
Part B, item 4(c) of the First Schedule requires the record to be kept for at least seven years, or longer if agreed or required by law.
Rules First Schedule Part B item 4(c)Part B, item 4(c) of the First Schedule requires the record to be kept for at least seven years, or longer if agreed or required by law.
Rules First Schedule Part B item 4(c)
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.