# Lesson 5: Consent in detail, Consent Managers | Learn DPDP | FOCTTA > The qualities of valid consent, withdrawal and its effects, who must prove consent, and how registered Consent Managers work. Web page: https://foctta.com/learn/consent-and-consent-managers This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 5 Lesson 5 of 12 · 7 min read # Consent in detail, Consent Managers The qualities of valid consent, withdrawal and its effects, who must prove consent, and how registered Consent Managers work. Jump to the quiz ## Where things stand - Not yet in force. Section 6(1) to (8) and (10) start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c) - Consent Manager registration (section 6(9) and Rule 4) starts one year after 13 November 2025, in November 2026. No one can be registered before then. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (b); Rules r.1(3) - No Board registration process or list of registered Consent Managers was located. Rule 4(1) leaves the application particulars for the Board to publish. Checked 28 Sep 2026 Source: Search of meity.gov.in and eGazette, 28 Sep 2026: not confirmed ## The qualities of valid consent Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must be limited to the data needed for the specified purpose. In the Act's example, a telemedicine app cannot rely on consent to read the phone's contact list, because telemedicine does not need it. Sources: Act s.6(1) ## Invalid parts of consent Any part of a consent that infringes the Act, the Rules or another law is invalid to that extent. In the Act's example, an insurer asks a buyer to waive her right to complain to the Board. That part of the consent is invalid. Sources: Act s.6(2) ## Withdrawal and what follows Where consent is the basis, the person may withdraw at any time, and withdrawing must be as easy as giving. Withdrawal does not make earlier processing unlawful, and she bears its consequences: a shop may stop taking her new orders but must still deliver goods already paid for. After withdrawal, the Fiduciary must, within a reasonable time, stop processing and make its Processors stop too, unless the Act or another law requires or authorises processing without consent. It must also erase the data, unless a law requires it to be kept (lesson 6). Sources: Act s.6(4) Act s.6(5) Act s.6(6) Act s.8(7) ## Proving consent If consent is questioned in a proceeding, the Data Fiduciary must prove that it gave a notice and that consent was given in line with the Act and Rules. In practice this means keeping a record of each notice version and each consent event. Sources: Act s.6(10) ## Consent Managers A person may give, manage, review or withdraw consent through a Consent Manager. Under Rule 4, an applicant meeting Part A of the First Schedule applies to the Board. The Board may inquire, then register it and publish its details, or reject it with reasons. Part A conditions include being a company incorporated in India, with a net worth of at least Rs 2 crore and sound finances and management. It also needs independent certification that its interoperable platform meets the Board's standards. The Board may suspend or cancel a registration after a hearing. Part B duties include being unable to read the data it passes on, and keeping records of consents, notices and sharing for at least seven years. It must not sub-contract its obligations. It must act in a fiduciary capacity, avoid conflicts of interest, and get Board approval before any change of control. Sources: Act s.6(7) Act s.6(9) Rules r.4 Rules First Schedule ## Key points - Consent must be free, specific, informed, unconditional and unambiguous. - Invalid clauses fall away to the extent they break the law. - Withdrawing must be as easy as giving. - The Fiduciary carries the burden of proving notice and consent. - Consent Managers: Indian company, Rs 2 crore net worth, Board registration. ## In practice A checklist for your organisation. - Use unticked boxes or clear buttons; never assume consent from silence. - Put the withdraw option where the consent was first given. - Send withdrawal signals to every Processor and record the stop date. - Store each consent with the notice version the person saw. - Before relying on a Consent Manager, check the Board's published register. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### Which words describe valid consent in section 6(1)? - Verbal only - Free, specific, informed, unconditional and unambiguous - Written and notarised - Implied, general and bundled Show the answer **B. Free, specific, informed, unconditional and unambiguous** Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action. Act s.6(1) 2. Question 2 of 5 ### An insurance consent form includes a waiver of the right to complain to the Board. What is the effect? - The waiver part is invalid - The Board must approve it - The whole consent is void - The waiver is valid if signed Show the answer **A. The waiver part is invalid** Section 6(2) makes the infringing part invalid; the Act's insurer illustration says the waiver of the right to complain is invalid. Act s.6(2) 3. Question 3 of 5 ### How easy must withdrawal of consent be? - Only possible through the Board - Comparable to the ease of giving consent - Only possible by letter - Harder than giving consent Show the answer **B. Comparable to the ease of giving consent** Section 6(4) requires the ease of withdrawing to be comparable to the ease with which consent was given. Act s.6(4) 4. Question 4 of 5 ### What minimum net worth must a Consent Manager applicant have? - Rs 50 lakh - Rs 2 crore - Rs 10 crore - Rs 100 crore Show the answer **B. Rs 2 crore** Part A of the First Schedule requires the applicant's net worth to be not less than two crore rupees. Rules First Schedule Part A item 4 5. Question 5 of 5 ### For how long, at minimum, must a Consent Manager keep its record of consents? - Ten years - Three years - Seven years - One year Show the answer **C. Seven years** Part B, item 4(c) of the First Schedule requires the record to be kept for at least seven years, or longer if agreed or required by law. Rules First Schedule Part B item 4(c) Try again[Next lesson: Duties of a Data Fiduciary](https://foctta.com/learn/fiduciary-duties) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 4 **The notice before consent**](https://foctta.com/learn/notice) [Lesson 6 → **Duties of a Data Fiduciary**](https://foctta.com/learn/fiduciary-duties) **In this lesson** 1. Where things stand 2. The qualities of valid consent 3. Invalid parts of consent 4. Withdrawal and what follows 5. Proving consent 6. Consent Managers 7. Key points 8. In practice 9. Quiz Take the quiz