DPDPA Consent Requirements: Section 6 & DPDP Rules Explained

A customer gives a phone number for order updates. A business later wants to use the same number for marketing. Does the original consent cover that?

Under the DPDPA, the answer depends on what the person actually agreed to.

Section 6 sets the conditions for valid consent, while the DPDP Rules 2025 add requirements for the notice given before consent is collected.

In this guide, I’ll break down these requirements with simple examples so you can see what valid consent should actually look like in practice.

DPDPA Consent Requirements at a Glance

What Are the Consent Requirements Under DPDPA Section 6?

Section 6 of the Digital Personal Data Protection Act, 2023 sets the conditions businesses must meet when they rely on consent to process personal data. Under Section 6(1), consent must meet five conditions:

1. Free: A person must be able to give consent without being forced. A business should not require consent to collect personal data that is unnecessary for providing the requested service.
2. Specific: Consent must cover a clearly stated purpose. Permission to use an email address for order updates does not automatically cover promotional emails.
3. Informed: The person must know what personal data is being collected and why before agreeing.
4. Unconditional: A business cannot attach conditions that go beyond the purpose for which the person is giving consent. 
5. Unambiguous: The person must actively agree. Silence, pre-ticked checkboxes, or simply continuing to use a website do not count as clear affirmative consent.

Section 6(1) also limits consent to the personal data necessary for the specified purpose. For example, the Act uses a telemedicine app to explain this requirement. If the app asks for permission to provide medical consultations and access the user's phone contacts, consent does not justify collecting the contact list when it is unnecessary for the consultation.

Section 6(2) states that any part of consent that violates the DPDPA, its rules, or another applicable law is invalid to the extent of that violation. For example, an insurance company cannot ask a customer to give up their right to complain to the Data Protection Board as part of their consent.

Section 6 also sets further requirements:

• Clear consent requests: Under Section 6(3), requests must use plain language, offer access in English or an Eighth Schedule language, and provide the relevant contact details.
• Right to withdraw: Under Section 6(4), individuals can withdraw consent at any time, as easily as they gave it.
• Stopping processing: Under Section 6(6), businesses must stop the relevant processing within a reasonable time and ensure their Data Processors do the same, unless another legal ground permits continued processing.
• Proof of consent: Under Section 6(10), a business must prove that it gave the required notice and obtained valid consent if the matter is questioned in a proceeding.

These rules set the standard for when a business can treat a person's agreement as valid consent under the DPDPA.

What Is Valid and Invalid Consent Under DPDPA?

Valid consent requires a clear choice for a specific purpose. The difference becomes easier to see with a few examples.

Consent is valid for what the person actually agreed to, not other uses added later.

What Must a Consent Notice Include Under DPDP Rule 3?

Before asking someone to consent, the business needs to give them enough information to understand what they are agreeing to. Rule 3 of the DPDP Rules 2025 sets out what this notice must contain.

A consent notice must include:

• An itemised description of the personal data being processed. Instead of saying “we collect your information,” the notice should identify the data involved, such as name, email address, phone number, or location.
• The specific purpose of processing so the person knows why each type of personal data is needed.
• The goods, services, or uses connected to the processing so the person can understand what the data processing will enable.
• A way to withdraw consent through the provided website or app link, or any other stated method. Withdrawing consent must be as easy as giving it.
• A way to exercise DPDPA rights through the provided link or other stated method.
• A way to make a complaint to the Data Protection Board if the person needs to take the matter further.

Rule 3 also requires the notice to use clear and plain language and be understandable independently of other information. This means the person should not have to piece together different documents just to understand what they are being asked to consent to.

Before a person agrees, they should be able to see what data is involved, why it is needed, and how they can later withdraw consent or exercise their rights.

How to Obtain and Record Valid Consent Under DPDPA

Under Section 6(10), if consent is questioned, the Data Fiduciary must be able to show that the required notice was given and valid consent was obtained.

This means businesses should:

• Give the Rule 3 notice before asking for consent so the person can see what personal data will be processed, why it is needed, and what goods, services, or uses the processing enables.
• Get a clear affirmative action such as selecting an unchecked consent box or actively choosing to agree.
• Keep consent linked to the stated purpose. If a person agrees to receive marketing emails, that consent should not be used for a different purpose.
• Keep a record of the notice shown when consent was given. This should make it possible to show what the person was told before they agreed.
• Keep a record of the person's consent. The DPDPA does not set a specific format for consent records, but the business must be able to show that valid consent was obtained.
• Record when consent is withdrawn so processing based on that consent can be stopped and Data Processors can also be asked to stop where required.

The DPDPA does not require businesses to use a particular consent-record format. The requirement under Section 6(10) is to be able to prove what notice was given and that valid consent was obtained if the consent is questioned.

What Are the Rules for Withdrawal of Consent Under DPDPA?

A person can withdraw consent at any time when their consent is the basis for processing personal data. Section 6(4)-(7) explains what happens after that.

• Withdrawal must be as easy as giving consent. The process for withdrawing consent should offer comparable ease to the process used to give it.
• Withdrawal does not affect earlier processing. Personal data processed on the basis of consent before it was withdrawn remains lawful.
• The person bears the consequences of withdrawal. If a service depends on that consent, withdrawing it may affect the person's ability to continue using that service.
• Processing must stop within a reasonable time. The Data Fiduciary must stop processing based on the withdrawn consent and cause its Data Processors to stop as well.
• Some processing may still continue. This applies where processing without consent is required or authorised under the DPDPA, its Rules, or another law in force in India.
• Consent can be withdrawn through a Consent Manager. A Data Principal can use a registered Consent Manager to give, manage, review, or withdraw consent.

For example, the Act explains that if a customer withdraws consent after placing and paying for an online order, the e-commerce provider may stop the customer from placing new orders. However, it can continue processing the personal data needed to supply the goods already ordered and paid for.

Once consent is withdrawn, the business cannot simply continue the same consent-based processing because it already has the person's data. It needs to stop within a reasonable time unless the processing can legally continue without that consent.

What Are the Parental Consent Requirements Under DPDPA?

The DPDPA has additional consent requirements when personal data belongs to a child. Under the Act, a child is anyone under 18 years of age.

Before processing a child’s personal data, a Data Fiduciary must:

• Obtain verifiable consent from the parent before processing the child’s personal data.
• Check that the person identifying as the parent is an adult. Rule 10 allows this check using reliable identity and age details already available with the Data Fiduciary or details voluntarily provided by the person.
• Use an authorised virtual token where applicable. Identity and age details may be provided through a virtual token issued by an authorised entity.
• Avoid processing likely to have a detrimental effect on the child’s well-being.
• Avoid tracking or behavioural monitoring of children and targeted advertising directed at children, subject to the exemptions under the Act and Rules.

Section 9 also covers a person with a disability who has a lawful guardian, with Rule 10 setting out separate checks for the lawful guardian.

Note: These requirements are scheduled to come into force on May 13, 2027.

DPDPA Consent Compliance Checklist for Businesses

A Data Fiduciary relying on consent should check the following before and after personal data is collected:

How Can Businesses Manage DPDPA Consent Records?

If consent is questioned in a proceeding, a Data Fiduciary needs to show what notice was given and that the consent obtained met the DPDPA requirements.

This means the consent record should make it possible to establish:

• What notice the person received before giving consent.
• What purpose they agreed to and what personal data was covered.
• How consent was given through a clear affirmative action.
• Whether consent was later withdrawn and when that happened.

The DPDPA does not prescribe a specific format for storing consent records. Section 6(10) focuses on the ability to prove that the required notice was given and valid consent was obtained.

This becomes harder when consent records are spread across different websites, apps, or systems. A consent management system can keep the notice, consent choice, and later changes connected to the same record.

How ConsentIQ Helps Manage DPDPA Consent

ConsentIQ by IQWorks covers the consent process from collecting a person's choice to keeping a record of it and handling later changes.

For consent collection, businesses can use consent banners and preference centres to let people choose what they agree to. Consent can be managed across websites, mobile apps, email, and offline interactions.

Once consent is given, ConsentIQ keeps a record showing when, how, and what consent was obtained. Each record can include the person's consent choices, timestamp, and device details. It also adds cryptographic verification to these records. Each consent record gets a unique fingerprint and records are linked through hash chains. If an existing record is changed later, the change can be detected.

ConsentIQ also covers what happens after consent is given:

• People can view, change, or withdraw their consent through a preference centre.

• Consent changes can be passed to connected systems.
• Marketing opt-in decisions can be synced with CRMs such as HubSpot, Salesforce, Zoho, Dynamics 365, Marketo, and LeadSquared.
• Consent records can be exported when proof of consent is needed.

The cryptographic proof is an extra feature, not a DPDPA requirement. Its value is that a Data Fiduciary can check whether the consent record being relied on later is the same record that was originally stored.

Conclusion

The DPDPA sets clear requirements around how consent is requested, recorded, used, and withdrawn. Businesses now have a clear basis for reviewing their consent flows and fixing gaps before these requirements take effect.

Consent records are an important part of that preparation, especially when consent is collected across websites, apps, CRMs, and other systems.

For businesses that do not want to manage this through scattered forms, spreadsheets, and separate systems, ConsentIQ by IQWorks provides a dedicated way to collect, manage, and verify consent records.

If DPDPA consent management is the next compliance task, ConsentIQ is worth considering for keeping those records clear and verifiable from the start.

Frequently Asked Questions

1. What are the consent requirements under DPDPA?

Under Section 6, consent must be free, specific, informed, unconditional, and unambiguous. It must involve a clear affirmative action and cover personal data necessary for the specified purpose.

2. Is a pre-ticked checkbox valid consent under DPDPA?

No. A pre-ticked checkbox does not show clear affirmative action from the person. The person needs to actively choose to give consent.

3. Can one consent be used for multiple purposes?

Only if the consent actually covers those specified purposes. Consent given for delivery updates, for example, cannot automatically be used for marketing.

4. Does DPDPA require businesses to keep consent records?

The DPDPA does not prescribe a specific consent-record format. However, Section 6(10) requires the Data Fiduciary to prove that the required notice was given and valid consent was obtained if questioned in a proceeding.

5. Can a person withdraw consent under DPDPA?

Yes. Consent can be withdrawn at any time, and withdrawing it must be as easy as giving it. Consent-based processing must then stop within a reasonable time unless the law permits it to continue.