DPDP Valid Consent: How to Prove It Under India's Law
Valid consent under the DPDP Act is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to a specified purpose and the data it needs (DPDP Act, 2023, s.6(1)). If it is questioned before the Board, the Data Fiduciary must prove notice and consent were given in line with the Act and Rules (s.6(10)). Your record must show the notice, the affirmative act, the scope, and withdrawal on comparable terms.
Source: IQWorks Research | Last updated: October 2026
A timestamp and a checkbox state tell you someone clicked something once. They cannot show the Data Protection Board which notice that person saw, what they agreed to, or whether they could withdraw as easily. Under Section 6(10) of the Digital Personal Data Protection Act, 2023, that gap belongs to the Data Fiduciary (the person or organisation that decides the purpose and means of processing), which carries the burden of proving valid consent (DPDP Act, 2023, s.6(10)). Proof of consent has to be built at the moment of collection, from records of the notice shown, the affirmative act, the scope agreed and any later withdrawal, including each Data Processor told to stop. Design each consent record so you could hand it to the Board as evidence.
What makes consent valid under the DPDP Act
The test in Section 6(1)
Section 6(1) sets the conditions for valid consent. Consent from the Data Principal (the individual the data is about) must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action". It must signify agreement to processing for the specified purpose and be limited to the personal data necessary for that purpose (DPDP Act, 2023, s.6(1)).
In the Act's illustration, a telemedicine app asks for consent to provide its service and to read the user's contact list, and she agrees to both. The contact list is not necessary for telemedicine, so her consent covers only telemedicine (s.6(1), Illustration).
When part of a consent is invalid (s.6(2))
Any part of a consent that infringes the Act, the Rules or any other law in force is invalid to the extent of that infringement (s.6(2)). In the Act's illustration, an insurer bundles a waiver of the customer's right to complain to the Board into its policy consent, and the waiver is invalid (s.6(2), Illustration).
The notice that has to come with or before the request (s.5(1); Rule 3)
Every consent request must be accompanied or preceded by a notice setting out the personal data and purpose, how to exercise rights under s.6(4) and s.13, and how to complain to the Board (s.5(1)).
Rule 3 of the DPDP Rules, 2025 adds that the notice must be understandable on its own. It must itemise the personal data, state the specified purposes, describe the goods, services or uses enabled, and give the communication link and other means to withdraw consent, exercise rights and complain to the Board (DPDP Rules, 2025, Rule 3).
Language and contact details (s.5(3), s.6(3))
The Data Principal must have the option to access the notice and the consent request in English or any Eighth Schedule language (s.5(3), s.6(3)). The request must also give contact details for the Data Protection Officer, where applicable, or another authorised person (s.6(3)). More on a notice in any Eighth Schedule language.
Consents collected before the Act (s.5(2))
For consent given before the Act commenced, the Data Fiduciary must give a notice "as soon as it is reasonably practicable", and may keep processing until the Data Principal withdraws (s.5(2)).
Who carries the burden of proof, and in what setting
Where consent is the basis of processing and a question arises in a proceeding, the Data Fiduciary must prove that notice and consent were given in accordance with the Act and the Rules (s.6(10)).
A "proceeding" means any action taken by the Board under the Act (s.2(w)). The Board has civil-court powers to summon and examine people on oath, require documents, and inspect any data, book, document or register (s.28(7)).
Most consent and notice failures have no Schedule entry of their own and fall under entry 7, the residual head, which "may extend to fifty crore rupees", decided on the s.33(2) factors. Breach of the additional obligations in relation to children under s.9, such as verifiable parental consent, is entry 3: up to ₹200 crore. See the DPDPA penalties guide and DPDP penalty estimator.
The four things your consent evidence must show
| What the Act requires | What you must be able to show later | Clause |
|---|---|---|
| A notice with or before the request | The exact notice version and language shown, with its itemised data and purposes | s.5(1); Rule 3 |
| A clear affirmative action | Who acted, when, on which channel, against which notice, and what they selected | s.6(1) |
| Specified purpose and necessary data only, with no invalid terms | The purposes and data items recorded, and a review of bundled terms | s.6(1); s.6(2) |
| Withdrawal as easy as giving consent | A withdrawal route on comparable terms, and a record of every withdrawal | s.6(4); Rule 3(c)(i) |
When you don't need consent at all (s.7, briefly)
Section 7 lists "certain legitimate uses" that need no consent. Asking for consent you don't need creates records you then have to defend.
Under s.7(a), a Data Fiduciary may process data for the specified purpose for which the Data Principal voluntarily provided it, unless she has indicated that she does not consent. The s.11 and s.12 rights still cover s.7(a) processing. In the Act's illustration, a pharmacy may text a payment receipt to the number a customer gave for that purpose (s.7(a), Illustration I). Under s.7(i), processing for employment purposes, or to safeguard the employer from loss or liability, is also a legitimate use (DPDP Act, 2023, s.7).
See consent vs legitimate interest and DPDP consent management requirements.
What a defensible consent record contains
| Field | Why it matters | Clause |
|---|---|---|
| Notice version ID and text hash | Which notice was shown | s.5(1); Rule 3 |
| Language served | The language option was given | s.5(3); s.6(3) |
| Itemised data items | Consent was limited to necessary data | s.6(1); Rule 3(b)(i) |
| Specified purpose(s) | Consent was specific | s.6(1); Rule 3(b)(ii) |
| Affirmative-action evidence (UI event, channel) | A clear affirmative action | s.6(1) |
| Timestamp | What processing preceded any withdrawal | s.6(5); s.6(10) |
| Data Fiduciary and any Data Processors | Who must stop on withdrawal | s.6(6); s.8(7)(b) |
| Consent Manager reference, if used | Links the event to the Consent Manager's record | s.6(7) |
| Principal identifier (minimised) | Links record to person with minimal data | s.8(5); Rule 6(1)(a) |
| Withdrawal events | Withdrawal was available and acted on | s.6(4); Rule 3(c)(i) |
| Processor cessation confirmations | Processors were made to stop | s.6(6); s.8(7)(b) |
Keep the record from becoming a new personal-data liability
A consent log is personal data, so the s.8(5) security duty applies. Rule 6(1)(a) lists encryption, obfuscation, masking and virtual tokens as examples of security measures (DPDP Rules, 2025, Rule 6(1)(a)). A keyed hash of the email or phone number lets you match a record to the person asking without storing plaintext.
ConsentIQ is one way to do this. Our consent management solution page describes "A digitally signed record of each consent, in a console that masks personal identifiers", and the ConsentIQ product page says its CRM sync "matches on hashed identifiers and writes back only the consent decision".
Making records tamper-evident and independently checkable
Hash-chaining stores with each record a hash of the one before it, so editing or deleting an old entry breaks every later link. A digital signature, checked against a published public key, lets an auditor or the Board confirm a record is genuine without trusting the platform that issued it.
MeitY's Electronic Consent Framework (version 1.1) describes a consent artefact as a machine-readable electronic document that must be digitally signed. Use it as a model only: the notified DPDP Rules, 2025 do not define or require a "consent artefact" or the ECF. More on tamper-evident consent records.
Proving withdrawal was as easy as giving consent
The Data Principal may withdraw at any time, "with the ease of doing so being comparable to the ease with which such consent was given" (s.6(4)). As a practical test, if consent took one tap in the app, so should withdrawal.
The consequences of withdrawal fall on the Data Principal, and earlier processing stays lawful (s.6(5)). In the Act's illustration, a shopper who withdraws can be stopped from placing new orders, but her paid order must still be fulfilled (s.6(5), Illustration).
The Data Fiduciary must then cease processing, and cause its Data Processors to cease, within a reasonable time, unless law requires or authorises it (s.6(6)). In the Act's example, a telecom customer moves from emailed to in-app bills, so the provider and its email processor must stop emailing them (s.6(6), Illustration). Unless retention is legally required, the Data Fiduciary must also erase the data and have its processors erase it (s.8(7)(a) and (b)).
Keep the withdrawal event (channel and steps), propagation logs and each processor's cessation or erasure confirmation. Withdrawals often arrive as rights requests, so tie this to your DSR workflows. ConsentIQ's Preference Center lets users view, modify or withdraw consent at any time.
Children and persons with disabilities: verifiable consent
Before processing the personal data of a child, or of a person with disability who has a lawful guardian, the Data Fiduciary must obtain the verifiable consent of the parent or lawful guardian (s.9(1)).
Rule 10 requires due diligence that the person identifying as the parent is an adult, identifiable if required for compliance with any law in force in India. The check uses reliable identity and age details already held, identity and age details the individual voluntarily provides, or a virtual token issued by an authorised entity (including details verified by a Digital Locker service provider) (DPDP Rules, 2025, Rule 10(1), 10(2)(b)). Under Rule 11, a lawful guardian must be verified as appointed by a court, a designated authority or a local level committee.
Record which route was used. See verifiable parental consent.
Consent given through a Consent Manager
A Data Principal may give, manage, review or withdraw consent through a Consent Manager registered with the Board (s.6(7) to s.6(9)).
Under Rule 4 and First Schedule Part B, the Consent Manager records consents given, denied or withdrawn, the related notices, and data sharing. It must give the Data Principal access, in machine-readable form on request, and keep the record for at least seven years, or longer if agreed or required by law (First Schedule, Part B, items 3 and 4).
See registered Consent Managers for registration.
How long to keep consent evidence
Neither the Act nor the Rules set a retention period for a Data Fiduciary's own consent records. Relevant provisions:
- Rule 8(3): personal data, traffic data and processing logs kept at least one year from processing, for the Seventh Schedule purposes, then erased unless other law requires longer.
- Rule 6(1)(e): security logs and related personal data kept for one year, unless other law requires otherwise.
- s.8(7): erase personal data on withdrawal or once the purpose is no longer served, unless the law requires retention.
Agree a documented retention rule with counsel, and record the reasoning.
When these obligations bite: the timeline
The Act was enacted on 11 August 2023. The Rules, G.S.R. 846(E), were notified in the Gazette dated 13 November 2025. Commencement dates:
- Rule 4 (Consent Managers): one year after publication, 13 November 2026 (Rule 1(3)).
- Rule 3 (notice) and Rules 5 to 16, including security, retention and verifiable consent: 18 months after publication, 13 May 2027 (Rule 1(4)).
Consent evidence checklist for DPOs
- Every notice has a version ID, stored text and hash, and each consent points to one.
- The record logs the language served for each notice and request.
- Each consent logs the affirmative action (no pre-ticked boxes), UI event and channel.
- Purposes, data items and bundled terms have been reviewed (s.6(1), s.6(2)).
- Withdrawal parity has been tested on every collection channel.
- Each Data Processor has been tested to stop, and confirm, on withdrawal.
- A scheduled job verifies the hash chain or signatures.
- Counsel has agreed a documented retention rule.
- Access to the consent store is restricted and logged.
- You can pull a sample evidence pack for one Data Principal.
Related reading: compare the best consent management platforms for DPDP compliance, see how privacy by design becomes an engineering system, follow breach notification on the DPDP clock, and see how the IQWorks suite fits a DPO's workflow.
Key Takeaways
- The Data Fiduciary must prove notice and consent in a Board proceeding (s.6(10)).
- Withdrawal must be as easy as consent, and Data Processors must stop too (s.6(4), s.6(6)).
- The seven-year record period applies to Consent Managers; Data Fiduciaries need their own retention rule.
Frequently asked questions
Who has to prove consent was valid under the DPDP Act?
The Data Fiduciary. Under s.6(10), where consent is the basis of processing and a question arises in a Board proceeding, it must prove that it gave a notice and that consent was given in accordance with the Act and the Rules.
Is a pre-ticked box or a terms-of-service click valid consent under DPDP?
Section 6(1) requires a clear affirmative action, and a box ticked by default involves no action by the Data Principal. Consent must also be for a specified purpose and limited to necessary data, which a terms-of-service click rarely shows. The Act does not mention pre-ticked boxes; this is our reading of s.6(1).
What must a DPDP consent notice contain?
The personal data and purpose, how to exercise rights under s.6(4) and s.13, and how to complain to the Board (s.5(1)). Rule 3 adds that it must stand on its own, itemise the data, describe the specified purposes and give the means to withdraw, exercise rights and complain.
Does withdrawing consent make past processing unlawful?
No. Under s.6(5), withdrawal does not affect the legality of processing based on consent before it, and the consequences of withdrawing fall on the Data Principal. In the Act's illustration, a shopper who withdraws can be refused new orders, but an order she has already paid for is still fulfilled. Processing must then stop within a reasonable time (s.6(6)).
What happens to data held by processors after consent is withdrawn?
The Data Fiduciary must cause its Data Processors to cease processing within a reasonable time (s.6(6)). Unless retention is necessary for compliance with law, it must also cause them to erase the personal data it made available to them (s.8(7)(b)), though Rule 8(3) requires personal data and processing logs, a processor's included, to be kept for at least one year. Log the instruction sent to each processor and its confirmation as evidence.
Do we need fresh consent from customers who agreed before the Act?
Section 5(2) asks for a notice, not new consent. The Data Fiduciary must give those Data Principals a notice as soon as reasonably practicable, setting out the personal data and purpose, how to exercise rights under s.6(4) and s.13, and how to complain to the Board. Processing can continue until the Data Principal withdraws.
How long should consent records be kept?
There is no single period for Data Fiduciaries. Rule 8(3) sets a one-year minimum for processing logs, and Rule 6(1)(e) sets one year for security logs. Consent Managers must keep their records for at least seven years (First Schedule, Part B, item 4(c)).
Conclusion
Valid consent under the DPDP Act is a legal test in s.6(1), and s.6(10) makes the Data Fiduciary prove it passed. That proof comes from records made at the time: notice version, affirmative act, scope, and every withdrawal with processor confirmations. Map your collection points against s.6(1) and s.6(2), version notices against Rule 3, and test withdrawal on each channel before Rule 3 commences on 13 May 2027.
To see how a consent evidence pack is produced for one Data Principal, take a look at ConsentIQ.
Our verdict
8 ratings, from Customer Success Research.
Free DPDP Implementation Workshop
A 90-minute session for your team, on-site or remote: the DPDP Act applied to your organization, a 90-day roadmap, and the top five actions per department.
Book the workshopRelated Solutions
Notices, consent, children's data, rights requests and breaches for the DPDP Act, on one inventory.
