Under the DPDP Act, valid consent is free, specific, informed, unconditional and unambiguous, and is given by a clear action. The request must come with a notice in plain language that lists the personal data, the purpose, how to withdraw consent and exercise rights, and how to complain to the Board.
- A notice explains; consent agrees. They go together.
- Consent must be as easy to withdraw as to give.
- Some processing is allowed without consent as a “legitimate use”.
What valid consent looks like
Section 6 describes consent as free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action. In practice that rules out:
- pre-ticked boxes
- bundling several purposes into one tick
- making an unrelated service depend on agreeing to extra data use
- burying the request in long terms and conditions
Consent should also be limited to the personal data needed for the stated purpose.
What the notice should include
Section 5 and Rule 3 describe the notice. As we read them, it should be clear, in plain language and presented separately from other information. It should cover:
- An itemised list of the personal data you will process.
- The specific purpose, and the goods, services or uses it enables.
- A way to withdraw consent that is as easy as giving it.
- How the person can exercise their rights.
- How to make a complaint to the Data Protection Board.
The Act also expects you to offer the notice in English or in any language listed in the Eighth Schedule to the Constitution, which includes Telugu, Hindi and Urdu.
When consent is not the route
Section 7 lists “legitimate uses” where processing can take place without consent. One example is where a person voluntarily provides data for a specified purpose and does not indicate that they object to its use. Others include legal obligations, medical emergencies and employment-related purposes. Whether a particular use qualifies depends on the facts and on the exact wording of section 7, so take advice for borderline cases.
Where to show a notice
| Moment | Typical data | Notice location |
|---|---|---|
| Website enquiry form | Name, phone, email | Short notice beside the submit button, linking to the full policy |
| Appointment booking | Name, phone, reason for visit | On the booking page and any confirmation message |
| Admission or enrolment form | Student and guardian details | At the top of the form and on the receipt |
| WhatsApp or SMS opt-in | Mobile number, message preferences | At the point of opt-in, with a simple way to opt out |
A simple notice outline
Use this structure and adapt it to your real practices:
- What we collect: list each item
- Why we collect it: one clear purpose per item
- Who sees it: your team and named vendors
- How long we keep it: a period or the rule you use
- Your choices: how to withdraw consent, access, correct or erase, and who to contact
- Complaints: our contact first, then the Data Protection Board
Frequently asked questions
Do I need to re-ask existing customers for consent?
The Act expects a notice to be given as soon as reasonably practicable to people whose data you already hold on the basis of earlier consent. Check section 5(2) and take advice on how it applies to your records.
Can a tick box be enough?
A clear, unticked box with a specific purpose can be a clear affirmative action. Pre-ticked boxes or silence generally are not.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.