What makes consent valid under the DPDP Act?
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. It must be requested with a notice the Data Principal can read in English or any language listed in the Eighth Schedule to the Constitution, and it must be as easy to withdraw as it was to give.
Pre-ticked boxes, bundled consent and making a service conditional on unrelated processing all fail this test.
Withdrawal has to be real. If a person withdraws and processing continues downstream, the consent was never genuinely withdrawable, whatever the interface showed.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Jupinder Bedi — Jupinder writes on data protection practice at ProtectComply, with a focus on how obligations translate into system behaviour.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →