Valid Consent under the Digital Personal Data Protection Act

Under the Digital Personal Data Protection Act, 2023, consent is a lawful basis for processing digital personal data when it reflects the Data Principal's genuine and clearly expressed choice. Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, and must be given through a clear affirmative action for a specified purpose.

Essential conditions

Consent signifies agreement to process personal data only for the stated purpose and only to the extent necessary for that purpose.

• Consent must be free, specific, informed, unconditional and unambiguous.
• It must involve a clear affirmative action; silence or inactivity does not meet this requirement.
• The consent request must use clear and plain language and provide access in English or a language in the Eighth Schedule.
• Any part of consent that infringes the Act, its rules or another law is invalid to that extent.

Notice and informed choice

Under Section 5, a notice must precede or accompany the consent request so that the Data Principal understands the proposed processing.

• The notice must describe the personal data sought and the purpose for which it will be processed.
• It must explain how consent may be withdrawn, how statutory rights may be exercised and how a complaint may be made to the Data Protection Board of India.
• The request must provide the relevant Data Protection Officer's contact details, where applicable, or those of another authorised contact person.

Withdrawal, proof and special cases

Consent remains subject to the Data Principal's continuing control, while the Data Fiduciary carries responsibility for demonstrating compliance.

• Withdrawal must be as easy as giving consent, and it does not affect the lawfulness of processing undertaken before withdrawal.
• After withdrawal, the Data Fiduciary must stop consent-based processing and cause its processors to stop, unless processing is otherwise required or authorised by law.
• In proceedings concerning consent, the Data Fiduciary must prove that notice was given and valid consent was obtained.
• Processing a child's personal data, or that of a person with disability who has a lawful guardian, requires verifiable consent from the parent or lawful guardian.
• Consent is not required where processing falls within the specified legitimate uses under Section 7.