Explainer · Data Protection · Last verified October 2026
Consent Requirements Under the DPDP Act (2026)
Consent is the heart of the Digital Personal Data Protection Act, 2023 (DPDP Act). For most processing of personal data in India, a business needs the person's consent, and the Act is precise about what counts. A pre-ticked box, a buried clause or a take-it-or-leave-it bundle will not do. This explainer sets out the notice that must come before consent, the exact standard consent has to meet, the right to withdraw it, the role of a consent manager, and the limited situations where consent is not required. It is written in plain English for Indian businesses and is general information, not legal advice. Last verified October 2026.
- Notice first: Section 5 requires a clear notice of what data, what purpose, and how to exercise rights, before or with the consent request.
- Then valid consent: Section 6 requires it to be free, specific, informed, unconditional and unambiguous, by a clear affirmative action, limited to the data needed.
- Easy to withdraw: withdrawing consent must be as easy as giving it, and processing must then stop within a reasonable time.
- Children: processing a child's data needs verifiable parental or guardian consent, with no behavioural tracking or targeted ads at children.
- Not always needed: Section 7 allows certain legitimate uses without separate consent, each with conditions the business must be able to prove.
01The short answer
Under the DPDP Act, before you process someone's personal data on the basis of consent, you must do two things in order. First, give a clear notice (Section 5) telling the person what data you want, why, and how to exercise their rights. Second, obtain consent (Section 6) that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data actually needed for that purpose.
Consent is not the only lawful basis. Section 7 sets out certain legitimate uses where processing is allowed without separate consent. But for ordinary commercial processing, consent built on a proper notice is the default, and the standard is strict.
02Step 1: the notice that comes first
Consent given in the dark is not valid consent, which is why the Act puts notice first. Under Section 5, the request for consent must be accompanied by, or preceded by, a notice that tells the person in clear and plain language:
- What personal data you intend to collect.
- The purpose for which it will be processed.
- How the person can exercise their rights, including withdrawing consent and making a complaint to the Data Protection Board.
The notice must be available in English and in the languages listed in the Eighth Schedule to the Constitution, at the person's option. Where a person gave consent before the Act, the Data Fiduciary is expected to provide this notice as soon as reasonably practicable. The notice is not a formality; it is what makes the consent that follows informed.
03Step 2: the standard consent must meet
Section 6 sets the bar, and every word carries weight. Valid consent must be:
| Requirement | What it means in practice |
|---|---|
| Free | Not coerced, and not the price of a service that does not need the data. |
| Specific | Tied to the stated purpose, not an open-ended licence. |
| Informed | Given after the Section 5 notice, so the person knows what they are agreeing to. |
| Unconditional | Not bundled so that accepting unrelated processing is forced. |
| Unambiguous, by clear affirmative action | An active choice, such as ticking an unticked box, not silence or a pre-ticked default. |
Consent is also limited to the data necessary for the specified purpose. If a request seeks consent for more than is needed, or for a purpose the person did not agree to, that part is not valid. In short, the Act rewards narrow, purpose-linked consent and penalises broad, bundled consent.
Valid consent under the DPDP Act is a narrow, active, informed yes to a specific purpose, not a broad tick-box buried in terms.
04The right to withdraw
Consent is not permanent. A data principal can withdraw it at any time, and the Act requires that withdrawing be as easy as giving consent was. You cannot make people jump through hoops to opt out of what they opted into with one click.
When consent is withdrawn, you must stop processing the personal data within a reasonable time, unless another lawful basis applies, and the same duty flows down to any data processor acting on your behalf. Withdrawal does not undo processing that was lawful while the consent stood, but it ends the basis for processing going forward. Building an easy, visible withdrawal path is therefore part of compliance, not an afterthought.
05Consent managers
The Act introduces a consent manager: a registered entity, accountable to the Data Protection Board, through which a person can give, manage, review and withdraw consent across different services from a single point. The idea is to make consent manageable for individuals who otherwise face dozens of separate requests.
Consent managers must be registered with the Board, and the DPDP Rules, 2025 (notified on 13 November 2025) set out the registration and obligations, with the consent manager provisions commenced on their own timeline. For a business, a consent manager can become a channel through which consent is obtained and tracked, but the underlying Section 6 standard still governs what valid consent looks like.
06Children and persons with a guardian
The Act gives extra protection to children, defined as persons under 18. For a child's personal data, the Data Fiduciary must obtain verifiable consent of a parent or lawful guardian. The Act also bars processing that is likely to cause a detrimental effect on a child's well-being, and bars tracking, behavioural monitoring and targeted advertising directed at children.
Similar protection applies to persons with a disability who have a lawful guardian: their consent is given through the guardian. Any business whose services may reach children needs an age and guardian-consent mechanism, because the ordinary adult-consent flow is not enough.
07When consent is not required
Consent is the default, but not the only basis. Section 7 lists certain legitimate uses where personal data may be processed without separate consent, including:
- Where the person has voluntarily provided their data for a purpose and has not objected to its use for that purpose.
- For the State to provide a benefit, service, licence or subsidy in defined circumstances.
- To comply with a legal obligation or a court order.
- For a medical emergency or threat to life, and for specified disaster and employment-related purposes.
These are narrower than they sound, and each has conditions. Relying on a legitimate use rather than consent is a decision to document carefully, because the burden is on the Data Fiduciary to show that it applies. For what to do when data is nonetheless exposed, see data breach obligations under the DPDP Act.
08Where Claw fits
Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.
Designing a consent flow is a product and compliance task, and Claw does not build that for you. Where Claw helps is when a consent or data dispute becomes a legal matter. If a complaint reaches the Data Protection Board, a penalty order is passed, or an appeal goes to the TDSAT or the courts, Claw tracks the resulting proceedings and related matters across 9,102 courts, tribunals and forums, with alerts and monitoring so nothing is missed. Its Legal GPT researches across 30 crore+ judgments and orders, with Supreme Court decisions from 1950 and High Court decisions from 1990, so you can see how courts have approached consent, privacy and data questions. Results return in under 5 seconds, and Claw does not train its AI models on your documents. To check whether a data vendor or partner already has litigation on record, run a case search across Indian courts by party name. The DPDP Rules, 2025 are being brought into force in stages, so confirm the current position for your facts; none of this is legal advice.
09Sources and further reading
- Ministry of Electronics and Information Technology (DPDP Act and Rules): meity.gov.in
- India Code (Digital Personal Data Protection Act, 2023): indiacode.nic.in
- DPDP Act reference (text of the Act): dpdpa.com
- Claw: clawlaw.in
This explainer is general information, not legal advice. The DPDP Rules, 2025 are being commenced in phases; confirm the current obligations against the official text before you act.
10Frequently asked questions
What makes consent valid under the DPDP Act?
Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data needed for the stated purpose. It must follow the Section 5 notice. A pre-ticked box, silence, a buried clause, or consent bundled with unrelated processing does not meet the standard.
Does a notice have to be given before taking consent?
Yes. Section 5 requires the consent request to be accompanied or preceded by a notice, in clear and plain language, stating what personal data will be collected, the purpose, and how the person can exercise their rights, including withdrawing consent and complaining to the Data Protection Board. The notice must be available in English and the languages in the Eighth Schedule at the person's option.
Can a person withdraw consent, and what happens then?
Yes. A data principal can withdraw consent at any time, and withdrawing must be as easy as giving it was. After withdrawal, the business must stop processing the personal data within a reasonable time unless another lawful basis applies, and the same duty flows down to any processor. Withdrawal does not undo processing that was lawful while the consent stood.
When can personal data be processed without consent?
Section 7 lists certain legitimate uses, including data the person voluntarily provided for a purpose, specified State functions, compliance with a legal obligation or court order, and medical emergencies. Each has conditions, and the burden is on the Data Fiduciary to show the use applies, so reliance on a legitimate use should be documented carefully.
What are the rules for children's data?
A child is a person under 18. Processing a child's personal data requires the verifiable consent of a parent or lawful guardian. The Act also prohibits processing likely to have a detrimental effect on a child's well-being, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. Similar protection applies to persons with a disability who have a lawful guardian.