What Makes Consent Valid Under the DPDP Act

The five requirements

Section 6(1) says consent shall be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must signify agreement to processing for the specified purpose, and be limited to such personal data as is necessary for that purpose.

Consent cannot waive your rights

Section 6(2) makes any part of a consent that infringes the Act invalid to that extent. The illustration is an insurer asking a customer to consent to processing and to waive her right to complain to the Board. The waiver is invalid; the rest survives.

Terms that bundle a rights waiver into acceptance are therefore not merely unenforceable, they mark the drafting as non-compliant.

Language is not optional

Section 6(3) requires every request for consent to be presented in clear and plain language, with the option to access it in English or any language specified in the Eighth Schedule to the Constitution. For consumer products in India that is a build requirement with real scope.

What invalid consent means in practice

If the consent is invalid, the processing that relied on it has no basis. That is not a documentation problem, it is a processing problem, and it reaches back over everything done on that footing.

“Unconditional” is the word most often skipped. Making access to a service contingent on consent to processing that the service does not require is precisely what it rules out.

Infosek Team

Checks worth running

• Is any consent bundled across purposes that could be separated?
• Is any processing conditioned on consent it does not need?
• Is consent captured by a pre-ticked box or an implied action? A clear affirmative action means neither.
• Do your consent screens offer a language choice?
• Do you store what was consented to, when, and for which purpose, so you can show it later?

Common questions

What is valid consent under the DPDP Act?

Under section 6(1), consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and it must signify agreement to processing for the specified purpose and be limited to the personal data necessary for that purpose.

Can I bundle consent for several purposes together?

No. Section 6(1) requires consent to be specific and limited to the personal data necessary for the specified purpose. The Act's own illustration makes clear that consent extending to data not necessary for the stated service is limited to what was necessary.