Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action such as ticking an unticked box, and limited to the data needed for the stated purpose. It must be preceded by a standalone notice (Rule 3) listing the data, the purpose, and how to withdraw consent, exercise rights and complain to the Data Protection Board. Withdrawing must be as easy as consenting.
- Consent
- Section 6
- Notice contents
- Section 5, Rule 3
- Pre-ticked boxes
- Not valid
- Consent managers
- Rule 4, from 13 Nov 2026
What makes consent valid
- Free: not forced as a condition for something that does not need the data.
- Specific: for a stated purpose, not 'any purpose we choose'.
- Informed: given after a clear notice.
- Unconditional and unambiguous: a clear affirmative action, never silence, inactivity or a pre-ticked box.
- Limited: only the data necessary for that purpose. Any part of a consent that goes beyond this, or that waives rights under law, is invalid to that extent.
What the notice must say (Rule 3)
- It must be understandable on its own, not buried in terms of service.
- An itemised description of the personal data collected.
- The specific purpose, and the goods, services or uses it enables.
- A link or means to withdraw consent, exercise rights, and complain to the Data Protection Board.
- Available in English or any language in the Eighth Schedule of the Constitution, on request.
Sample opt-in wording
☐ I agree that [Business] may use my name, mobile number and email to contact me about my enquiry. [Read the notice] · You can withdraw consent at any time at [link].
Keep a separate unticked box for marketing, for example: '☐ Send me offers and updates by email and WhatsApp.'
When you do not need consent: legitimate uses
Section 7 lists situations where data can be processed without consent, including:
- data the person voluntarily gave for a specific purpose and did not object to its use for that purpose (for example, giving a phone number to receive a delivery update);
- employment purposes, such as payroll, attendance and preventing corporate espionage;
- complying with a law, a court order or a judgment;
- medical emergencies, epidemics and disasters; and
- certain functions of the State.
Even under a legitimate use, security, breach reporting, retention and grievance duties still apply.
Consent managers
A consent manager is a Board-registered platform that lets individuals give, manage, review and withdraw consent across businesses. It must be a company incorporated in India with a net worth of at least ₹2 crore. The registration rules (Rule 4) apply from 13 November 2026. Using one is optional for businesses.
Frequently asked questions
Is a pre-ticked checkbox valid consent under DPDP?
No. Consent must be a clear affirmative action. Silence, inactivity and pre-ticked boxes do not count.
Can I refuse service if a customer does not consent to marketing?
No. Consent for a purpose that is not needed for the service cannot be made a condition of providing it. Keep marketing as a separate optional opt-in.
What happens to data already collected before the DPDP Act?
Where processing was based on consent given before the Act, Section 5(2) requires the business to give a notice 'as soon as reasonably practicable' with the same information, and the person can withdraw consent.
What happens when someone withdraws consent?
The business (and its processors) must stop processing for that purpose within a reasonable time and erase the data, unless a law requires it to be kept. Processing before withdrawal remains lawful.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.