Section 6: Consent
Simple Explanation
Section 6 sets the gold standard for valid consent under the DPDP Act:
• Consent must be freely given, specific, informed, and unambiguous.
• It requires a clear affirmative action: pre-ticked boxes or silence do not count.
• Only data necessary for the stated purpose can be collected.
• Any consent that waives rights under the Act is invalid.
• Consent requests must be in simple, clear language.
• Data Principals can withdraw consent anytime, and it must be as easy as giving it.
• Once withdrawn, data processing must stop (unless required by another law).
• Consent Managers can help individuals manage consent.
• If there's a dispute, the Data FIDUCIARY must prove they obtained valid consent.
Key Points
- ✓Consent must be free, specific, informed, and unambiguous
- ✓Requires clear affirmative action
- ✓Limited to data necessary for the specified purpose
- ✓Data Principals can withdraw consent anytime
- ✓Withdrawal must be as easy as giving consent
- ✓Data Fiduciary bears the burden of proving consent
- ✓Consent Managers help manage consent
Official Text (Summary)
Consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. It must be limited to data necessary for the specified purpose. Any part of consent that violates the Act is invalid. Requests must be in clear, plain language with contact details of the Data Protection Officer. Data Principals have the right to withdraw consent at any time with comparable ease. The Data Fiduciary bears the burden of proving that valid consent was obtained.
Source: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Law and Justice.
Jump to any Section
More Sections in Chapter II
All Chapters
Is your business DPDP compliant?
Avoid penalties up to ₹250 Crore. Let our experts help you implement consent management, grievance redressal, and data protection measures.
Get a Free Compliance Audit