Article
Proof of consent: building a consent log that will stand up
12 Nov 2026 · Dpofficer.in team · 2 min read
Under section 6(10), the Data Fiduciary must prove consent. What a good consent record contains, how long to keep it, and common gaps.
Imagine a customer complains to the Data Protection Board: “I never agreed to these WhatsApp offers.” Who has to prove what?
Under section 6(10) of the DPDP Act, the answer is clear: the Data Fiduciary must prove that it gave a notice and that consent was given in line with the Act. If you can’t produce evidence, you lose.
What a consent record should contain
For every consent, store:
| Field | Why |
|---|---|
| Who | A stable user or customer ID (not just an email that can change) |
| What | The purpose(s) agreed to, one per row |
| Which notice | The version or ID of the notice and checkbox text shown |
| When | Date and time, with time zone |
| Where | Channel: web, app, WhatsApp, branch, call centre |
| How | The action: ticked box, button press, “YES” reply, signature |
| Status | Given, refused, or withdrawn (with its own timestamp) |
Refusals and withdrawals matter as much as yes. A log that only records agreement can’t show you stopped when you should have.
Make it tamper-evident
A consent log that anyone can edit is weak evidence. Good options:
- Append-only storage: new rows are added, old rows never changed.
- Database permissions that block updates and deletes.
- Regular exports to separate, protected storage.
Keep the notice text
Store every version of your notice and consent wording, with dates. A record that says “agreed to notice v7” is useless if v7 no longer exists.
How long to keep it
The Act doesn’t fix a period for a fiduciary’s own consent records. Keep them for as long as you rely on the consent, plus a period to defend complaints. Consent Managers must keep their records for seven years under the Rules, which is a useful benchmark. Rule 6 also requires logs of processing to be kept for at least one year.
Common gaps
- No record of the notice version shown to each person.
- Bundled consent recorded as one “agreed: yes”.
- Offline consent on paper never digitised or indexed.
- Agencies collecting consent for you with no copy reaching your systems.
- Withdrawals processed in one tool but not recorded centrally.
Let people see it
A good practice is to show people their own consent history in their account, and include it when they download their data. It builds trust and saves support time.
A quick test
Pick ten random customers who receive marketing. Can you produce, within an hour, the notice they saw, when they agreed, and how? If not, your log needs work.
Go deeper
Our courses include a consent-record design exercise. Browse the courses.
This article is for education and is not legal advice.
Get a new DPDP explainer every day
Follow dpdpcourse.in: