Valid consent under the DPDP Act: the six tests your forms must pass

Most Indian websites ask for consent with a single pre-ticked box that bundles terms of service, privacy and marketing together. Under the DPDP Act, that won’t work.

Section 6(1) says consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the data necessary for the purpose. Let’s turn those words into tests.

1. Free

The person must have a real choice. Consent obtained by pressure, or where refusing carries an unfair penalty, isn’t free. Employee consent is a classic problem, because of the power imbalance; that’s one reason the Act gives employers a separate legitimate-use ground in section 7.

Test: could someone say no without losing something unrelated?

2. Specific

Consent must be tied to a specified purpose. “To improve our services” is too vague. “To send you delivery updates by SMS” is specific.

Test: is there a separate purpose statement, and a separate choice, for each distinct use?

3. Informed

The person must have the notice first: what data, what purpose, how to withdraw, how to complain (section 5 and Rule 3).

Test: is the notice shown at or before the moment of consent, in plain language, and available in English or an Eighth Schedule language?

4. Unconditional

You can’t make a service conditional on consent to unrelated processing. A food delivery app can require an address to deliver food; it can’t require consent to share data with an advertising partner as the price of ordering.

Test: remove the optional purposes. Does the service still work?

5. Unambiguous, with a clear affirmative action

Silence, inactivity and pre-ticked boxes are not consent. The person must do something: tick an empty box, press “I agree”, reply “YES”.

Test: are all consent boxes unticked by default?

6. Limited to necessary data

Section 6(1) adds that consent is valid only for data necessary for the specified purpose. Its illustration describes a telemedicine app that asks for consent to access the user’s phone contacts. That consent is invalid for the contacts, because contacts aren’t needed for a consultation.

Test: for every field you collect, can you name the purpose that needs it?

What else section 6 says

• Any part of a consent that breaches the law is invalid, for example a clause waiving the right to complain.
• People can withdraw consent at any time, as easily as they gave it (section 6(4)).
• If a dispute arises, the Data Fiduciary must prove that notice was given and consent obtained (section 6(10)). Keep records.

A quick redesign

Replace one bundled box with three:

1. ☐ I agree to the terms of service (required to use the service)
2. ☐ I have read the privacy notice (with a link)
3. ☐ Send me offers by WhatsApp (optional, unticked)

Go deeper

Our courses include consent-flow reviews with real examples. Browse the courses.

This article is for education and is not legal advice.