What makes consent valid under the DPDP Act — and what silently breaks it
Valid consent under the DPDP Act is free, specific, informed, unconditional and unambiguous — given by a clear affirmative action, after a plain-language notice, for a defined purpose, covering only the data that purpose needs. Withdrawing it must be as easy as giving it. Pre-ticked boxes, bundled "agree to everything" consents and terms-and-conditions burials all fail — and if challenged, you must prove what the person agreed to and when.
Most Indian businesses believe they already collect consent. Most of them collect something else: a signup, a checkbox someone had to tick to proceed, a line in the terms nobody read. Under the DPDP Act those aren't consent — they're evidence of the opposite. Here's the actual standard, test by test.
The five tests
Free
The person must have a real choice. If refusing consent for marketing means they can't buy your product at all, the consent wasn't free — it was a toll. Consent for anything beyond what the service strictly needs must be refusable without penalty.
Specific
Consent attaches to a purpose, not to your company. "We may use your data to improve our services" is not a purpose; "we'll use your email to send order updates" is. One consent per purpose — a person can say yes to delivery updates and no to promotions.
Informed
Before consenting, the person must receive a notice that says, in plain language: what personal data you're collecting, for what purpose, how they can exercise their rights and raise a grievance, and how to complain to the Data Protection Board. If your notice needs a lawyer to parse, it fails its own job.
Unconditional & unambiguous
No strings, no guesswork. Consent can't be a condition for something unrelated, and it must be expressed through a clear affirmative action — a tap, a tick, a signature. Silence, inactivity and pre-ticked boxes are not affirmative anything.
Limited to what's necessary
Even with consent, you may only collect the data the stated purpose actually requires. A feedback form doesn't need date of birth. Every extra field is extra liability — and extra mess to clean later.
Withdrawal: the test most businesses fail
Section 6(4) is one sentence with sharp edges: withdrawing consent must be as easy as giving it. If consent was one tap at signup, withdrawal cannot be an email to support, a phone call, and a five-day wait. And withdrawal must actually work — propagating to your CRM, your email tool and your vendors, not just flipping a flag in one system.
When you don't need consent
The Act recognises legitimate uses where separate consent isn't required: data a person voluntarily gives you for a specific purpose (a support request, for that support request), employment-related processing, medical emergencies, and legal obligations. Two cautions: the purpose boundary is strict — a support email address doesn't become a marketing list — and legitimate use doesn't waive your other duties (security, retention, breach reporting).
Prove it or lose it
The quiet requirement underneath all of this: records. When a customer or the Board asks "show me the consent," you need the notice version they saw, the choice they made, and the timestamp — per person, per purpose. A consent you can't prove is a consent you don't have. This is exactly why we built Ronin Consent around an append-only consent log rather than a simple yes/no flag.
Your consent-flow checklist
- Write the notice in plain language — what, why, rights, grievance contact, Board complaint route.
- Split consents by purpose — no bundling essential service with marketing.
- Require an affirmative action — no pre-ticked boxes, no consent-by-scrolling.
- Collect only what the purpose needs — delete the "nice to have" fields.
- Make withdrawal one step — and wire it to every downstream system.
- Log everything — notice version, choice, timestamp, per person.
Is your consent flow actually compliant?
Take the free 2-minute DPDP Readiness Scorecard, or see how Ronin Consent handles collection, withdrawal and the audit log with one script tag.
Keep reading
- DPDP Rules 2025 explained: the deadlines and what to do now
- Cookie consent under the DPDP Act
- The full DPDP compliance checklist
The DPDP Act gives individuals rights too. Saaph.in — a Ronin Works product — finds where your personal data is exposed across the open web and gets it removed under the Act, then keeps watch.
Scan your exposure at Saaph.in →Want your consent flow reviewed?
Send us a note — we reply within one working day.
This article is general information, not legal advice. It summarises the DPDP Act, 2023 and the DPDP Rules as notified in November 2025; for the authoritative text consult the Gazette notifications or a qualified professional, or talk to Ronin Works.