Consent, the DPDP way
Five adjectives set the bar. Consent must be free, specific, informed, unconditional and unambiguous. Withdrawal must be as easy as giving. Miss any and the whole processing chain unwinds.
01What Section 6 says
Section 6(1) sets the consent standard. Section 6(2) sets the purpose limitation. Section 6(3) preserves the Data Principal's right to consent through a Consent Manager. Section 6(4) sets the withdrawal right.
Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must signify agreement to processing for a specified purpose. It is limited to only the personal data necessary for that purpose. And the Data Principal may withdraw at any time with ease comparable to how consent was given.
02Unpacking "free, specific, informed, unconditional, unambiguous"
Each word in Section 6(1) is doing real work and is separately litigable. If any one of the five fails, the consent fails and the processing that followed becomes unlawful.
Free. Coercion kills consent. This is where most bundled flows fail. If refusing a marketing cookie stops the checkout, or if agreeing to research use is a condition of opening a savings account, the consent for marketing or research is not free even though the customer clicked. The rule of thumb: the essential service should still work if the person says no to the non-essential ask.
Specific means one consent for one named purpose. You cannot ask for a blanket "we may use your data for improvement, analytics, marketing, product development, partner sharing and future undefined uses" and treat one tick as consent for all six.
Informed is where Rule 3 kicks in. The consent notice must stand on its own. If the person needs to click through to a policy PDF to understand what is being collected and why, the notice failed the informed test. Itemised list of data collected, itemised list of purposes, withdrawal link. That is the minimum.
Unconditional. You cannot tie consent to something structurally unrelated. Making marketing consent a condition of exercising a statutory right (say, filing a grievance) is the textbook fail.
And unambiguous with clear affirmative action is the death of the pre-ticked box, the "continued use of this site means acceptance" banner, and the silence-as-agreement pattern. A tap, a click, a signed form, an audible yes on a recorded call. Something the person actively did.
03The withdrawal right
If it took a tap to consent, one tap must be enough to withdraw.
Section 6(4) sets the equivalent-ease standard. If you offered a single-click consent, you cannot bury the withdrawal three menus deep or require an email exchange. Withdrawal must be as accessible as consent was.
Consequence of withdrawal, per Section 6(6): the Data Fiduciary must cease processing within a reasonable time. Rule 8 will require erasure once the purpose is no longer served. The withdrawal does not affect the lawfulness of processing before withdrawal.
04The Rule 3 notice
Rule 3 sets what the Section 5 notice must contain and how it must read.
The notice must be understandable on its own without pointing at a separate policy. It must use clear and plain language. It must give at minimum an itemised description of the personal data collected and the specific purposes. It must include a specific communication link to the Data Fiduciary's website or app for the Data Principal to withdraw consent, exercise their other rights, and file complaints with the Board.
The notice must be provided in English by default and, on the Data Principal's request, in any of the 22 languages listed in the Eighth Schedule to the Constitution.
05The Consent Manager route
A Consent Manager is a Data Protection Board-registered platform that intermediates consent between the Data Principal and multiple Data Fiduciaries.
Under Section 6(3), the Data Principal has the right to give, manage, review and withdraw consent through a Consent Manager. Rule 4 sets the eligibility, registration, and conduct standards for Consent Managers. Rule 4 takes effect on 14 November 2026, one year after notification, so that the Board has time to be seated and process the first tranche of registrations.
Consent Managers are accountable to the Data Principal, not to the Data Fiduciary. The obligation is fiduciary in nature. Non-compliance falls under the Rs. 200 crore breach cap in the Schedule.
06The consent patterns already tripping up Indian sites
-
Pre-ticked marketing checkboxes on signup
Not unambiguous. Not clear affirmative action. Invalid under Sec. 6.
-
Cookie banners with "accept all" and a nested "manage"
Not free. The equivalent-ease standard requires a single-click reject at the same level.
-
Consent bundled across purposes
Not specific. One consent per purpose. Marketing consent cannot be bundled with service consent.
-
Notice that points at the privacy policy
Rule 3 requires the notice to stand on its own. Cross-references to a separate policy do not satisfy it.
-
Withdrawal via email only
If consent took one tap, withdrawal must take one tap. Email-only withdrawal fails the equivalent-ease test.