Section 6 of the DPDP Act 2023 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action — and withdrawal must be as easy as giving it. EasyDP captures exactly that kind of consent on every channel an Indian business actually uses, and records every grant and withdrawal.
DPDP Act 2023, Section 6 · DPDP Rules 2025, Rule 3 (notice) · Updated July 2026
| No. | Obligation | What the Act says | Citation |
|---|---|---|---|
| 01 | Consent must meet five tests | Free, specific, informed, unconditional, unambiguous — signalled by a clear affirmative action. A pre-ticked box or "they gave me their number" fails all five. | Act · S.6(1) |
| 02 | A notice must accompany the request | The consent request must come with a standalone, plain-language notice: an itemised description of the data, the specified purpose, and links to withdraw, exercise rights, and complain to the Board. | Rules · R.3 |
| 03 | Withdrawal must be as easy as consent | If a customer consented in one tap, they must be able to withdraw in one tap — and processing based on that consent must stop. | Act · S.6(4)–(6) |
| 04 | You carry the burden of proof | In any proceeding, it is the Data Fiduciary who must prove that a valid notice was given and valid consent existed. No record, no defence. | Act · S.6 |
Consent checkboxes at web checkout, a standard consent flow for WhatsApp commerce, and QR codes for the shop counter — because Indian businesses collect data in DMs and at the till, not only in forms.
The notice and consent screen render in the customer’s language — Hindi, Tamil, Telugu, Kannada, Malayalam or English — which is what makes the consent genuinely "informed".
Customers withdraw from the same portal they consented on; EasyDP timestamps the withdrawal and tells your connected systems to stop processing.
Who consented, to what purpose, in which language, against which notice version, at what time — stored in the audit log so the burden of proof is already discharged.
No. A cookie banner covers one moment of collection on one channel — your website. The DPDP Act also requires a compliant notice with itemised data and purposes (Rule 3), consent records you can produce as proof (Section 6), withdrawal that is as easy as consent, and coverage of data collected over WhatsApp, phone and paper forms that get digitised. A banner does none of that.
The Act does not set an expiry date — consent remains valid until the customer withdraws it or the specified purpose is served. But consent is purpose-specific: using data for a new purpose requires fresh consent, and once the purpose no longer exists the data must be erased (Section 8(7)).
You need to send those customers a DPDP-compliant notice as soon as reasonably practicable (Section 5(2)). Their earlier consent continues to be valid until withdrawn — so it is a notice obligation, not a fresh consent drive.
A Consent Manager is a Board-registered platform (Rule 4, in force from November 2026) through which individuals can give, manage and withdraw consent across Data Fiduciaries. Businesses will need to interoperate with registered Consent Managers; EasyDP tracks the registration framework as it rolls out.