Section 6 of the DPDP Act 2023 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action — and withdrawal must be as easy as giving it. EasyDP captures exactly that kind of consent on every channel an Indian business actually uses, and records every grant and withdrawal.
DPDP Act 2023, Section 6 · DPDP Rules 2025, Rule 3 (notice) · Updated July 2026
| No. | Obligation | What the Act says | Citation |
|---|---|---|---|
| 01 | Consent must meet five tests | Free, specific, informed, unconditional, unambiguous — signalled by a clear affirmative action. A pre-ticked box or "they gave me their number" fails all five. | Act · S.6(1) |
| 02 | A notice must accompany the request | The consent request must come with a standalone, plain-language notice: an itemised description of the data, the specified purpose, and links to withdraw, exercise rights, and complain to the Board. | Rules · R.3 |
| 03 | Withdrawal must be as easy as consent | If a customer consented in one tap, they must be able to withdraw in one tap — and processing based on that consent must stop. | Act · S.6(4)–(6) |
| 04 | You carry the burden of proof | In any proceeding, it is the Data Fiduciary who must prove that a valid notice was given and valid consent existed. No record, no defence. | Act · S.6 |
Consent checkboxes at web checkout, a standard consent flow for WhatsApp commerce, and QR codes for the shop counter — because Indian businesses collect data in DMs and at the till, not only in forms.
The notice and consent screen render in the customer’s language — Hindi, Tamil, Telugu, Kannada, Malayalam or English — which is what makes the consent genuinely "informed".
Customers withdraw from the same portal they consented on; EasyDP timestamps the withdrawal and tells your connected systems to stop processing.
Who consented, to what purpose, in which language, against which notice version, at what time — stored in the audit log so the burden of proof is already discharged.
No. A cookie banner covers one moment of collection on one channel — your website. The DPDP Act also requires a compliant notice with itemised data and purposes (Rule 3), consent records you can produce as proof (Section 6), withdrawal that is as easy as consent, and coverage of data collected over WhatsApp, phone and paper forms that get digitised. A banner does none of that.