DPDP reference
Section 6: Consent
Last checked 6 Nov 2026
Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the personal data necessary for the specified purpose (s.6(1)). Any part of a consent that infringes the Act is invalid to that extent (s.6(2)).
A request for consent uses clear and plain language, offers English or an Eighth Schedule language, and gives the contact details of a Data Protection Officer or another authorised person (s.6(3)). Withdrawing must be comparable in ease to giving (s.6(4)). After withdrawal the Data Fiduciary stops processing within a reasonable time and causes its Data Processors to stop, unless the law requires or authorises the processing (s.6(6)).
A Data Principal may act through a registered Consent Manager (s.6(7) to s.6(9)). In a proceeding, the Data Fiduciary must prove that notice was given and consent was obtained under the Act (s.6(10)).
- Applies to
- Every Data Fiduciary that relies on consent. s.6(8) and s.6(9) apply to Consent Managers.
- Starts
- s.6(9): 13 Nov 2026 (G.S.R. 843(E), item (b)). The rest of s.6: 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- Up to ₹50 crore (s.33, Schedule item 7).
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 6; G.S.R. 843(E), commencement
Questions
Who must prove consent under the DPDP Act?
The Data Fiduciary. In a proceeding it must prove that notice was given and that consent was given under the Act and Rules (s.6(10)).
How easy must withdrawal of consent be?
Comparable to the ease with which consent was given (s.6(4)).
Related
- Section 5: Notice
- Section 4: Grounds for processing personal data
- Rule 4: Registration and obligations of Consent Manager
Next
Not legal advice.