How to Record and Maintain Consent Under the DPDP Act

Under the DPDP Act 2023, consent is only as good as your ability to prove it. A ticked checkbox is no longer enough; organisations need a complete, auditable consent lifecycle that shows who agreed to what, when, and under which notice.

Where the law stands

The Act was passed in August 2023. The DPDP Rules, 2025 were notified on 13 November 2025, which also set up the Data Protection Board of India. Consent Manager registration is expected to open on 13 November 2026, and the remaining provisions, including the core consent, notice and security duties, are due to apply from 13 May 2027.

That gives businesses a limited window. The sensible move is to build consent infrastructure now instead of waiting for the final deadline.

What makes consent valid

Section 6 sets out six conditions, and all of them must be met. Consent has to be:

• Free, with no coercion or manipulation
• Specific, tied to a clearly stated purpose
• Informed, given after a clear notice
• Unconditional, not bundled with unrelated services
• Unambiguous, with no pre-ticked boxes or implied consent
• Affirmative, given through an active step

Any part of a request that breaks these rules is void to that extent, even if the rest is fine. The section is aimed at dark patterns such as pre-checked boxes, lopsided accept and reject buttons, and bundled consent.

Notice comes first

Every consent request must be accompanied or preceded by a notice (Section 5 and Rule 3). It should list each personal data item and its purpose, explain how to withdraw consent and use rights such as access, correction and erasure, say how to complain to the Board, and give contact details for the Data Protection Officer or authorised representative. Notices must be available in English or any of the 22 languages in the Eighth Schedule, and data already being processed needs a retrospective notice.

What proof looks like

Section 6(10) puts the burden of proof on the Data Fiduciary. For each consent, record:

• Who: a stable identifier for the individual
• What: the exact purpose and data items
• When: a timestamp
• How: the form, button or screen flow used
• Which notice: the version that was shown
• Evidence: a log entry of the action, not just a yes/no flag

Store this as an event log of every grant, update and withdrawal, each linked to a notice version and purpose, rather than a single field that gets overwritten.

Consent is a loop, not an event

Consent has to be maintained after it is collected. A workable cycle looks like this:

1. Show a notice with itemised data and purposes.
2. Let the person accept, partly accept or reject.
3. Record the choice against the notice version and purpose, with a timestamp and proof of the action.
4. Process only the consented data for the consented purpose.
5. Update the record, and processing, whenever the purpose, the notice or the person's choice changes.
6. Log every step so the history can be rebuilt on request.

A gap at any step can leave processing without a provable lawful basis.

Withdrawal must be as easy as consent

Section 6(4) requires withdrawal to be comparable in ease to giving consent. Support tickets, long forms or an unmonitored compliance inbox do not meet that bar. Offer a visible self-service control wherever consent was captured, pass the withdrawal automatically to your CRM, marketing tools and processors, and stop processing within a reasonable time.

Two carve-outs apply. Past lawful processing does not become unlawful (Section 6(5)), and data may be kept for a separate legal purpose such as tax or KYC records, but only for that purpose (Sections 6(6) and 8(7)). If withdrawal makes a service impossible, you may stop it, but tell the person the consequence first.

Children and Consent Managers

Children under 18, and persons with disabilities who have a lawful guardian, need verifiable guardian consent. Processing likely to harm children, behavioural monitoring and targeted advertising aimed at them are prohibited. If minors may use your product, build age-gating and parental-consent flows well before 2027.

Consent Managers are registered intermediaries that let people give, review and withdraw consent across organisations from one place, similar to the RBI's Account Aggregator model. They must register with the Board and meet First Schedule conditions, including minimum net worth. Your systems should be able to honour signals from them.

The takeaway

Treat consent as a data architecture problem, not a line of legal text on a signup form. Itemised multilingual notices, versioned records, near one-step withdrawal that reaches every processor, purpose limits enforced in code, and an audit trail you can export within hours are the practical building blocks.