Section 6(10): The Reversed Burden of Proof on Data Fiduciaries

Statutory Text (Official Gazette)

Section 6(10): Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder.

What Section 6(10) Means in Plain English

In standard legal disputes, the accuser has to prove that a wrongdoing occurred. Section 6(10) completely flips this principle for data privacy in India.

If a user, regulator, or competitor files a complaint claiming your website tracked them unlawfully:

1. The user does not need to show technical proof.
2. The Data Protection Board demands that YOU prove that lawful notice was shown and valid affirmative consent was granted.
3. If your systems cannot produce verifiable, timestamped proof of that specific consent interaction, your business is legally presumed to have violated the Act.

Why Standard Cookie Banners Fail Section 6(10)

Most cheap cookie banners only store a basic local cookie in the user’s browser (e.g. cookie_consent=true).

This is legally useless in a dispute because:

• If the user clears their cookies or uses incognito mode, the record disappears.
• A local browser cookie does not prove what version of your privacy policy the user saw.
• A local browser cookie does not prove which specific language the user selected.
• A local browser cookie can easily be modified by any developer in Chrome DevTools, making it inadmissible as tamper-evident proof before the Board.

What Is Legally Required: A Tamper-Evident Consent Ledger

To satisfy Section 6(10) before the Data Protection Board of India, every consent event must generate a server-side cryptographic record containing:

1. Unique Consent Token: A cryptographically random identifier linked to the session.
2. Exact Notice Version: Hash of the precise notice text shown to the visitor.
3. Selected Language: The specific Eighth Schedule language chosen by the visitor.
4. Timestamp & Categories: Exact UTC timestamp paired with granular purposes accepted (e.g., Necessary = True, Analytics = False, Marketing = True).
5. Merkle Tree Proof: Sealed into an append-only cryptographic ledger so no internal developer or external actor can alter or backdate records.

How ConsentPlix Solves Section 6(10)

ConsentPlix generates a verifiable, tamper-evident audit receipt for every consent grant and withdrawal. In the event of a regulatory inquiry, you can export certified cryptographic audit trails in one click, providing indisputable legal proof under Section 6(10).

← Back to Full Section 6: Consent Guide