Section 6: Consent

Statutory Text (Official Gazette)

(1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.

Illustration.—X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services.

(2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.

Illustration.—X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. She gives to Y her consent for (i) the processing of her personal data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the Data Protection Board of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid.

(3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal for the purpose of exercise of her rights under the provisions of this Act.

(4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.

(5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal.

Illustration.—X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processing of her personal data by Y for the purpose of fulfilling her supply order and places an order for supply of a good while making payment for the same. If X withdraws her consent, Y may stop enabling X to use the app or website for placing orders, but may not stop the processing for supply of the goods already ordered and paid for by X.

(6) If a Data Principal withdraws her consent to the processing of personal data under sub-section (5), the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India.

(7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.

(8) The Consent Manager shall be accountable to the Data Principal and shall act on her behalf in such manner and subject to such obligations as may be prescribed.

(9) Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.

(10) Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder.

Detailed Clause-by-Clause Breakdown

Section 6 is the heart of the DPDP Act. Below is an exhaustive, plain-English breakdown of all 10 sub-sections and what they require in software and business operations.

Sub-Section (1): The Five Pillars of Valid Consent & Purpose Limitation

“The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action…”

This clause defines what legally qualifies as consent in India:

1. Free: The user cannot be tricked or coerced into agreeing. If declining consent results in an unfair penalty (such as blocking access to a service that doesn’t actually need that data), consent is not free.
2. Specific: You cannot ask for blanket permission to collect “general data for business operations”. Consent must be tied to a distinct, stated task (e.g., “processing your delivery address” or “collecting analytics to track checkout completion”).
3. Informed: The user must know who is collecting their data, what exact attributes are collected, and how to reach the company’s privacy officer before they agree.
4. Unconditional: You cannot make consent for optional marketing trackers a prerequisite for using the website or completing an order.
5. Unambiguous with a Clear Affirmative Action:
   • Illegal: Continuing to scroll, clicking anywhere on the page, or assuming silent consent.
   • Illegal: Pre-ticked checkboxes where the box is already checked when the user opens the page.
   • Legal: The user explicitly taps or clicks a button that says “Accept All”, “Accept Necessary Only”, or “Save My Preferences”.
6. Data Minimization (Purpose Limitation): You can only collect the data points strictly required for that specific purpose. If you run a flashlight app or a calculator, you cannot request access to the user’s contacts or location under this sub-section.

Sub-Section (2): Invalidation of Overreaching Consent Clauses

“Any part of consent… which constitutes an infringement of the provisions of this Act… shall be invalid to the extent of such infringement.”

• Plain English Meaning: Even if a customer signs a contract or clicks “I Agree” on a form that says “The company is not responsible for data breaches and may share your data with any party without notice”, that clause is automatically void under Indian law.
• Practical Impact: Businesses cannot use aggressive contracts to waive user rights. If any term violates the DPDP Act, courts and the Data Protection Board will strike down that clause while holding your company liable for the violation.

Sub-Section (3): Plain Language, 22 Languages and a Contact Person

“Every request for consent… shall be presented… in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised…”

• Plain English Meaning: The user must have the option to read the consent request in English or any of the 22 scheduled languages, and the request must name a DPO or other contact person. The Act does not require every request to be shown in all 22 languages at once, but since you cannot predict which language a user will pick, a picker covering all 22 is the safe approach.
• The 22 Scheduled Languages Covered: Hindi, Bengali, Tamil, Telugu, Marathi, Gujarati, Kannada, Malayalam, Odia, Punjabi, Assamese, Sanskrit, Urdu, Maithili, Santali, Kashmiri, Nepali, Konkani, Sindhi, Dogri, Manipuri, and Bodo.
• Engineering Requirement: Consent banners and preference centers must include an accessible language picker allowing visitors to switch instantly between English and regional languages without page reloads.

Sub-Section (4): The “Symmetrical Ease” Rule for Withdrawal

“…the Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.”

• Plain English Meaning: If it took the user one click on a cookie banner to agree, it must not take more than one click for them to withdraw their consent later.
• Dark Patterns Outlawed:
  • Requiring users to send an email to a support desk to opt out of tracking.
  • Making users fill out a 5-step questionnaire or call a phone number.
  • Hiding the preference settings deep inside obscure account sub-menus.
• Website Requirement: Maintain a persistent, visible floating privacy icon or footer button that allows users to re-open their settings and revoke permissions in a single tap.

Sub-Section (5): Legal Protection for Historical Data & User Consequences

“The consequences of the withdrawal… shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing… before its withdrawal.”

This clause provides fair balance to businesses:

1. No retroactive liability: If a user consented on Monday, you processed their order on Tuesday, and they withdrew consent on Wednesday, your processing on Monday and Tuesday remains 100% legal. The user cannot retroactively sue you for prior processing.
2. Consequences on the user: If withdrawing consent makes it technically impossible to continue offering the service (e.g. withdrawing consent for a food delivery address while waiting for a meal), the business is legally permitted to halt that service without breach of contract.

Sub-Section (6): Downstream Vendor Purge (Processor Cascade)

“…the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data…”

• Plain English Meaning: When a user revokes consent, you cannot simply stop tracking them on your own server while letting third-party marketing tools continue processing their information.
• Engineering Requirement: Your platform must trigger automated webhooks or API requests to all downstream processors (CRM systems, marketing email tools, cloud analytics, advertising networks) to stop processing that user’s data.

Sub-Section (7): Integration with Registered Consent Managers

“The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.”

• Plain English Meaning: Indian citizens will be able to manage their privacy settings through centralized platforms called Consent Managers (similar to how UPI handles payments or Account Aggregators handle financial statements).
• Engineering Requirement: Websites will eventually need to accept consent signals sent from external registered Consent Managers via open APIs.

Sub-Section (8): Consent Manager Fiduciary Duty

“The Consent Manager shall be accountable to the Data Principal and shall act on her behalf…”

• Plain English Meaning: A Consent Manager is legally classified as an agent of the citizen, not of the advertising company. They cannot sell user data, monetize tracking preferences, or collude with brands against the individual’s interest.

Sub-Section (9): Registration with the Data Protection Board

“Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.”

• Plain English Meaning: No company can act as a Consent Manager without registering with the Board under Rule 4 of the DPDP Rules 2025, which takes effect on November 13, 2026. The First Schedule to the Rules requires, among other things, a company incorporated in India with a net worth of at least ₹2 crore, independent certification of its platform against standards the Board publishes, no conflicts of interest with Data Fiduciaries, and consent records kept for at least seven years.

Sub-Section (10): The Reversed Burden of Proof

“Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given… and consent was given…”

• Plain English Meaning: In normal court cases, the person making an accusation has to prove it. Under the DPDP Act, the law reverses this rule.
• If a customer or competitor claims to the Data Protection Board that your website tracked them without permission, the burden is on YOU to prove you did everything lawfully.
• The Golden Technical Rule: If your system does not log a cryptographically verified receipt (timestamp, IP/device hash, exact notice version, and specific categories accepted), you have zero legal defense before the Board.

Complete Compliance Matrix for Section 6

How ConsentPlix Implements Section 6 Automatically

ConsentPlix was engineered specifically around the 10 sub-sections of Section 6:

• Strict pre-consent blocking: Blocks Google Analytics, Meta Pixel, Hotjar, and third-party trackers from loading or dropping cookies until sub-section (1) affirmative consent is clicked.
• Built-in 22 Indian languages: Native translations for all Eighth Schedule languages ready out of the box (satisfying sub-section 3).
• One-click revocation dock: Sits unobtrusively on the bottom corner of every page, guaranteeing instant compliance with sub-section (4).
• Cryptographic audit trail: Generates immutable, tamper-evident receipts that satisfy the strict sub-section (10) burden of proof before the Data Protection Board of India.