Definition
Under Section 6 of the DPDPA, 2023, consent means any freely given, specific, informed, unconditional and unambiguous indication of a person's agreement, signalled by clear affirmative action. Silence, a pre-ticked box, or continued use of your website is not consent. Consent is valid only for the personal data actually necessary for the stated purpose — bundling extra fields into one tick invalidates the whole request. It must be preceded or accompanied by a notice, and Section 6(4) requires withdrawal to be as easy as giving consent. Under Section 6(10), the burden of proving valid consent sits with you, not the customer.
What a valid consent request looks like
- An itemised list of exactly what data you collect and why (Rule 3)
- Presented on its own, not buried inside terms and conditions
- Available in English or any language in the Eighth Schedule to the Constitution
- A visible way to withdraw, exercise rights, and complain to the Data Protection Board
- Separate ticks for separate purposes — service delivery and marketing cannot share one checkbox
Consent is not the only route. Section 7 sets out legitimate uses — a closed, finite list including employment purposes, medical emergencies, legal obligations and data a person voluntarily provides for a clear purpose. Unlike GDPR, India has no open-ended "legitimate interests" test you can argue your way into. If your processing doesn't fit a named Section 7 entry, you need consent.
A Consent Manager is a separate mechanism under Section 6(7) — a Board-registered platform through which people give, manage and withdraw consent. That's covered in detail on our Consent Manager page; it's a delivery channel, not an alternative standard.
How this matters in practice
Most Indian SMBs fail Section 6 in three predictable places: one checkbox covering service and marketing, no withdrawal path once someone is in the CRM, and no record of what was consented to or when. Privigo generates itemised Rule 3 notices, wires a real withdrawal route into your forms and WhatsApp flows, and logs each consent event so you can discharge the Section 6(10) burden.
Frequently asked questions
Can we make consent a condition of using our service — no tick, no access?
Not for data you don't actually need. Consent must be free and unconditional, and Section 6(1) limits it to the personal data necessary for the specified purpose. You can require the fields genuinely needed to deliver the service. You cannot force agreement to marketing, profiling or data-sharing as the price of entry — that's a conditional tick, and it makes the consent invalid rather than merely risky.
We use a cookie banner copied from a European site. Is that enough for India?
India has no ePrivacy-style cookie law, so there's no separate cookie rule to comply with — but that cuts both ways. Where cookies or trackers process personal data, Section 6 applies in full. A cookie wall that blocks the site until you accept, pre-ticked analytics boxes, or an "OK" button with no reject option all fail the free, unambiguous, affirmative-action test. A reject option as prominent as accept is the practical fix.
A customer withdrew consent. Do we have to delete everything immediately?
You must stop processing within a reasonable time under Section 6(5) and erase the personal data, unless retention is required by another law — tax, GST, company or sector-specific record-keeping rules commonly apply. Section 6(6) lets you tell the person the consequences of withdrawal: if the service cannot run without that data, it can stop. What you cannot do is make withdrawal harder than consent was, or keep the data "just in case."
Turn consent into a record you can show
Book a 30-minute call. We pick one form and one WhatsApp flow, split service from marketing, and show what a Section 6 artefact looks like versus a privacy-policy tick.
Book a demo
Free Gap Analysis
Disclaimer: Privigo is not a law firm. This page provides operational compliance guidance only. For institution-specific obligations, work with qualified Indian legal counsel.