Consent is the primary basis for processing under the DPDPA. To be valid it must be free, specific, informed, unconditional and unambiguous — backed by a clear notice and an easy way to withdraw.
The notice that accompanies consent
Before or at the time you seek consent, give an itemised notice describing the personal data you will process, the specific purposes, how the individual can exercise their rights and withdraw consent, and how to complain to the Data Protection Board. It must be available in English or any language in the Eighth Schedule.
Granularity & purpose limitation
Consent is tied to specific purposes. You cannot bundle unrelated purposes, and you cannot process beyond what the individual agreed to.
Withdrawal must be easy
Withdrawing consent must be as easy as giving it. On withdrawal, you — and your processors — must stop the relevant processing within a reasonable time.
Consent Managers
The Act contemplates registered Consent Managers through which individuals can give, manage, review and withdraw consent via an accessible, interoperable platform.
Keep proof
Maintain records of what was consented to, when, and on what notice — you must be able to demonstrate valid consent.