What consent is required for processing personal data?

What the Law Says

The Digital Personal Data Protection Act, 2023 (DPDP Act) sets out strict conditions for valid consent before personal data can be processed.

Under the DPDP Act, consent is the primary legal basis for processing personal data. It must be obtained before any processing begins — unless an exception applies (e.g., for legal compliance, medical emergency, or employment purposes).

Consent must be 'free, informed, specific, unambiguous, and given through a clear affirmative action'. This means individuals must understand what data is collected, why it’s needed, who will process it, and how long it will be retained — and must actively agree (e.g., ticking a box), not just remain silent or be subjected to pre-ticked options.

The law explicitly prohibits 'dark patterns' — user interfaces designed to manipulate or trick individuals into giving consent. Consent must also be capable of being withdrawn at any time, and withdrawal must be as easy as giving consent.

Statutory Text

Consent shall be free, informed, specific, unambiguous and given through a clear affirmative action.

— Digital Personal Data Protection Act, 2023, s. 6(1) — Consent

Statutory Text

Consent shall not be deemed to have been given if it is obtained through deception, misrepresentation, coercion, undue influence, or any other unfair or dishonest practice.

— Digital Personal Data Protection Act, 2023, s. 6(3) — Invalid consent

Statutory Text

The Data Principal shall be at least eighteen years of age…

— Digital Personal Data Protection Act, 2023, s. 2(t) — Definition of Data Principal

Sources