(1) Subject to the provisions of this Act, the consent given by a Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and to the extent necessary for such purpose. (2) A request for consent shall be presented to the Data Principal in a clear and plain language, prior to the processing of personal data, and where such request is made in conjunction with other matters, such request shall be presented separately from such other matters. (3) Any part of consent which is in violation of the provisions of this Act shall be invalid to the extent of such violation. (4) A Data Principal shall have the right to withdraw her consent given to a Data Fiduciary at any time, with the ease of doing so being comparable to the ease with which such consent was given. (5) Upon receiving a request for withdrawal of consent, the Data Fiduciary shall, within such period as may be prescribed, cease to process the personal data for the specified purpose. (6) The consequences of withdrawal of consent shall be borne by the Data Principal. (7) Where a Data Principal withdraws her consent, the Data Fiduciary shall, unless retention of personal data is necessary for the performance of any contract or for any other purpose under any law, erase the personal data within such period as may be prescribed. (8) A Data Fiduciary shall not make the provision of a good or service or the performance of a contract contingent upon the consent by a Data Principal to the processing of personal data that is not necessary for that purpose.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 6 is the operational core of the consent regime. It sets five requirements for valid consent — free, specific, informed, unconditional, unambiguous — all of which must be met simultaneously. A bundled consent that covers multiple purposes in one checkbox fails the 'specific' test. A consent obtained as a condition of service fails the 'free' test if the data is not necessary for that service. The withdrawal right in Section 6(4) is operationally demanding: if the consent journey takes five clicks, the withdrawal journey must also take roughly five clicks. Asymmetric consent/withdrawal flows are non-compliant.
A banking app asks users to consent to (a) opening an account, (b) receiving marketing emails, and (c) sharing data with credit bureaus — all in a single checkbox. This violates the 'specific' requirement. Section 6(2) requires the consent request for each purpose to be presented separately. The bank must separate these into three distinct consent asks.
An app that lets users give consent in two taps but requires them to navigate to Settings > Privacy > Data > Consent Management > Toggle > Confirm to withdraw fails Section 6(4). The withdrawal journey must be as frictionless as the consent journey. A best practice: the same interface that collected consent must be able to revoke it.
A food delivery app cannot make placing an order contingent on consent to receive marketing push notifications. Processing order data is necessary for delivery. Sending marketing is not. The app can ask for marketing consent, but it cannot refuse service if the user declines.
If a consent form contains one clause that violates the Act (e.g., an unconditional consent to third-party data sharing that is not purpose-specific), only that clause is invalid — the rest of the consent remains valid to the extent it complies. This is the DPDP Act's severability principle for consent.