Section 6 of Digital Personal Data Protection Act, 2023 - Consent
Section 6 of the Digital Personal Data Protection Act, 2023 (DPDP Act) sets the legal standard for consent used as a basis for processing digital personal data. It deals with the quality of consent, invalid terms, withdrawal, Consent Managers and the Data Fiduciary's obligation to prove valid notice and consent.
Meaning and scope of consent under Section 6
For consent-based processing under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, must involve a clear affirmative action, and must relate to a specified purpose. The personal data sought on the basis of consent must also be limited to what is necessary for that specified purpose.
This requirement is important because consent is not intended to operate as a blanket permission for unrelated or unnecessary collection of personal data. A Data Fiduciary relying on consent must be able to connect the personal data collected with the purpose communicated to the Data Principal.
Key requirements of Section 6
- Purpose limitation: consent must relate to a specified purpose.
- Data minimisation: consent is limited to personal data necessary for that purpose.
- Clear affirmative action: consent must be unambiguous and actively indicated.
- No unlawful waiver: a consent term that infringes the Act, the rules or another law is invalid to the extent of the infringement.
- Plain-language request: a request for consent must be presented clearly and provide the prescribed language option and relevant contact details.
- Withdrawal: where consent is the basis of processing, it may be withdrawn, and withdrawal must be as easy as giving consent.
- Consent Manager: the Act permits a Data Principal to give, manage, review or withdraw consent through a registered Consent Manager.
- Proof: where consent is disputed in a proceeding, the Data Fiduciary must prove that the required notice was given and that consent complied with the Act and rules.
Section 6 - statutory provision
(1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
Illustration. X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services.
(2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.
Illustration. X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. She gives to Y her consent for (i) the processing of her personal data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the Data Protection Board of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid.
(3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal for the purpose of exercise of her rights under the provisions of this Act.
(4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
(5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal.
Illustration. X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processing of her personal data by Y for the purpose of fulfilling her supply order and places an order for supply of a good while making payment for the same. If X withdraws her consent, Y may stop enabling X to use the app or website for placing orders, but may not stop the processing for supply of the goods already ordered and paid for by X.
(6) If a Data Principal withdraws her consent to the processing of personal data under sub-section (5), the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India.
Illustration. X, a telecom service provider, enters into a contract with Y, a Data Processor, for emailing telephone bills to the customers of X. Z, a customer of X, who had earlier given her consent to X for the processing of her personal data for emailing of bills, downloads the mobile app of X and opts to receive bills only on the app. X shall itself cease, and shall cause Y to cease, the processing of the personal data of Z for emailing bills.
(7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager.
(8) The Consent Manager shall be accountable to the Data Principal and shall act on her behalf in such manner and subject to such obligations as may be prescribed.
(9) Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.
(10) Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder.
Withdrawal of consent
Section 6 gives the Data Principal a continuing right to withdraw consent where consent is the basis for processing. The statutory test is practical: withdrawing consent should be comparable in ease to giving it. Withdrawal does not retrospectively make earlier consent-based processing unlawful. After withdrawal, processing based solely on that consent must cease within a reasonable time, including processing carried out by Data Processors, unless another provision of the Act, the rules or another Indian law requires or authorises continued processing.
Consent Manager under the DPDP framework
A Consent Manager is a mechanism through which a Data Principal may give, manage, review and withdraw consent. Section 6 requires registration with the Data Protection Board and contemplates prescribed technical, operational, financial and other conditions. The Digital Personal Data Protection Rules, 2025 contain the detailed registration framework and obligations for Consent Managers, including requirements concerning records, security, transparency and conflicts of interest.
Burden of proving consent
Sub-section (10) places an important evidentiary responsibility on the Data Fiduciary. If a question arises in a proceeding about consent-based processing, the Data Fiduciary must prove that the required notice was given and that consent was obtained in accordance with the Act and the applicable rules. Organisations relying on consent should therefore maintain appropriate records of the notice, the consent event, the purpose, the relevant data and subsequent withdrawal or modification.
Related provisions
Section 6 should be read with Section 5 on notice, Section 4 on grounds for processing personal data, Section 7 on certain legitimate uses and Section 8 on general obligations of a Data Fiduciary.
Note: This page is a general legal information resource. For compliance or a dispute, verify the current Gazette notifications, rules and any applicable judicial or regulatory developments.