Consent management under the DPDP Act
Updated 19 Sep 2026 · 6min read · Reviewed by ConsentLo's DPDP audit team
Consent is the main lawful basis for processing personal data under the DPDP Act, and the bar is high. This guide explains what valid consent looks like and how to manage it at scale.
What valid consent means
Consent must be all of these:
- Free: not forced, and not a condition of a service when the data is not needed for it.
- Specific: given for a stated purpose, not a blanket "we may use your data".
- Informed: preceded by a clear notice.
- Unconditional and unambiguous: given by a clear affirmative action, never a pre-ticked box.
- Limited to the data necessary for that purpose.
Purpose by purpose
If you process data for order delivery, marketing emails and personalised ads, each is a separate purpose and needs a separate choice. A person may say yes to delivery and no to ads. Any clause in your notice or terms that goes against the Act is invalid to that extent.
Withdrawal as easy as giving
People must be able to withdraw consent as easily as they gave it, for example with one switch in a portal or app. After withdrawal you, and your processors, must stop processing for that purpose within a reasonable time.
Proving consent
If there is a dispute, the burden of proving that valid notice and consent were given is on you. You need a record of exactly which notice version was shown, in which language, what was chosen, when and through which channel, kept in a form that cannot be quietly edited.
What a consent management platform does
A consent management platform (CMP) such as ConsentLo handles this end to end: versioned multilingual notices, a widget or SDK that captures purpose-level choices, an immutable consent ledger, a self-service privacy portal for withdrawal and rights, and automatic instructions to your processors when consent is withdrawn.
Frequently asked questions
Are cookie banners enough for DPDP consent?
Not by themselves. DPDP consent must be purpose-specific, backed by a clear notice, as easy to withdraw as to give, and provable later. Many cookie banners fail on at least one of these.
Can consent be bundled with terms and conditions?
No. Consent must be specific and unconditional. Bundling it into terms of service, or making a service conditional on consent to unnecessary processing, does not meet the standard.
What is the difference between a consent management platform and a Consent Manager?
A consent management platform is software a business uses to run its own consent. A Consent Manager is an entity registered with the Data Protection Board that lets individuals manage consent across many businesses. ConsentLo can connect to registered Consent Managers.