Consent, as Section 6 defines it
Five adjectives, one affirmative act, and a right to withdraw that must be as easy as the giving. What the Act requires of consent, and where it does not require it at all.
Section 6(1) of the Act states that consent given by a data principal shall be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must signify agreement to the processing of personal data for the specified purpose, and it is limited to the personal data necessary for that purpose. A request for consent that bundles purposes, or that collects more than the purpose needs, does not meet the section.
The request
Under Section 6(3), a request for consent must be presented in clear and plain language, with the option to read it in English or in any language specified in the Eighth Schedule to the Constitution. It must give the contact details of a data protection officer, where one has been appointed, or of another person authorised to respond on the data fiduciary’s behalf. Section 5 requires that the request be preceded or accompanied by a notice describing the personal data, the purpose, the manner in which the data principal may exercise their rights, and the manner in which a complaint may be made to the Data Protection Board of India.
Withdrawal
Section 6(4) gives the data principal the right to withdraw consent at any time, and requires that the ease of withdrawal be comparable to the ease with which consent was given. The consequences of withdrawal are borne by the data principal. Once consent is withdrawn, Section 6(6) requires the data fiduciary, and any processor acting for it, to cease processing within a reasonable time, unless the processing is required or authorised under a law in force.
Consent managers
Sections 6(7) to 6(9) provide that a data principal may give, manage, review or withdraw consent through a consent manager, and that a consent manager is accountable to the data principal and acts on their behalf. A consent manager must be registered with the Data Protection Board of India under conditions the Rules prescribe. Section 6(10) places the burden of proving that a notice was given and consent obtained on the data fiduciary, in any proceeding where the question arises.
Where consent is not required
Section 7 lists the legitimate uses for which personal data may be processed without consent. They include personal data the data principal has voluntarily provided for a specified purpose, without indicating that they do not consent to its use; processing by the State for subsidies, benefits, services, certificates, licences or permits; compliance with a judgment or order; medical emergencies and public health; and processing for employment purposes, including safeguarding the employer from loss. Each use is bounded by its own terms, and none of them dispenses with the general obligations in Section 8.
- The Digital Personal Data Protection Act, 2023, Sections 5, 6 and 7.
Published 18 September 2026. This note is the Forum’s reading of the law, not the law. It carries no regulatory force.
Back to the Bulletin, or read the standards.