What is valid consent under the DPDP Act — 5 requirements
DPDP consent is not a checkbox formality. Here are the five requirements that make consent legally valid under the Act.
What does 'free' consent mean under DPDP?
Free consent means the data principal genuinely had a choice to refuse without material detriment. Consent is not free when: access to a service is conditional on consenting to data processing not strictly necessary for that service (consent-for-service bundling); the data principal faces significant harm from refusing (job-dependent consent); or there is a significant power imbalance (employer-employee, government-citizen). Bundling consent — 'agree to all data uses to create your account' — is not free consent for non-essential processing. Separate, optional consent checkboxes for non-essential uses are required.
What does 'specific' consent mean under DPDP?
Specific consent means separate consent for each distinct processing purpose. A single blanket consent covering 'all purposes' or 'as described in our privacy policy' is not specific. Each use case must be individually described and individually consented to. Example: order fulfilment consent is separate from marketing email consent, which is separate from data sharing with advertising partners, which is separate from profiling for personalised recommendations. Granular consent design — one checkbox per purpose — is the technical implementation of specificity.
What does 'informed' consent mean under DPDP?
Informed consent requires that the data principal understands, before consenting: what personal data is being collected; the specific purpose for which it will be used; who it will be shared with; how long it will be retained; and their right to withdraw. This information must be provided in a notice that is: written in plain language (not legalese); itemised (per processing purpose); accessible (before the consent mechanism, not buried in a 40-page privacy policy); and available in the language the data principal chooses from those offered by the Fiduciary.
What does 'unambiguous' consent mean under DPDP?
Unambiguous consent requires a clear, positive action to indicate agreement — a deliberate act that cannot be misinterpreted as refusal or indifference. A pre-ticked checkbox is not unambiguous — the user's failure to untick is not an affirmative act. Continued scrolling through a website is not unambiguous. Silence is not unambiguous. Valid unambiguous consent: actively checking a blank checkbox; clicking an 'I agree' button specifically linked to the consent purpose; completing a sign-up form after reading a consent statement — where the act of submission clearly constitutes agreement.
How must consent withdrawal work under DPDP?
Withdrawing consent must be: as easy as giving consent — if consent was given with one click, withdrawal should also be one click; immediately effective — the Fiduciary must stop processing within a reasonable time after withdrawal; permanent — re-requesting consent after withdrawal is allowed, but only once after a reasonable period; and consequence-free for essential services — withdrawal of optional consent cannot result in withdrawal of the core service. The withdrawal mechanism must be visible and accessible at all times, not buried in settings.
What are the consequences of invalid consent?
Processing based on invalid consent is processing without a lawful basis — one of the most fundamental DPDP violations. The Data Protection Board can: direct immediate cessation of the processing; require deletion of all data collected on invalid consent; and impose a penalty of up to ₹250 crore. Invalid consent also means any downstream processing — sharing with third parties, use in analytics, AI training — is also unlawful. Audit your consent flows before enforcement begins to identify and fix invalid consent at every collection point.
Frequently asked questions
Does clicking 'Accept All' on a cookie banner constitute valid DPDP consent?
A cookie banner 'Accept All' button can constitute valid consent if: the banner clearly describes the purposes for each cookie category; the consent is granular (marketing cookies are separate from analytics cookies); rejecting non-essential cookies is as prominent as accepting; and there is no penalty for declining. Most current Indian website cookie banners do not meet these standards — they present 'Accept All' prominently with no genuine 'Reject All' option, and the descriptions of cookie purposes are vague. An audit of cookie consent architecture is recommended.
Is consent needed for processing employee data?
Employment data processing required to perform the employment contract — payroll, attendance, performance management, benefit administration — is covered by the contractual basis, not consent. Statutory obligations — EPF, TDS, ESI — are covered by the legal obligation basis. Consent is required for employee data processing that goes beyond what is necessary for the employment relationship: using employee photos in marketing, sharing data with wellness app vendors, collecting biometric data for attendance (if an alternative is possible). The distinction between contract and consent is critical for HR teams.
Can consent be obtained in an employment contract?
Bundling data protection consent into an employment contract is problematic for the same reason as bundling in service contracts: the power imbalance between employer and employee means the consent may not be 'free'. Employees may feel coerced into consenting to data processing they would otherwise refuse. For employment-necessary processing, rely on the contract or statutory basis. For discretionary processing (wellness apps, photos, biometrics), obtain separate, optional consent outside the employment contract.
Audit your consent mechanisms
Niti Bharat's DPDP Consent Audit tests every collection point against the five validity requirements — free, specific, informed, unconditional, unambiguous — with a gap report and remediation plan.
Start Consent Audit