Compliance
A practical walkthrough shows how a business must obtain, record and withdraw consent under the DPDP Act, and the cost of non‑compliance when consent is invalid or not withdrawn correctly
Check your DPDP readiness — free More on the blogThe first task is to list every distinct purpose for which personal data will be processed. The list must be granular because the DPDP Act requires consent to be specific to each purpose. This list becomes the backbone of the notice that will be shown to data subjects and must be approved by the compliance officer before any consent request is built.
Using the purpose list, the legal team prepares a notice that explains what data will be collected, why it is needed and the legal basis. The notice must be clear, concise and written in plain language so that the data subject can give an informed decision. Each notice is attached to its own consent mechanism; bundling multiple purposes into a single checkbox is prohibited.
The product team builds a user interface where the data subject must perform a clear affirmative action – for example ticking an unticked box – for each purpose. Pre‑ticked boxes or silence do not satisfy the unambiguous requirement. The system records the exact timestamp, the purpose, and the user’s identifier as proof of consent.
The same product team must add a withdrawal button that mirrors the consent step. If consent was given by ticking a box, the user should be able to uncheck it with a single click. The withdrawal action must trigger an automatic update of the consent log, marking the purpose as withdrawn and recording the withdrawal timestamp.
When a withdrawal is logged, the operations team must halt any further processing for that purpose immediately. The data engineering team then runs an erasure script to delete the relevant data, unless a statutory retention requirement applies. A record of the erasure action, including date and method, must be kept for audit purposes.
The compliance officer compiles a consent register that includes the original notice, the consent log, withdrawal logs and erasure records. This register is stored securely and must be producible to regulators or data subjects on request. Failure to produce it can lead to penalties, and processing without valid consent is unlawful under the Act.
Human resources arranges periodic training for marketing, product and operations staff on the requirement that consent be free, specific, informed and unambiguous, and that withdrawal be as easy as consent. The compliance team runs quarterly checks of the consent logs to ensure no processing continues after withdrawal and that no pre‑ticked boxes are in use. By following these steps in order—identifying purposes, drafting separate notices, building affirmative consent controls, matching withdrawal mechanisms, halting processing, documenting everything and training staff—a business can avoid the cost of unlawful processing, which includes regulatory fines and reputational damage.
Proof comes from a consent log that records the data subject’s identifier, the exact purpose, the timestamp and the affirmative action (such as ticking an unticked box). This log must be stored in a tamper‑evident system and be available for audit.
Only the processing linked to the withdrawn purpose must stop and the data must be erased, unless a law requires retention. Processing for other purposes where valid consent still exists can continue unchanged.
No. The DPDP Act requires consent to be specific to each purpose. A single checkbox that bundles multiple purposes does not meet the requirement for free, specific and unambiguous consent.
Pre‑ticked boxes are not an affirmative act, so consent obtained that way is invalid. Processing based on such consent is unlawful, exposing the business to penalties and the need to delete any data processed without valid consent.
Published 23 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.