Data protection · Provision
Consent must be free, specific, informed and unambiguous. Given for one purpose, it authorises nothing else. Withdrawal must be as easy as giving it. (Section 6, Digital Personal Data Protection Act, 2023.) Sub-section (9) in force from 13 November 2026; the rest from 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Under Section 6 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. Pre-ticked boxes, bundled consent terms, or forced consent as a condition of service are invalid under law. Furthermore, withdrawing consent must be made as easy as it was to give it, and requires the fiduciary to cease processing and erase the data.
6. Consent.— (1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose. Illustration. X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services. (2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement. Illustration. X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. She gives to Y her consent for (i) the processing of her personal data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the Data Protection Board of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid. (3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal for the purpose of exercise of her rights under the provisions of this Act. (4) Where consent given by the Data Principal is the basis of processing of personal data, such Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given. (5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal. Illustration. X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processing of her personal data by Y for the purpose of fulfilling her supply order and places an order for supply of a good while making payment for the same. If X withdraws her consent, Y may stop enabling X to use the app or website for placing orders, but may not stop the processing for supply of the goods already ordered and paid for by X. (6) If a Data Principal withdraws her consent to the processing of personal data under sub-section (5), the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law for the time being in force in India. Illustration. X, a telecom service provider, enters into a contract with Y, a Data Processor, for emailing telephone bills to the customers of X. Z, a customer of X, who had earlier given her consent to X for the processing of her personal data for emailing of bills, downloads the mobile app of X and opts to receive bills only on the app. X shall itself cease, and shall cause Y to cease, the processing of the personal data of Z for emailing bills. (7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager. (8) The Consent Manager shall be accountable to the Data Principal and shall act on her behalf in such manner and subject to such obligations as may be prescribed. (9) Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed. (10) Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder.
| Statutory Condition | Legal Standard (Section 6) | Invalid Implementation | Compliant Implementation |
|---|---|---|---|
| Free & Unconditional | Not compelled or made condition of service | Refusing service if marketing consent unchecked | Core service independent of optional marketing |
| Specific Purpose | Tied strictly to one processing activity | One checkbox for terms, privacy & promotions | Separate, itemised checkboxes for distinct uses |
| Clear Affirmative Act | Positive deliberate user action | Pre-ticked checkboxes or passive scrolling | Unticked checkbox requiring deliberate user click |
| Withdrawal Parity | Withdrawal must be as easy as giving consent | Signup takes 1 click; withdrawal needs email/letter | In-app toggle or profile setting to withdraw in 1 click |
Processing is unlawful. Consent obtained by bundling or without a real affirmative act is not valid consent under section 6.
Under section 6, valid consent must be free, specific (to a stated purpose), informed (following a section 5 notice), unconditional, and unambiguous — indicated by a clear affirmative action such as ticking a checkbox. Pre-ticked boxes, silence or inaction do not constitute valid consent.
No. Section 6 requires consent to be specific to each purpose. A person may give consent for some purposes and withhold it for others, and processing for a purpose without consent is unlawful.
Through the mechanism the Data Fiduciary must provide, which must be at least as easy as giving consent. If consent was given by ticking a checkbox, withdrawal must be achievable in a similarly simple step — not by sending a written request or navigating to a buried settings panel.
The Data Fiduciary must stop processing the data for that purpose and erase it unless a law requires retention. Erasure on withdrawal is mandated by section 8.
No. Section 6(5) says withdrawal does not affect the legality of processing done on that consent before it was withdrawn. And because consent under section 6(1) is given for a specified purpose, withdrawing it for one purpose does not withdraw consent given separately for another.
In two parts. Sub-section (9), which requires every Consent Manager to be registered with the Board, comes into force on 13 November 2026. The rest of section 6, including the conditions for valid consent and the right to withdraw it, comes into force on 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.