Data protection · Provision
Consent must be free, specific, informed and unambiguous. Given for one purpose, it authorises nothing else. Withdrawal must be as easy as giving it.
Quick Statutory Answer
Under Section 6 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. Pre-ticked boxes, bundled consent terms, or forced consent as a condition of service are invalid under law. Furthermore, withdrawing consent must be made as easy as it was to give it, and requires the fiduciary to cease processing and erase the data.
| Statutory Condition | Legal Standard (Section 6) | Invalid Implementation | Compliant Implementation |
|---|---|---|---|
| Free & Unconditional | Not compelled or made condition of service | Refusing service if marketing consent unchecked | Core service independent of optional marketing |
| Specific Purpose | Tied strictly to one processing activity | One checkbox for terms, privacy & promotions | Separate, itemised checkboxes for distinct uses |
| Clear Affirmative Act | Positive deliberate user action | Pre-ticked checkboxes or passive scrolling | Unticked checkbox requiring deliberate user click |
| Withdrawal Parity | Withdrawal must be as easy as giving consent | Signup takes 1 click; withdrawal needs email/letter | In-app toggle or profile setting to withdraw in 1 click |
Processing is unlawful. Consent obtained by bundling or without a real affirmative act is not valid consent under section 6.
Under section 6, valid consent must be free, specific (to a stated purpose), informed (following a section 5 notice), unconditional, and unambiguous — indicated by a clear affirmative action such as ticking a checkbox. Pre-ticked boxes, silence or inaction do not constitute valid consent.
No. Section 6 requires consent to be specific to each purpose. A person may give consent for some purposes and withhold it for others, and processing for a purpose without consent is unlawful.
Through the mechanism the Data Fiduciary must provide, which must be at least as easy as giving consent. If consent was given by ticking a checkbox, withdrawal must be achievable in a similarly simple step — not by sending a written request or navigating to a buried settings panel.
The Data Fiduciary must stop processing the data for that purpose and erase it unless a law requires retention. Erasure on withdrawal is mandated by section 8.
No. Section 6(4) says withdrawal does not affect the lawfulness of processing done before withdrawal, and does not affect processing for other purposes for which valid separate consent exists.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.