Consent Audit Trail: Prove Compliance When the Board Comes Asking

Who this is for: compliance leaders, engineers and DPOs who need to be able to prove, not just assert, that consent was properly obtained and honoured.

Most organisations can tell you that a customer consented. Far fewer can show what that customer was told, exactly what they agreed to, how they agreed, and that a later withdrawal was respected across every system. Under the DPDP Act, that difference matters.

Section 6(10) states that where consent is the basis of processing and a question arises in any proceeding, the Data Fiduciary must prove that notice was given and consent was obtained in accordance with the Act. A consent audit trail is how you discharge that burden. For the consent standard itself, see valid consent under DPDP.

What the audit trail must answer

For any individual and purpose, your records should answer six questions at any point in time:

1. Who gave consent (a stable identifier for the Data Principal)?
2. For what purpose, covering which data items?
3. After seeing which notice, in which version and language?
4. How: what affirmative action did they take, through which channel?
5. When: at what exact time?
6. What has happened since: renewals, changes, withdrawal, and confirmation that downstream systems acted on them?

MeitY's June 2025 Business Requirement Document for consent management systems, which is non-binding guidance, points the same way. It calls for tamper-resistant logging built around a consent record capturing details such as the timestamp, user identifier, purpose, session and method of consent.

What to record

Making it tamper-evident

An audit trail is only as convincing as its integrity. If records can be edited quietly, they prove little. Three design principles help:

• Append-only. Never update or delete a consent event. A withdrawal is a new event, not an edit to the old one.
• Hash-chaining. Store a cryptographic hash of each record together with the hash of the previous record. Any later change to an earlier record breaks the chain and is detectable.
• Separation of duties. The people who can configure consent flows should not be able to alter the evidence they produce. Log configuration changes, such as new notice versions and purposes, in the same trail.

Logging withdrawal properly

Withdrawal is where evidence matters most and where weak systems fail. Section 6(4) requires withdrawal to be as easy as giving consent, and Section 6(6) requires you to stop processing, and cause your processors to stop, within a reasonable time.

Log the withdrawal event itself, then log each downstream confirmation: the CRM suppressed the contact, the email platform unsubscribed them, the vendor confirmed. Without those confirmations, you can prove you received a withdrawal, but not that you honoured it.

How long to keep it

The Act sets no specific retention period for a fiduciary's consent records. A sensible rule is to keep them for as long as you rely on the consent, plus a reasonable period afterwards in which a dispute or complaint could arise. For comparison, registered Consent Managers must keep consent records for at least seven years under the First Schedule to the Rules.

Keep consent records separate from operational logs, which Rule 6 requires to be retained for at least one year for security purposes. They serve different ends and have different retention needs.

Using the trail

A good audit trail is not only defensive. It lets you:

• answer an individual's question about their consent within minutes
• show partner banks, enterprise customers and auditors how consent is governed
• report consent and withdrawal rates by purpose and channel
• demonstrate, under Section 33(2), that you acted on withdrawals and complaints promptly

Common mistakes

• A boolean field. marketing_consent = true proves nothing about notice, method or time.
• Overwriting records. Updating a consent row on withdrawal destroys the history you need.
• No notice versioning. Without it, you cannot show what the individual was told.
• Stopping at the front end. Logging the click but not the downstream propagation leaves the most important question unanswered.
• Editable logs. Evidence that administrators can change is weak evidence.

How ConsentifyAI helps

ConsentifyAI records every consent event in an append-only, hash-chained audit trail, together with the purpose, data items, notice version, language, method, channel and actor. Withdrawals are logged with the confirmation from each connected system. Configuration changes are recorded in the same trail, and you can retrieve the complete history for any individual and purpose when a customer, auditor or the Data Protection Board asks.