Re-Consenting Existing Users: A DPDP Playbook Before the Deadline
TL;DR
Section 5(2) of the DPDP Act covers data you already hold. Where an individual gave consent before the Act commenced, you must send them a notice as soon as reasonably practicable, and you may continue processing until they withdraw. But that only works where real consent exists and can be evidenced. Data with no consent record, bundled consent or data obtained from third parties needs re-permission or another lawful basis, or must stop being used.
Who this is for: marketing, product and privacy teams responsible for the customer data an organisation already holds.
Most DPDP planning focuses on new sign-ups: new notices, new consent flows, new banners. But for most businesses, the larger job is the data already sitting in CRMs, marketing platforms and databases, collected over years under very different standards. Section 5(2) of the DPDP Act deals specifically with that data.
What Section 5(2) says
Where a Data Principal gave consent before the Act commenced, the Data Fiduciary must, as soon as reasonably practicable, give them a notice describing:
- the personal data and the purpose for which it has been processed
- how they can withdraw consent and exercise their rights
- how they can complain to the Data Protection Board
The fiduciary may continue to process the data until the individual withdraws consent.
This is more permissive than many businesses assume. Valid pre-existing consent does not have to be collected again. It has to be followed by a notice and honoured if withdrawn.
The catch: you need consent to rely on
Section 5(2) only helps where consent was actually given. It does not create consent where there was none. Sort your existing data into three groups:
| Group | Typical examples | What to do |
| A. Evidenced consent | Opt-in records with date, channel and wording | Send the Section 5(2) notice; continue; honour withdrawals |
| B. Another lawful basis | Data customers gave to receive an order or service (Section 7(a)); employee data (Section 7(i)) | Keep using it for that purpose only; consent is not needed for it |
| C. No defensible basis | Purchased lists, scraped contacts, bundled "agree to everything" checkboxes, consent you cannot evidence | Seek fresh consent through a clear opt-in, or stop using it |
Group C is where most risk sits. Under Section 6(10), you carry the burden of proving consent. A spreadsheet of email addresses with no record of how they were collected cannot carry it.
The playbook
Step 1: Inventory
List every database holding personal data used for consent-based purposes, especially marketing. For each, record the source, collection date range and what evidence of consent exists. Your ROPA is the starting point.
Step 2: Classify
Put each segment into group A, B or C. Be honest about group C; it is better to discover weak consent now than in front of the Board.
Step 3: Send Section 5(2) notices to group A
Write a notice that meets the content requirements above, in plain language, through a channel the individual uses. Include a one-step way to withdraw. See how to write a DPDP privacy notice.
Step 4: Run a re-permission campaign for group C
Ask clearly: "Do you want to keep hearing from us about X?" with an unticked opt-in. Do not use dark patterns such as default yes, confirmshaming or repeated prompts (see consent dark patterns). Anyone who does not opt in is suppressed.
Step 5: Restrict group B to its purpose
Data held for orders, accounts or employment can stay, but only for that purpose. Remove it from marketing audiences unless consent is obtained.
Step 6: Record and propagate
Log every notice, opt-in and withdrawal with the notice version and timestamp, and push the results to every downstream system: CRM, email, SMS, WhatsApp, ad audiences and vendors.
Timing
The notice and consent obligations take effect on 13 May 2027 (see the DPDP compliance timeline). Large databases and multi-channel campaigns take months. Start inventory and classification now, and aim to complete notices and re-permission around commencement.
Common mistakes
- Re-consenting everyone unnecessarily. Evidenced consent can continue with a notice.
- Assuming everything is "existing consent". Without evidence, it is not.
- Re-permission emails that look like spam. Keep them clear, branded and short.
- Forgetting downstream systems. Suppressed contacts reappear from old exports.
How ConsentifyAI helps
ConsentifyAI imports existing consent records with their source and evidence, helps classify segments, sends versioned Section 5(2) notices and re-permission requests, and records every response in a tamper-evident audit trail, propagating opt-outs to your CRM and messaging tools.
Sources & references
- DPDP Act, 2023 — Section 5(1), 5(2)
- DPDP Act, 2023 — Section 6(1), 6(4), 6(10)
- DPDP Act, 2023 — Section 7(a)
- DPDP Rules, 2025 — Rule 3
Frequently asked questions
Do we have to re-collect consent from existing users under DPDP?
Not automatically. Section 5(2) lets you continue processing on consent given before commencement, provided you send a notice and stop if the person withdraws. Re-consent is needed where you cannot show that consent was actually given.
What must the Section 5(2) notice contain?
The personal data and the purpose for which it has been processed, how the individual can withdraw consent and exercise their rights, and how to complain to the Data Protection Board.
When must existing users receive the notice?
As soon as reasonably practicable. Plan to complete it around the 13 May 2027 commencement of the notice obligations.
What if we have no record of consent?
Then there is nothing to rely on under Section 5(2). Identify another lawful basis, such as Section 7(a) for the original transaction, or seek fresh consent, or stop the processing.
Will a re-consent campaign shrink our list?
Usually, yes. The remaining contacts are typically more engaged and, crucially, defensible.
Related reading
Marketing Consent Under DPDP: The Rules for Email, SMS and WhatsApp
Under the DPDP Act, direct marketing to individuals generally needs consent: there is no legitimate interests ground, and data given for an order does not cover promotions. Consent must be specific to the channel and purpose, preceded by a notice, and as easy to withdraw as to give. Purchased and scraped lists are high-risk. TRAI's commercial communication rules still apply to SMS and calls. Existing databases need a notice and a consent check before May 2027.
ReadHow to Write a DPDP Privacy Notice People Actually Read
Under Section 5 of the DPDP Act and Rule 3, every request for consent must come with a notice that stands on its own, uses clear and plain language, and itemises the personal data, the specific purpose and what it enables. It must explain how to withdraw consent, exercise rights and complain to the Data Protection Board, and be available in English or any Eighth Schedule language. A privacy policy alone does not meet this standard.
ReadValid Consent Under DPDP: Why Your Checkbox Isn't Enough
Under Section 6 of the DPDP Act, consent is valid only if it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. It must come with a standalone, itemised notice. It must be as easy to withdraw as to give. And the business, not the customer, must be able to prove all of this (Section 6(10)). A checkbox captures a click. It does not, by itself, meet any of these tests.
Read