Consent & Notices
← All postsBuild vs Buy Consent Management: The Real Cost of Doing It In-House
A DPDP-ready consent system is far more than a checkbox and a database column. It needs a purpose registry, versioned multilingual notices, a consent ledger, withdrawal propagation, parental consent, cookie handling, rights requests and a tamper-evident audit trail, all maintained as the Rules and guidance evolve. Building can make sense for organisations with unusual needs and spare engineering capacity. For most, buying is faster and cheaper over three years.
Re-Consenting Existing Users: A DPDP Playbook Before the Deadline
Section 5(2) of the DPDP Act covers data you already hold. Where an individual gave consent before the Act commenced, you must send them a notice as soon as reasonably practicable, and you may continue processing until they withdraw. But that only works where real consent exists and can be evidenced. Data with no consent record, bundled consent or data obtained from third parties needs re-permission or another lawful basis, or must stop being used.
ReadEmployee Privacy Notice Under DPDP: What to Tell Your People
Section 5 of the DPDP Act requires a notice when consent is requested, and most employee data relies on the Section 7(i) employment use instead. A clear employee privacy notice is still essential: it defines the purposes you rely on, explains monitoring and vendors, sets expectations on retention and rights, and replaces outdated blanket consent clauses. Use separate, Rule 3-compliant notices for any optional, consent-based programmes.
ReadBackground Verification Under DPDP: What Employers Can Check, and How
Background verification collects some of the most sensitive data an employer handles: identity documents, education and employment history, addresses and sometimes criminal records. Under the DPDP Act, tell candidates exactly what will be checked and by whom, get their authorisation, check only what the role requires, handle Aadhaar carefully, contract your BGV vendor as a processor and delete verification data once it has served its purpose.
ReadRecruitment Under DPDP: Handling Candidate Data From Application to Talent Pool
Candidates are Data Principals too. CVs and assessments submitted for a role can be processed for that recruitment, but keeping them in a talent pool for future roles, sourcing profiles from portals and running AI screening each raise separate questions. Give candidates a clear notice, get consent for talent pools, check vendors and AI tools, and erase unsuccessful candidates' data on a fixed schedule.
ReadEmployee Data Under DPDP: When You Need Consent and When You Don't
Section 7(i) of the DPDP Act lets employers process employee data without consent for employment purposes and to protect the business from loss or liability. Consent is still needed for anything beyond that, and consent from employees is hard to call free, so use it only for genuinely optional activities. Because access and correction rights attach to consent-based data, many employment records fall outside them, but security, retention, breach and grievance duties still apply.
Read7 Consent Dark Patterns That Could Void Your Consent Under DPDP
Consent under the DPDP Act must be free, specific, informed, unconditional and given by a clear affirmative action. Design tricks that steer people towards "yes" undermine each of those tests, and India's Central Consumer Protection Authority separately prohibits dark patterns under its 2023 guidelines. The seven patterns below are the most common in consent flows, and each has a straightforward alternative.
ReadVerifiable Parental Consent: Handling Children's Data in India
Under the DPDP Act, anyone under 18 is a child. Before processing a child's data on the basis of consent, you need verifiable consent from a parent or lawful guardian (Section 9(1), Rule 10). Tracking, behavioural monitoring and targeted advertising directed at children are banned even with consent (Section 9(3)). Rule 12 and the Fourth Schedule exempt specific organisations and purposes. Breaches can cost up to ₹200 crore.
ReadLegitimate Uses Under DPDP: When You Don't Need Consent
The DPDP Act allows only two lawful grounds for processing: consent, or a legitimate use listed in Section 7. The list is closed. It covers data individuals voluntarily provide for a specified purpose, certain state functions, legal obligations and court orders, medical emergencies, epidemics, disasters and employment purposes. There is no general "legitimate interests" ground. Choosing the right basis for each purpose decides which rights apply and whether withdrawal is possible.
ReadChoosing a Consent Management Platform in India: A Buyer's Guide
A consent management platform (CMP) for the DPDP Act must do much more than show a cookie banner. It should manage per-purpose consent across every channel, version multilingual notices, propagate withdrawals to downstream systems, support verifiable parental consent and rights requests, and keep a tamper-evident audit trail. Note that a CMP is software you use; a Consent Manager is a separate, Board-registered entity under the Act.
ReadThe Consent Lifecycle: How to Build Consent You Can Prove
Under the DPDP Act, consent has to be valid when given, honoured while it lasts, withdrawable at any time and provable afterwards. That makes it a lifecycle, not a checkbox. Design it as states and events: notice, capture, record, propagate, use, modify, renew and withdraw. A central registry of purposes, a consent ledger as the single source of truth, event-driven integrations and an audit layer turn that lifecycle into something your teams can operate.
ReadHow to Write a DPDP Privacy Notice People Actually Read
Under Section 5 of the DPDP Act and Rule 3, every request for consent must come with a notice that stands on its own, uses clear and plain language, and itemises the personal data, the specific purpose and what it enables. It must explain how to withdraw consent, exercise rights and complain to the Data Protection Board, and be available in English or any Eighth Schedule language. A privacy policy alone does not meet this standard.
ReadGet started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.