Consent is not a checkbox.It is a contract you have to prove.

The question is not whether the customer clicked. It is whether you can show what they agreed to, and honour it when they change their mind.

In one line: Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose. It must be as easy to withdraw as to give.

The estate · Consent is a contract you have to proveHover to inspect

Consent obtained minus consent understood equals no defence.

The scene

The marketing team had eighty thousand opt-ins. Legal asked a simple question: opt-in to what, shown which notice, on which date, in which language? The answer lived in a vendor's logs that had rotated out months ago. Eighty thousand consents became eighty thousand assertions.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
One checkbox covers everything. Section 6 requires consent to be specific to a purpose; bundling fails that test. One purpose, one ask. Let the customer say yes to some and no to others.
Withdrawal is an email to support. Section 6(4) requires withdrawal to be as easy as giving consent. Put withdrawal where consent was given, one tap away.
The notice is in the privacy policy. Section 5 requires a notice at or before the request, in clear language, with options in scheduled languages. Show the notice at the moment of the ask, not in the footer.

Consent managers

The Act introduces registered consent managers: platforms through which Data Principals give, manage and withdraw consent. Registration opens under the Rules' phased timeline. They will change who holds the record of consent.

Monday morning

  1. 01Screenshot every place you ask for consent today.
  2. 02For each, write the purpose in one sentence. If you cannot, the ask is not specific.
  3. 03Test withdrawal yourself. Time it.

Questions, answered plainly

What makes consent valid under DPDPA?

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to personal data necessary for the specified purpose. It must be as easy to withdraw as to give.

Does DPDPA allow pre-ticked consent boxes?

Consent must be signified by a clear affirmative action. A pre-ticked box is not an action by the Data Principal and is unlikely to meet the standard.

Who are consent managers under DPDPA?

Consent managers are entities registered with the Data Protection Board that let Data Principals give, manage, review and withdraw consent through an accessible, interoperable platform. They act on behalf of the Data Principal.

Argument 05Silence after a breach is the most expensive sound.Read → Argument 06You can outsource the processing. You cannot outsource the liability.Read → Argument 07Privacy is not a department. It is a board decision.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner