Sekurzen Logo
DPDP chapter4 / 14

Chapter 4: Consent and Withdrawal

Consent standards, proof, and withdrawal

chapter · 2 min read · Updated 14-Feb-2026 · 4 of 14

Executive Summary

  • •Consent must be free, specific, informed, unconditional, and unambiguous, and it must be signified through clear affirmative action for a specified purpose.

Institutional Impact

  • •Clear affirmative action: Do not rely on silence, inactivity, or a pre-selected choice as the expression of consent.
  • •Purpose discipline: Consent must relate to a specified purpose and be limited to personal data necessary for that purpose.
  • •Easy Withdrawal: Withdrawing consent must be as easy as giving it. If it took one click to subscribe, it shouldn't take a phone call to unsubscribe.
  • •Proof: The Data Fiduciary must be able to prove that notice was given and consent was obtained when a dispute arises.

Data Principal Rights

  • •Power to Say No: You can agree to the service but refuse the marketing tracking.
  • •Change Your Mind: You can withdraw consent at any time, and the company must stop processing your data (within a reasonable time).

Practical application

What this looks like in practice

Use these examples to distinguish a defensible process from a common mistake.

Right

  • ✓A user actively opts into a clearly described purpose and can withdraw that consent through the same service.

Incorrect

  • ×A pre-ticked box treats silence as consent or makes withdrawal harder than the original opt-in.

Official Reference & Scope

  • •Section 5: Notice
  • •Section 6: Consent
  • •Rule 3: Notice details and withdrawal information

Details the requirements for obtaining valid consent from Data Principals.

  • Consent characteristics: Free, specific, informed, unambiguous, and clear affirmative action
  • Consent request format: How to present consent requests
  • Withdrawal mechanism: Easy withdrawal of consent
  • Record keeping: Documentation of consent obtained

The notified Rules do not contain a separate rule titled “Manner of obtaining consent.” Rule 4 instead governs registration and obligations of Consent Managers; the core consent standard remains in section 6 of the Act.

Primary sources: sections 5-6 of the DPDP Act and rule 3 of the DPDP Rules.

Back to list
Chapter 3: Manner of Giving NoticeNext: Chapter 5: Verifiable Consent and Children