Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to personal data necessary for the specified purpose (section 6). Any part of a consent that infringes the Act or another law is invalid to that extent.
Notice comes first
Every consent request must be accompanied or preceded by a notice (section 5). Rule 3 requires the notice to be understandable on its own, to itemise the personal data, to describe each purpose and the goods or services, and to give a link for withdrawing consent, using rights and complaining to the Board (rule 3).
Withdrawal
A Data Principal may withdraw consent at any time, as easily as she gave it. The consequences of withdrawal are borne by her, and processing before withdrawal stays lawful. After withdrawal, the Data Fiduciary must stop, and make its processors stop, within a reasonable time unless a law requires or authorises the processing (section 6).
Consent Managers
A Consent Manager is registered with the Board and acts as a single point of contact through an accessible, transparent and interoperable platform (section 2). It is accountable to the Data Principal and acts on her behalf (section 6).
- Must be a company incorporated in India with a net worth of not less than two crore rupees, among other conditions (First Schedule, Part A).
- Must not be able to read the personal data it helps share, must keep records of consents for at least seven years, must not sub-contract its obligations and must avoid conflicts of interest (First Schedule, Part B).
- The Board registers, rejects, directs, suspends or cancels registrations (rule 4).
Section 6(9), section 27(1)(d) and rule 4 come into force on 13 November 2026. The rest of section 6 and section 5 come into force on 13 May 2027. See the deadlines.