Consent sits at the centre of the Digital Personal Data Protection Act, 2023. Unless a specific "legitimate use" applies, a Data Fiduciary needs the individual's valid consent to process their personal data. Yet many consent mechanisms in use today, from pre-ticked boxes to buried clauses in lengthy terms, would struggle to meet the Act's standard.

This article explains what valid consent looks like under the DPDPA, how to design for it and where organisations typically go wrong. Always verify details against the current Act and rules.

Under the Act, consent must be:

  • Free: not obtained through coercion, undue influence or conditioned on unnecessary data.
  • Specific: tied to a stated purpose, not a vague blanket permission.
  • Informed: preceded by clear information about what data is collected and why.
  • Unconditional: not bundled with unrelated terms; consent to processing beyond what is necessary for the service cannot be a condition for receiving it.
  • Unambiguous: indicated by a clear affirmative action.
  • Limited: covering only the personal data necessary for the specified purpose.

Consent must also be capable of withdrawal, and withdrawal must be as easy as giving consent.

Why pre-ticked boxes fail

A pre-ticked checkbox requires the user to act in order to refuse, not to agree. Silence or inaction is not a clear affirmative action. The same logic applies to defaults buried in sign-up flows, "continue means you agree" statements and consent presumed from usage of a service.

The notice requirement

Consent requests must be accompanied by, or preceded by, a notice that informs the individual about:

  • The personal data to be processed and the purpose of processing.
  • How to exercise rights, including withdrawing consent and making a grievance request.
  • How to complain to the Data Protection Board.

The Act contemplates notices in clear and plain language, and the ability to access the notice in English or any language listed in the Eighth Schedule of the Constitution. The rules prescribe further detail, so check them.

Good notices are short, layered and written for ordinary people, not lawyers. Provide a summary first, with links to detail.

Use granular choices. If you process data for several purposes, such as service delivery, personalised offers and analytics shared with partners, let people decide on each separately. A single "I agree to everything" button is risky where purposes differ.

Separate consent from terms of service. Do not hide consent inside a long agreement. Present it distinctly, with a clear action.

Avoid dark patterns. Do not use confusing language, visual tricks, repeated nagging or making refusal difficult. Make "decline" as visible and as easy as "accept".

Explain value honestly. Say what the individual gets in return, without exaggeration.

Request only what is needed. If a flashlight app does not need contacts, do not ask for them.

Make withdrawal easy. Provide a settings page, a link in communications or another accessible route, and act promptly on requests. Explain consequences of withdrawal truthfully, such as inability to provide a service that needs the data.

Support multiple languages. Offer notices and consent flows in languages your users understand.

Under the Act, the burden of proof of consent rests on the Data Fiduciary. Keep reliable records showing:

  • Who consented, when and through what interface.
  • The version of the notice shown.
  • The purposes and data covered.
  • Any withdrawal and its date.
  • Evidence that downstream processing stopped after withdrawal.

Build a consent management capability, either in-house or through a vendor, that integrates with systems that use the data so that changes propagate. The Act also provides for Consent Managers, registered entities that help individuals give, manage, review and withdraw consent through an accessible platform. Consider whether integration with them is relevant to your business.

Legacy data and existing consents

Many organisations hold large amounts of data collected under older mechanisms. The rules and transitional provisions address how existing data and consents are treated, and the position may involve fresh notices. Review current guidance, identify datasets whose consent is unclear, and plan to refresh consent or rely on another lawful basis where permitted.

Legitimate uses

Not all processing needs consent. The Act lists specific legitimate uses, including voluntary provision of data by the individual for a stated purpose where they have not indicated non-consent, compliance with legal obligations and court orders, responding to medical emergencies, certain employment-related purposes, and some state functions and benefits. These are narrowly defined. Do not treat them as a general escape hatch; document the specific basis relied upon for each activity.

For individuals under 18, verifiable consent from a parent or lawful guardian is required before processing, with further limits on tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions the government may specify. If your service might be used by minors, design age assurance and parental consent flows early. Likewise, for persons with disabilities who have lawful guardians, guardian consent applies.

Employees and other contexts

Employment contexts raise particular questions. The Act includes legitimate uses connected to employment, but these are limited, so map employee data processing carefully and document the basis for each activity rather than assuming consent covers everything.

Common mistakes

  • Pre-ticked boxes and silent consent.
  • One bundled consent for unrelated purposes.
  • Legalistic, hard-to-read notices.
  • No withdrawal path, or one that is harder than giving consent.
  • Failure to record consent versions.
  • Collecting more data than needed "just in case".
  • Sharing data with partners beyond the stated purposes.
  • Ignoring downstream systems after withdrawal.

A quick audit

Review your top three customer touchpoints, such as app sign-up, website forms and marketing preferences. For each, ask: Is the notice clear? Is consent granular and affirmative? Can users withdraw easily? Do we record proof? Do downstream systems honour changes? Fix the weakest first.

Get a review

F9 Infotech reviews consent flows, notices and records against DPDPA requirements and helps you design compliant, user-friendly experiences. Get our DPDPA consent and notice review. Message us.

This article is general information, not legal advice. Check the Act, rules and official guidance.