What makes consent valid under the DPDP Act and how to design consent journeys that work for users and regulators.
Valid consent
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the specified purpose.
Withdrawal and records
Individuals must be able to withdraw consent with comparable ease. Organisations should maintain records that demonstrate when and how notice was given and consent was obtained.
Consent Managers
The Act introduces registered Consent Managers — entities that allow individuals to give, manage, review and withdraw consent through an accessible and interoperable platform.
This article provides general information and does not constitute legal advice.