Consent only counts if the notice did its job first.

• Free. No pressure, and not tied to something unrelated.
• Specific. Given for a named purpose, not for 'business use' in general.
• Informed. Given after a notice the person could understand.
• Unconditional. Not a toll charged for a service that does not need the data.
• Unambiguous, by clear action. A tick, a tap or a signed statement. Silence and boxes ticked in advance show no action by the person.
• Limited to necessary data. Consent reaches only the data the purpose needs; the rest falls away.

Two more rules sit beside the six. Any part of a consent that breaks the Act or another law is invalid to that extent, so a clause waiving the right to complain to the Board binds no one. And if consent is disputed before the Board, the fiduciary must prove both the notice and the consent.

Stands on its own

Readable without opening your terms, policy or anything else.

Itemised data

A list of the personal data items, not a phrase like 'information you provide'.

Purposes and what they enable

Each purpose, with a specific description of the goods, services or uses it makes possible.

How to withdraw

A link to your website or app, any other means, and withdrawal as easy as consenting.

How to use rights

The route for access, correction, erasure, grievance and nomination.

How to complain to the Board

That she can complain to the Board, and how.

The notice must come with or before the request for consent. A notice shown after the tap cannot inform a choice already made.

• Both the notice and the consent request must be available in English or in any language listed in the Eighth Schedule to the Constitution, at the person's option.
• The option has to be real: a working language choice, not a promise to translate on request.
• The consent request must give contact details for the Data Protection Officer, where there is one, or another person authorised to respond on rights.
• Use clear and plain language throughout. Rule 3 asks for a fair account, not a legal summary.

1. Put withdrawal where consent was given. One tap to agree and an emailed letter to withdraw is not comparable ease.
2. Say what withdrawal will change. The consequences are hers to bear, and processing done before withdrawal stays lawful.
3. Stop processing within a reasonable time and make your processors stop, unless the Act or another law requires or permits it to continue.
4. Erase data held only on that consent, unless a law requires you to keep it.
5. Log the withdrawal against the original consent record, so you can prove both.

The Act's own example: a shopper who withdraws consent can be stopped from placing new orders, but an order already paid for still has to be delivered.

Where a person consented before the Act's notice provisions took effect, section 5(2) asks for a notice as soon as reasonably practicable. It covers the data and purposes, how to withdraw and use rights, and how to complain to the Board. Processing may continue until she withdraws. Email, an in-app message or another effective channel will do. Expect some people to withdraw once they are told they can, and make sure the systems behind the notice can act on it.

• Consent folded into the terms. Agreeing to terms of service is not a specific, informed choice about each purpose.
• Consent where a legitimate use fits. Asking for consent you do not need creates a withdrawal you cannot honour.
• A notice that is only a link. Rule 3 wants a notice that stands on its own, not a pointer to the privacy policy.
• Withdrawal harder than sign-up. Buried settings and support tickets fail the comparable-ease test.
• No consent log. Without per-person, per-purpose records, nothing can be proved.
• Processors left running. Withdrawal must reach every vendor processing on that consent.
• Asking for more than the purpose needs. Consent to unnecessary data does not hold for that data.

Sources: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), sections 4 to 7; the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), rules 1 and 3.