Module 3 of 9Section 68 min including the detail
Consent, and its whole lifecycle
Consent under this Act is not a checkbox you collect once. It is a state you have to be able to prove, narrow, and dismantle on request.
Five adjectives, each of which rules something out
Free, specific, informed, unconditional, unambiguous. Each word bans a practice you have almost certainly seen this week.
What each word bans
- Freemaking an unrelated service conditional on it
- Specificbundling several purposes into one tick
- Informedconsent on top of a notice that was not adequate
- Unconditionalburying it in terms of service
- Clear affirmative actionpre-ticked boxes, silence, or just carrying on using the site
The detail, if you want it
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Each word excludes a common practice. Free excludes making an unrelated service conditional on it. Specific excludes bundling several purposes into one tick. Informed depends on the notice being adequate, which links section 6 to section 5. Unconditional excludes burying it in terms of service. And a clear affirmative action excludes a pre-ticked box, silence, and continued use of a site.
Consent is also limited by necessity. It is valid only for the personal data necessary for the specified purpose. Consent to more than you need is not consent to the excess, even if the person ticked it.
Withdrawal must be as easy as giving it
If consent took one tap, withdrawal cannot take a support ticket. This is the most common gap in an otherwise good implementation.
What usually gets built
- One tap to agree
- Email support to withdraw
- Identity check by reply
- Up to five working days
What the Act asks for
- One tap to agree
- One tap to withdraw
- Comparable effort, both directions
- Processing stops in reasonable time
The detail, if you want it
A person may withdraw consent at any time, and the ease of withdrawing must be comparable to the ease of giving. If consent took one tap, withdrawal cannot take a support ticket and three working days. This is the single most common gap in an otherwise good consent implementation, because the giving path is built by a product team with a target and the withdrawal path is built by nobody.
Two consequences follow. The person bears the consequences of withdrawing, meaning a service may legitimately stop working. And withdrawal does not make past processing unlawful. What it does require is that you stop, within a reasonable time, and that erasure follows unless a law requires you to keep the data.
Consent Managers, and what they do not do
A Consent Manager changes the plumbing of consent. It never moves the duty, which stays with you.
The detail, if you want it
The Act creates the Consent Manager: an entity registered with the Board through which a person can give, manage, review and withdraw consent, and which is accountable to the Data Principal rather than to you.
Using one does not transfer your obligations. You remain the Data Fiduciary, responsible for compliance including where a Processor acts for you. A Consent Manager changes the plumbing of consent, not its ownership.
The three things to remember
- Free, specific, informed, unconditional, unambiguous, by clear affirmative action. Each word rules out a common practice.
- Withdrawal must be as easy as giving. One tap in cannot mean a support ticket out.
- A Consent Manager changes the plumbing of consent, never the ownership of the duty.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A consent record per person per purpose, with a timestamp and the exact notice version they saw.
- A withdrawal route reachable in the same number of steps as the consent route, tested end to end.
- Evidence that withdrawal actually stops downstream processing, including in systems that received a copy.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.