DPDP Consent & Notice Architecture Guide

The Five Statutory Pillars of Section 6(1)

Under Section 6(1), consent given by the Data Principal must satisfy five cumulative statutory criteria:

• Free: Given without coercion or undue influence. Access to essential goods or services cannot be denied merely because the user refuses non-essential data collection.
• Specific: Tied directly and exclusively to each specified purpose. Bundling marketing, telemetry, and service provision into one consent prompt is strictly prohibited.
• Informed: Preceded by an itemized, clear notice in accordance with Section 5 and Rule 3.
• Unconditional: Not made a condition precedent for contract performance unless strictly necessary for that transaction.
• Unambiguous: Evidenced by a clear affirmative action. Silence, inactivity, or pre-ticked checkboxes do not constitute valid consent.

Ease of Withdrawal: Section 6(4)

Section 6(4) establishes that the Data Principal has the right to withdraw consent at any time. Crucially:

"The ease of such withdrawal shall be comparable to the ease with which such consent was given."

If consent was obtained through a 1-click toggle on a mobile app, the user cannot be required to call customer care, send an email, or navigate a multi-step labyrinth to revoke consent. Upon withdrawal, processing must stop and cascade erasure must trigger across all sub-processors.

Section 6(10): The Burden of Proof Rests on You

Section 6(10) explicitly codifies: "Where a question arises in any proceeding whether the consent was given... the burden of proving that consent was given shall be on the Data Fiduciary." To satisfy this burden, organizations must maintain immutable, timestamped cryptographic proof records (such as SHA-256 hash chains) for every consent event.