DPDP.ai Resource guide | 2026 edition A PRACTICAL GUIDE FOR DATA FIDUCIARIES DPDP consent management explained Everything you need to know about asking for consent, keeping proof of it, and respecting a person's choices under India's Digital Personal Data Protection Act. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 2 CONTENTS What's inside CHAPTER 01 Welcome: why this guide exists What'sinside . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Welcome: why this guide exists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Why consent matters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Key terms in plain words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 What makes consent valid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 The notice: what to tell people first . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Where consent is collected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Designing a good consent request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 The consent lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Recording consent: building proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Withdrawal and preference management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Children and persons with disabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Consent Managers and consent management platforms . . . . . . . . . . . . . . . . . . . . . 13 A step-by-step roadmap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 A practical self-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Frequently asked questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Key takeaways . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Every time someone signs up, downloads an app or fills in a form, they hand over a little piece of themselves. Consent is how they say, "Yes, you may use this, for this reason." India's Digital Personal Data Protection Act, 2023 (the DPDP Act) puts that simple idea at the centre of how organisations handle personal data. The Digital Personal Data Protection Rules, 2025 add the practical detail on how it should work day to day. Together they ask organisations to be honest about DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 3 Think about handing your house keys to a neighbour. You would say who may enter, when, and for what. You would also expect them to give the keys back when you ask. Personal data works the same way: people lend it to organisations for a specific reason, and they expect control over it. Three reasons consent deserves careful attention It is the law. For most uses of personal data, the DPDP Act requires valid consent. Organisations that fall short can face financial penalties that, for the most serious failures, run up to INR 250 crore. It builds trust. People are more willing to share information with organisations that explain clearly and respect their choices. Clear consent requests often lead to better, more engaged customers. It reduces risk. Good records protect an organisation when questions come up. Under the Act, the burden of showing that notice was given and consent was obtained rests with the organisation collecting the data. Weak consent practices tend to show up in familiar ways: pre-ticked boxes, long and confusing policies, bundled permissions, missing records, and withdrawal buttons that are hard to find. Each one makes it harder to prove that a person truly agreed, and each one can erode trust when customers notice. what they collect, to ask clearly, to respect the answer, and to be able to show their work. That sounds easy. In practice, it touches many teams: legal, product, engineering, marketing, customer support and security. This guide breaks the topic down in plain language so that all of them can follow it. Throughout the guide you will see the phrase DPDP consent management platform . It simply means the software and processes an organisation uses to collect consent, record it, and keep it up to date over time. You can run consent management with spreadsheets and manual steps, but as the number of people, channels and purposes grows, most teams move to a dedicated platform. • • A quick note Who this guide is for Founders,product managers, compliance and privacy officers, developers, marketers, and anyone who has been asked, "Are we collecting consent properly?" No legal background is needed. Thisguide is for general understanding and is not legal advice. The law and its timelines are phased and may be updated, so please check the official notifications and speak to a qualified professional for your own situation. CHAPTER 02 Why consent matters Consent is more than a check box. It is the moment a relationship starts between a person and an organisation. The cost of getting it wrong • DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 4 Notice Consent Purpose Data Principal Term Personal data Data Fiduciary Data Processor Nobody is sure which version of the policy a person agreed to Withdrawal requests get lost between teams Audits mean weeks of digging Without good consent management Consent lives in scattered databases and emails What it means Any data about an individual who can be identified by or in relation to that data. The person the personal data is about. For a child or a person with a disability, this includes the parent or lawful guardian. The organisation that decides why and how personal data is processed. A company that processes data on behalf of a Data Fiduciary. A free, specific, informed, unconditional and unambiguous indication, given by a clear affirmative action, that the person agrees to the processing of their data for a stated purpose. The information a Data Fiduciary must give before or when asking for consent. The specific reason data is being used. Everyday example A name, phone number, email address, location or account ID. A customer who signs up to a shopping app. A short screen listing what data is collected and why. "To deliver your order" or "to send you offers by email". With good consent management Consent is recorded in one consistent, searchable place Every record links to the exact notice version shown Withdrawals flow to every connected system quickly Evidence can be exported when it is requested Consent is not a one-time event. It is a living record that can change whenever the person changes their mind. The shopping company that runs the app. A cloud provider or an email-sending service. Tapping "I agree" next to a clear explanation of why an address is needed for delivery. Remember CHAPTER 03 Key terms in plain words The DPDP Act uses a few special words. Once you know them, the rest becomes much easier to follow. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 5 Quality Free Specific Informed Unconditional Unambiguous Data Protection Board Clear affirmative action Term Consent Manager The person understands what they are agreeing to. It is not bundled with things the person does not need to agree to. There is no doubt that the person agreed. The person actively does something to agree. In plain words The person has a real choice and is not pressured or tricked. It is tied to a clearly stated purpose. What it means A registered entity that lets a Data Principal give, manage, review and withdraw consent through one accessible platform. The body set up under the Act to look into complaints and breaches and to decide on penalties. Everyday example A neutral service where a person can see and control permissions across many organisations. The authority that can ask an organisation to show its consent records. The Act uses "Consent Manager" for a specific, registered kind of entity that works on behalf of the person. A "DPDP consent management platform" is the tooling that a Data Fiduciary uses inside its own organisation. Chapter 12 explains the difference. What it looks like Saying no does not cause unrelated services to be withheld. A separate choice for "order updates" and "marketing offers". A notice in simple language shown at the moment of the request. No "accept everything or leave" screens for optional uses. A clear label such as "Yes, send me offers". Ticking an empty box or tapping a button. Silence or pre-ticked boxes do not count. Two names, two ideas CHAPTER 04 What makes consent valid The Act describes the qualities that valid consent must have. Here they are in simple terms. Limited to what is necessary Consent only covers the personal data that is needed for the stated purpose. If a flashlight app asks for your contacts, that data is not necessary for the purpose, so consent for it would not hold up. A good habit is to ask: "If we removed this field, could we still deliver the service?" If yes, the field is probably optional or should not be collected at all. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 6 A short example Writing tips that work • What a good notice contains Consent can be given for a purpose, but the person may take it back What data is being collected, described itemised and in simple words. Why it is being collected, meaning the specific purpose or purposes. How to exercise rights , including how to withdraw consent and how to make a request. How to complain to the Data Protection Board of India. Who to contact , such as the contact details of a Data Protection Officer or another person who can answer questions. The Act says that a person can withdraw consent at any time,and that withdrawing must be as easy as giving it. If it took one tap to say yes, it should not take five screens and an email to say no. Chapter 10 returns to this in detail. Under the Act, a request for consent must come with, or be preceded by, a notice. The notice should be written in clear and plain language, and it should be available in English or any of the 22 languages listed in the Eighth Schedule to the Constitution of India. People should be able to choose the language they are most comfortable with. Use short sentences and everyday words. Replace "ancillary processing activities" with "other things we do with your data". Use headings and bullets so that people can scan. Show the notice on the same screen, or one tap away from the consent choice, not buried in a footer. Keep one notice per purpose family, and keep the older versions on file. • • • • • • • • A handy test Not everything needs consent Section 7 oftheActlists certain legitimate uses where data can be processed without asking, such as meeting a legal obligation, responding to a medical emergency, or when a person voluntarily shares data for a purpose they have not objected to. Document which basis applies to each purpose. Imagine showing your consent screen to a friend who has never heard of your product. Would they understand what they are agreeing to in under 30 seconds? If not, simplify. CHAPTER 05 The notice: what to tell people first Consent only counts when people know what they are saying yes to.That is the job of the notice. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 7 Channel Website Mobile app Partner or agent journeys Messaging (SMS, WhatsApp, email) Branch or in person Call centre or phone How consent is usually collected Banner, sign-up form or checkout checkbox. Onboarding screen or in-app prompt, using the app's own consent screens. The agent reads a short script and records a clear yes. Paper or tablet form with a signature or digital tap. Consent collected through a partner's app, link or API. A link to a consent page, or a reply keyword. When the notice changes, give it a new version number. A consent record should always point to the exact notice the person saw. Things to watch Show choices before non-essential tracking starts. Avoid pre-ticked boxes. Keep the choice consistent across devices and app versions. Record the date, time, script version and agent reference. Digitise quickly so that the record is searchable. Define who records it, and make sure the record reaches you. Record the exact wording of the message and the response. Example notice (short form) We collect: your name, phone number and delivery address. We use them to: deliver your order and send delivery updates. You can: change or withdraw your choices at any time from Settings, Privacy. Questions or complaints: write to our Data Protection Officer, or approach the Data Protection Board of India. Keep versions CHAPTER 06 Where consent is collected Customers meet organisations in many places.Consent should work in all of them, not just on the website. Language matters One person, many channels India has 22 scheduled languages. A person who reads Tamil comfortably should not have to decode an English-only banner. Offering the consent request and notice in the language the person prefers is A customer might accept marketing emails on your website, then call the helpline and ask to stop. If those two channels do not talk to each other, you may send the next email by mistake. This is why many organisations aim to keep a single, central view of each person's consent status and push updates to all connected tools quickly. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 8 one of the simplest ways to make consent genuinely informed. Avoid guilt-tripping language such as "No, I don't want to save money". Avoid repeatedly asking after someone has declined. Wait for a genuine reason, such as a new purpose. Test with real users and ask what they think they just agreed to. • • • Consistency check Before (unclear) "By continuing, you agree to our terms and to receive communications from us and our partners." Make "Accept" and "Decline" equally easy to find and similar in size. Leave optional boxes empty by default. Explain the benefit and the reason in one line. Show a link to the full notice and the withdrawal option. Let the person continue using the core service if they say no to optional uses. Do Ask for each purpose separately, with plain labels. Pre-ticked boxes or silence treated as a yes. Long legal paragraphs that nobody reads. Hiding the policy behind several clicks. Pick any three channels and compare the wording and the choices they show. If they differ in ways the customer would not expect, align them. Avoid Bundling several purposes into one "I agree to everything" button. Hiding the decline option, or making it grey and tiny. After (clear) "Send me order updates by SMS." (required for delivery) "Send me offers by email." (optional, you can change this any time) Blocking the whole service because someone refused marketing. CHAPTER 07 Designing a good consent request A well-designed request is short, honest and easy to act on. Before and after Make it respectful DPDP.ai The cycle repeats whenever the purpose, the notice or the person's choice changes DPDP consent management explained A simple guide to collecting and recording consent Page 9 Tip Draw your own version of this cycle for each of your major products. You will quickly spot where information gets stuck. Design for everyone Keept ext readable, usesufficient colour contrast, and make sure screen readers can announce each choice. Accessible design is good consent design. CHAPTER 08 The consent lifecycle Consent has a beginning, a middle and,sometimes, an end. Seeing it as a cycle helps teams plan. 1 Tell 2 Ask Get aclear yes 3 Record 4 Use 5 Update Change or withdraw 6 Review Renew when needed Share the notice Keep the proof Only as agreed The "use" stage is where many problems hide. Having a consent record is helpful, but it only protects you when downstream systems actually follow it. A marketing tool that ignores the consent flag defeats the entire exercise. That is why connecting consent status to the tools that use the data matters as much as collecting it. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 10 CHAPTER 09 Recording consent: building proof Collecting a yes is only half of the job. You also need to be able to show it later. Keep records tamper-evident. Use append-only logs or integrity checks so that records cannot be quietly changed. Keep history, not just the latest status. If someone said yes, then no, then yes, all three events are useful. Minimise personal data inside the record. A reference or token is often enough, which keeps the consent log itself low-risk. Make records easy to find and export. If a regulator asks, you should be able to produce evidence quickly in a readable format. Decide on retention. Keep records for as long as you need to demonstrate compliance, and follow the retention rules that apply to you. Ask your legal adviser for the right period. The Act places the burden of proof on the Data Fiduciary. If a person or the Data Protection Board asks, you should be able to show that you gave the notice and that the person agreed. A good consent record answers five simple questions: who, what, when, where and which version What a consent record usually contains Good storage habits • Method Field Person reference Purpose Decision Timestamp Notice version Channel and language Why it matters Links the record to the right individual without exposing their details. Shows exactly what the person agreed to. Granted, declined or withdrawn. Proves when the choice was made. Shows which wording the person saw. Shows where and in what language the request was shown. Describes the action taken. Example Token such as U-A9F2 Ticked box on sign-up form Order updates; email offers Granted 2026-06-12 09:41 IST Privacy notice v2.3 Web, Tamil If someone gave you only your consent log, could they work out who agreed to what, when, and under which notice? If yes, your record is in good shape. • • • • Think like an auditor DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 11 CHAPTER 10 Withdrawal and preference management People change their minds, and the law expects you to make that easy. A list of purposes with on and off switches, in plain language. The ability to see what they agreed to and when. A way to withdraw all optional consents at once. A simple link to raise requests such as access, correction or erasure. A choice of language. Withdrawal does not make earlier processing unlawful. What was done properly, before the person withdrew, remains valid. But from the moment of withdrawal, processing for that purpose should stop. Section 6 of the Act says that a Data Principal can withdraw consent at any time, and that the ease of withdrawing should be comparable to the ease of giving consent. Practically, that means a visible, simple route, such as a Privacy or Preferences page that people can reach in a couple of taps. What a preference centre should offer What should happen after someone withdraws • • • • • Make it symmetrical Confirm Step Record it Stop processing Tell your processors Erase unless required If you can give consent in one tap, offer one-tap withdrawal. If you can give consent by phone, allow withdrawal by phone. What to do Log the withdrawal with the time, purpose and channel, just like the original consent. Stop using the data for the withdrawn purpose within a reasonable time. Pass the change to the partners and tools that handle the data on your behalf. Delete the data unless the law requires you to keep it, and let the person know what is retained and why. Let the person know the change has been made. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 12 CHAPTER 11 Children and persons with disabilities Some people cannot or should not give consent alone. The Act has extra safeguards for them. The Act treats anyone under 18 as a child. Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. The same applies to a person with a disability who has a lawful guardian. What this means in practice Find out if the user is a child. This can be done through age declaration, age bands or other reasonable checks, depending on your service and risk. Get verifiable parental or guardian consent. The Rules explain how a guardian's identity and age can be checked, for example through reliable details that are already available or through a digital token linked to a verified identity. Avoid harmful processing. The Act prohibits processing that is likely to cause detrimental effects on a child's well-being. It also prohibits tracking, behavioural monitoring and targeted advertising directed at children. Know the exemptions. The Rules provide for certain classes of organisations and purposes, such as some healthcare, education and safety uses, with conditions. Check whether any apply to you. • A practical flow for guardian consent • • • Who is affected most? 5 Step 1 2 3 4 Education platforms, gaming, social, entertainment, family and health services. If your audience could include young people, plan for this early. What happens The user indicates their age or date of birth. If the user is under 18, the service asks for a parent or guardian's contact. The guardian receives a clear notice and verifies who they are. The guardian gives or declines consent, and the choice is recorded with the same detail as any other consent. The guardian can review and withdraw consent from a simple page. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 13 CHAPTER 12 Consent Managers and consent management platforms The words sound alike, but they describe different things. Here is the difference. Main job What it is Accountabilit y Who it serves Consent records Preference centre Synchronisation Capability Consent collection Policy and notice versions Request handling Reporting Consent Manager (as defined in the Act) A separate entity registered with the Data Protection Board. The Data Principal, who uses it to give, manage, review and withdraw consent. Offer the person one accessible, transparent place to control their consents across organisations. Acts on behalf of the Data Principal and is accountable to them. In plain words Shows notices and choices across web, mobile, call centres and partner journeys, in several languages. Creates timestamped, versioned and tamper-evident proof for each choice. Lets people view, change and withdraw their choices. Pushes updates to CRMs, marketing tools and data warehouses via APIs and webhooks. Tracks changes and triggers fresh consent when needed. Connects with rights requests such as access, correction and erasure. Shows opt-in rates, trends and exports evidence for audits. Supports the Data Fiduciary's own legal duties. DPDP consent management platform Software and processes used by a Data Fiduciary. The organisation, which uses it to collect, record and honour consent. Run consent journeys, keep proof, sync choices into internal systems. The Rules set out how Consent Managers register and operate. They also come into force on a phased timeline. For Data Fiduciaries, the sensible approach is to build consent management that works on its own and is ready to connect with registered Consent Managers when they become part of your ecosystem. What a DPDP consent management platform typically does DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 14 CHAPTER 13 A step-by-step roadmap You do not have to solve everything in one go. This sequence works for most teams. 1 2 3 4 5 6 7 8 9 10 If time is short, begin with your highest-volume journey, usually the website or app sign-up. Get that right, then repeat the pattern elsewhere. Map your data List what personal data you collect, where it comes from, why you use it and who receives it. A simple spreadsheet is a fine start. Group your purposes Turn that list into a small set of clear purposes, such as "deliver orders", "customer support" and "email offers". Decide the basis for each purpose Mark which purposes need consent, which rely on a legitimate use, and which you can drop. Write your notices Create short, plain-language notices for each journey, in the languages your users prefer. Design the consent journey Draft the screens, scripts and forms for every channel. Test them with real users. Set up recording Decide the fields, the storage and the retention for consent records, and who can access them. Connect your systems Make sure your CRM, marketing tools, analytics and data stores read and respect consent status. Plan for withdrawal and requests Build the preference centre and define who handles requests and how fast. Train your teams Give support, sales, marketing and engineering a short, practical briefing. Review regularly Check records, update notices when purposes change, and run a short audit every quarter. Start small DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 15 CHAPTER 14 A practical self-check Use this list to see where you stand. Tick what you already do, and note what is left. ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ We know what personal data we collect and why. Each purpose is described in plain language. We know which purposes rely on consent and which on another basis. Our notices are short, clear and available in the languages our users prefer. Our consent requests are separate for each purpose. Optional boxes are not pre-ticked. Declining optional uses does not block the main service. Every consent creates a timestamped, versioned record. We can show which notice version each person saw. Records are protected against quiet changes. People can view and change their choices in one place. Withdrawing is as easy as giving consent. Withdrawals reach our connected systems promptly. We have a process for children's and guardian consent. We know where to send questions and complaints, and who answers them. We can export consent evidence quickly. Teams that use data have been briefed. We review our consent setup at least once a quarter. Ticked 15 or more: your foundations are strong, so focus on automation and testing. Ticked 8 to 14: you have a solid start, so tackle recording and withdrawal next. Fewer than 8: begin with the roadmap in Chapter 13. How did you do? DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 16 CHAPTER 15 Frequently asked questions When does all this apply? The Rules phase in different obligations over time. Check the official notifications for the dates that apply to you, and begin preparing early, because systems and habits take time to change. Is a cookie banner enough? A banner covers only one touchpoint. Consent management also covers apps, forms, calls and partners, plus recording and withdrawal. Cookie choices are one important part of the bigger picture. Can we reuse consent collected before the Act came into force? The Act contains transition provisions for consent given earlier. In general, organisations are expected to give affected people a notice and an easy way to withdraw. Check the current provisions or ask your adviser. How long should consent records be kept? Keep them for as long as you need to show that you acted lawfully, and follow any retention rules that apply to your sector. Ask your legal adviser to set a period. What if a person withdraws consent for one purpose but not another? Handle each purpose separately. Stop the withdrawn purpose and continue the others as agreed. Do we have to store personal data in the consent record? Not necessarily. Many organisations store a reference to the person instead of full details, which keeps the log itself low-risk and easier to share. Does consent have to be in English? No. The notice and request should be available in English or any language in the Eighth Schedule. Offering the language the person prefers is best practice. Do we need consent for every use of personal data? No. Consent is the main basis, but the Act also lists certain legitimate uses, such as complying with the law or responding to medical emergencies. Document which basis applies to each purpose. DPDP.ai DPDP consent management explained A simple guide to collecting and recording consent Page 17 CHAPTER 16 Key takeaways If you remember only a handful of things from this guide, make them these. • • • • • • Final thought Ask clearly. Short notices, plain words, separate choices, no pre-ticked boxes. Record carefully. Who, what, when, where and which notice version, stored safely and easy to produce. Respect changes. Withdrawal should be as easy as giving consent, and every connected system should follow it. Protect children. Under-18 users need verifiable guardian consent and extra care. Keep it alive. Review your purposes, notices and records regularly. Use the right tools. A DPDP consent management platform can bring collection, records and withdrawals into one place, which helps when volumes and channels grow. Good consent management is not about ticking a legal box. It is about showing people that their choices matter, and that your organisation can be trusted with their information. Disclaimer Thisguideis provided for general information and education only. It is not legal advice and does not create a lawyer-client relationship. The DPDP Act, 2023 and the DPDP Rules, 2025 are subject to phased implementation, amendments and official clarification. Please consult the official text and a qualified legal professional before making compliance decisions.