Section 6 — Consent

What this section requires

Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action — an active opt-in, never inferred from silence or a pre-ticked box — and it must be limited to the personal data actually necessary for the stated purpose.

Any part of a consent that would itself infringe the Act, the Rules, or any other law is invalid to that extent — a Data Principal cannot validly consent away a statutory right, such as her right to complain to the Board.

Every consent request must be in clear, plain language, offered in English or an Eighth Schedule language, and must give the contact details of a Data Protection Officer (where one applies) or another authorised contact person.

Withdrawal must be at least as easy as giving consent was. Withdrawal doesn't undo the legality of processing that already happened on that consent, but it does mean the Data Fiduciary — and any Data Processor acting for it — must stop processing within a reasonable time, unless another lawful basis independently permits continuing.

Consent can be given, managed, reviewed, or withdrawn through a Consent Manager, who is accountable to the Data Principal. In any dispute, the burden of proving valid notice and consent sits with the Data Fiduciary, not the Data Principal.

Who it applies to

Every Data Fiduciary that relies on Data Principal consent — Section 4(a) — as its ground for processing.

Checklist

• Free — no coercion or undue influence built into the request.
• Specific — tied to the purpose actually stated, not a broader one.
• Informed — clear, plain language on what and why.
• Unconditional — consent to one purpose isn't bundled with another.
• Unambiguous — a deliberate signal, never inferred from inaction.
• Affirmative action — an active opt-in step, never a pre-ticked box.
• Make withdrawal as easy as giving consent — same number of steps, same channel.
• Publish the contact details of a Data Protection Officer or authorised contact person alongside every consent request.
• Keep records capable of proving, if challenged, that notice was given and consent was obtained validly — Section 6(10) puts that burden on you.

Penalty exposure

No Schedule item names Section 6 directly, so a defective consent mechanism falls under the residual item 7 — "breach of any other provision of this Act or the rules made thereunder" — up to ₹50 crore. Failing to prove valid consent when challenged doesn't carry a separate penalty, but it removes the lawful ground for the underlying processing, exposing that processing itself.

Implementation timeline

Sub-sections (1) to (8) and (10) — the substance of the consent rule — commence 13 May 2027, together with the rest of Chapter II.

Sub-section (9) — the requirement that every Consent Manager be registered with the Board — is on its own, later clock: it commences 13 November 2026.