DPDP Act 2023 Section 6 Consent: Free, Specific, Informed, Unconditional and Unambiguous

Section 6 of the DPDP Act 2023 mandates that consent be "free, specific, informed, unconditional and unambiguous" with a clear affirmative action. A Data Principal actively agrees to data processing for a defined purpose. The law restricts data collection to the exact fields necessary for that specific function. A company cannot bundle broad data capture with core service delivery. Section 4 confirms that processing occurs only for a lawful purpose based on consent or specific legitimate uses.

B2B software vendors face immediate scrutiny over consent mechanisms during vendor risk assessments. Enterprise buyers reject applications that fail to log clear affirmative action. Passing investor due diligence requires an auditable trail showing the platform limits data intake at the exact point of capture. Startups need a system to record the timestamp and context when a user clicks agree. Building this tracking infrastructure internally pulls engineering resources away from product features.

Section 6(1) sets firm boundaries on obtaining agreement. Consent operates as the main basis for processing, except where Section 7 legitimate uses apply. The statute demands free agreement from the individual. A user faces no coercion or negative consequences for refusing non-essential data collection. The unconditional requirement dictates that a business cannot deny a service simply because a person refuses to share unrelated data.

The Act provides an illustration concerning a telemedicine app. A user downloads a medical application that requests access to their phone contact list. A contact list has no functional connection to remote medical consultations. The law limits valid consent exclusively to the data required for that core service. A developer violates the unconditional standard by locking the user out of the app for denying contact access.

Section 6 operates alongside the itemised notice mandate in Section 5. A Data Fiduciary provides this notice to the Data Principal before or when asking for consent. The text requires the notice to list the personal data collected and the specific processing purpose. The Draft DPDP Rules 2025 add operational weight to this requirement. Rule 4 specifies that the notice must remain separate from general terms of service. It details distinct mechanisms for users to exercise their rights under Section 6(4) and Section 13. The notice also includes instructions for filing a complaint with the Data Protection Board.

Companies cannot bury these details inside a lengthy privacy policy page. The Draft DPDP Rules 2025 mandate that the notice be concise and comprehensible. A Data Fiduciary provides the option to read the notice in English or any language specified in the Eighth Schedule to the Constitution. Engineering teams map these multi-language requirements directly into the frontend architecture.

Section 5 includes an illustration detailing a bank account opening. A user initiates a live video-based customer identification process through a banking app. The bank requests processing of personal data to comply with Know-Your-Customer laws. The bank accompanies this request with a clear notice specifying the data type and exact purpose. Software teams build user interfaces that mirror this transparency. The notice appears before or at the exact moment the app requests the data. A retroactive explanation fails the legal standard.

Section 6(4) grants the Data Principal the right to withdraw consent at any time. The process for withdrawal is required to be as easy as the process for granting it. The Data Fiduciary and its Data Processors hold a legal obligation to stop processing that personal data within a reasonable time after revocation. This generates a data orchestration challenge for product teams. A user might withdraw consent through a mobile app menu. Backend systems then propagate that signal to external marketing tools and CRM platforms. Deleting the local database entry solves only half the equation. A failure to honor a withdrawal request exposes the entity to financial penalties reaching 50 crore rupees.

Engineering managers handle specific architectural tasks to meet the standards of Section 6 and the Draft DPDP Rules 2025.

1. Review current sign-up forms and product onboarding flows to remove all pre-ticked boxes.

2. Unbundle terms of service acceptance from data privacy consent requests to match Rule 4 of the Draft DPDP Rules 2025.

3. Build an auditable backend record tracking exactly when and how a user provided clear affirmative action.

4. Map out data collection points to confirm no unnecessary data fields remain mandatory for service delivery.

5. Test consent withdrawal mechanisms to verify that opting out takes the same number of clicks as opting in.

6. Display the itemised notice prominently before the user inputs any information.

A frequent compliance failure involves reliance on passive agreement. A user scrolling past a banner or continuing to navigate a website fails the test for unambiguous clear affirmative action. Product teams often assume broad terms cover future iterations. If an early-stage company pivots to new generative artificial intelligence features, the product requires fresh consent for the distinct processing purpose. The original agreement does not roll over.

Software providers frequently ignore the verifiable audit trail. Investors examining an application expect database logs proving the exact version of the notice the user accepted. A simple database boolean flag fails to satisfy a compliance audit. A complete record captures the timestamp, the specific notice version, and the exact user action.

Managing these rules manually drains engineering teams. Hardcoding consent logic into an application consumes developer hours every time the legal text or product scope changes. A direct connection to a third-party vendor demands custom code to handle revocation signals across the tech stack. Purpose-built consent management platforms externalize this specific operational load. A dedicated solution versions the notices and logs affirmative action. It embeds into the user interface to preserve product speed. Founders access a centralized dashboard to demonstrate compliance to an auditor or enterprise procurement team. Run a gap analysis with the free DPDP website scanner at freescan.complydp.com to evaluate where existing flows miss the statutory marks.