DPDP Act Section 6 Explained: Unbundling Consent for D2C Startups

Section 6 of the Digital Personal Data Protection Act 2023 prohibits bundled opt-ins and forces D2C startups to restructure how they collect user information. The statute requires consent to be free, specific, informed, unconditional, and unambiguous. E-commerce brands can no longer hide marketing email subscriptions inside general terms of service during checkout. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. A pre-checked box at the bottom of a payment screen no longer constitutes legal consent. Founders need to treat this as a strict engineering requirement rather than a vague legal guideline.

Section 6(10) places the entire burden of proof on the Data Fiduciary to demonstrate valid notice and consent during any proceeding. If a user complains about receiving unsolicited marketing emails, the company must produce the exact timestamp and notice version that user accepted. This shifts the compliance burden from a theoretical legal exercise to a concrete data engineering problem. Startups cannot simply update their privacy policy and claim compliance. They require back-end systems capable of storing individual consent receipts for every active customer.

Section 6(1) states that a Data Principal must signal agreement via clear affirmative action. This agreement remains limited strictly to the personal data necessary for a specified purpose. The Act provides a direct illustration to clarify this boundary. If a user downloads an app for a specific service, the app cannot force access to an unrelated mobile phone contact list. Section 6(4) introduces a strict withdrawal standard. A user must possess the ability to withdraw consent with the exact same ease they provided it. If a user opted into promotional SMS messages via a single click during account creation, they need a single click in their account settings to opt out.

Sections 6(7) through 6(9) create a new ecosystem of Consent Managers. These entities register directly with the Data Protection Board. A Consent Manager acts on behalf of the Data Principal, allowing individuals to manage, review, and withdraw consent across multiple platforms from a centralized dashboard. E-commerce platforms will eventually need API integrations to accept consent signals directly from these managers. This interoperability requirement forces technical teams to standardize how they classify and store user permissions.

This legislation binds every Seed to Series B startup acting as a Data Fiduciary processing digital personal data within India. It also covers processing outside India connected to offering goods or services to Data Principals in India. Startup founders seeking their next funding round face immediate investor due diligence on these specific workflows. E-commerce CMOs can no longer rely on pre-checked boxes to build subscriber lists to hit monthly revenue targets. Investors actively look for Section 6 compliance in security questionnaires to measure enterprise readiness and regulatory risk. An inability to prove consent provenance often blocks enterprise deals entirely.

1. Unbundle the user checkout flow. Separate the shipping address collection from promotional email opt-ins at the payment stage. You cannot make a user agree to receive daily promotional offers just to complete a purchase. The Product Manager owns this workflow redesign and documents the new user journey. The evidence artifact is a screen recording of the decoupled checkout flow stored in the compliance repository.

2. Localize the consent notice. Rule 3 of the DPDP Rules 2025 requires itemised notices available in English and the 22 regional languages listed in the Eighth Schedule. Relying on a single English privacy policy fails a compliance audit. The CTO owns the implementation of translation APIs or static localized notices that match the user browser preferences. The evidence artifact is a translated notice repository and database logs recording the specific language selection of each user.

3. Build a one-click withdrawal mechanism. Section 6(4) forbids making users call a support line or write an email to stop marketing messages if they joined via a single click. Forcing a user through a dark pattern to unsubscribe violates the Act. The Engineering Lead owns the integration of a simple withdrawal feature directly into the user account settings. The evidence artifact is the live user dashboard code showing an accessible, working opt-out toggle.

4. Maintain an immutable audit trail. Section 6(10) demands hard proof of valid consent if the Data Protection Board initiates an inquiry. Storing a simple boolean value in a database column falls short of this requirement. The DPO or compliance lead owns the dedicated data retention architecture. The evidence artifact is a secure system log showing the exact timestamp, the specific notice version presented, and the affirmative action taken per user.

Failing to fulfill obligations related to valid consent exposes the Data Fiduciary to severe financial risk and deal-blocking scrutiny. The Schedule to the Act sets a penalty ceiling of up to 50 crore rupees for breaching general duties under the Act. The Data Protection Board weighs aggravating factors when calculating specific fines. Repeating forced-consent tactics during a high-volume festive sale draws heavier penalties than an isolated technical glitch. Beyond regulatory fines, an active non-compliance finding during a security audit stalls investor due diligence indefinitely.

Section 6 ties directly to Section 5. Section 5 mandates that an itemised notice must accompany or precede every consent request. The rules limit data retention under Section 8, forcing complete erasure once a user withdraws consent or the specified purpose ends. The framework also interfaces with Section 9, requiring verifiable parental consent before processing any personal data belonging to a child. Rule 3 mechanics govern the itemised notice delivery, while breach rules mandate notifying the Data Protection Board within 72 hours if consent records are compromised.

Exactly 220 days remain until the DPDP hard compliance deadline of 13 May 2027. Re-engineering a D2C checkout flow requires dedicated engineering sprints, extensive quality assurance, and an overhaul of marketing automation platforms. Delaying this shift threatens your runway by holding up enterprise deals and Series B funding rounds. Standard banking compliance tools are too heavy for fast e-commerce teams. You need mechanisms that decouple shipping data from marketing lists and automatically translate notices into regional languages for Tier-2 consumers. Evaluate whether your current setup satisfies Section 6 obligations with a gap scan at https://www.complydp.com/audit-preview.