Why obtaining consent and obtaining valid consent are two entirely different legal propositions.
For years, privacy compliance in India largely revolved around documentation. Businesses published privacy policies, embedded them within lengthy terms of service and assumed that a user's acceptance of those documents sufficiently authorised the processing of personal data. The Digital Personal Data Protection Act, 2023 ("DPDPA") fundamentally departs from that approach. The focus is no longer on whether a privacy policy exists, but whether a Data Principal has provided valid consent to a clearly defined processing activity. This distinction has profound legal consequences. A single checkbox accepting a Privacy Policy, Terms of Service and various ancillary processing activities may appear operationally convenient, yet it often fails to satisfy the statutory standards prescribed under the DPDPA. As the Draft Digital Personal Data Protection Rules, 2025 move towards implementation, consent mechanisms that have historically been accepted across Indian digital platforms are likely to attract significantly greater regulatory scrutiny.
For most commercial organisations, consent constitutes the primary legal basis for processing personal data. Under Section 4 of the DPDPA, a Data Fiduciary may process personal data only for a lawful purpose and only where valid consent has been obtained or where processing falls within one of the legitimate uses recognised under Section 7. The statutory requirements become clearer when Sections 5 and 6 are read together. Before seeking consent, a Data Fiduciary must provide a notice identifying the categories of personal data being collected, the purpose of processing, the rights available to the Data Principal and the applicable grievance redressal mechanism. Consent itself must be free, specific, informed, unconditional and unambiguous, expressed through a clear affirmative action and capable of being withdrawn with the same ease with which it was granted. Against this legislative framework, a review of contemporary digital products reveals a number of recurring compliance deficiencies which are discussed below in this article.
A Practical Compliance Audit:
1. Bundled Consent for Multiple Processing Activities
Many digital platforms continue to obtain consent through a single acceptance that simultaneously authorises the Terms of Service, Privacy Policy, marketing communications, analytics, profiling and third-party data sharing. While operationally convenient, such mechanisms struggle to satisfy the DPDPA's requirement that consent be specific and unconditional.
A user's willingness to access a particular service cannot automatically extend to unrelated processing activities. Optional purposes, particularly direct marketing and data sharing, should therefore be presented separately, allowing individuals to make independent choices without affecting access to the core service.
2. Consent by Default Rather Than by Choice
Another persistent practice is the use of pre-selected consent options. Marketing preferences, analytics permissions and similar settings are frequently enabled by default, requiring users to opt out rather than opt in.
Section 6 adopts the opposite principle. Consent must result from a clear affirmative action, meaning it should arise from a deliberate decision taken by the individual rather than from silence, inactivity or default configurations. The Draft DPDP Rules reinforce this position by emphasising transparent notice and active user participation. Businesses should therefore replace implied consent mechanisms with genuine opt-in models.
3. Privacy Notices That Inform Very Little
Compliance frequently fails not because organisations omit privacy notices but because those notices fail to communicate meaningful information. Lengthy policies drafted exclusively in technical or legal language rarely enable users to understand what personal data is being collected or why it is required.
Section 5 requires notice that is genuinely informative. Accordingly, organisations should adopt layered notices consisting of concise, plain-language explanations presented at the point of collection, supported by comprehensive privacy policies for users seeking additional detail. Effective notice should clearly explain what data is collected, why it is necessary, how long it will be retained and with whom it may be shared.
4. Collecting More Data Than the Purpose Requires
The principle of data minimisation is reflected throughout the DPDPA. Nevertheless, businesses frequently collect categories of personal data that bear little relationship to the services they provide. Utility applications requesting access to contacts, call logs or precise location data despite having no operational need illustrate this recurring concern.
Sections 4 and 6 require that processing remain connected to the specified lawful purpose. Future business opportunities or speculative product development cannot justify present-day collection. Organisations should therefore periodically review every category of personal data collected and retain only what is demonstrably necessary for the disclosed purpose.
5. Interface Design That Manipulates User Choice
Consent mechanisms increasingly raise compliance concerns because of how they are designed rather than what they say. Large, prominently displayed "Accept All" buttons coupled with obscure preference settings or complicated rejection pathways effectively steer users toward a predetermined outcome. Such design practices, commonly described as dark patterns, are difficult to reconcile with the statutory requirement that consent be free. Businesses should ensure that accepting, rejecting and managing consent are presented with equal prominence and comparable levels of effort.
6. Making Withdrawal Unnecessarily Difficult
The DPDPA recognises that consent remains subject to the continuing autonomy of the Data Principal. Section 6 therefore requires withdrawal of consent to be as simple as granting it. Yet many organisations continue to conceal withdrawal mechanisms within multiple settings menus or require users to contact customer support before consent can be revoked. These practices create unnecessary friction and undermine statutory compliance. Effective governance requires straightforward, self-service withdrawal mechanisms that also ensure corresponding processing activities cease unless another lawful basis exists.
7. Failing to Maintain Defensible Consent Records
Obtaining consent is only one aspect of compliance, demonstrating that valid consent existed is equally important. Section 8 places the responsibility for proving compliance squarely upon the Data Fiduciary. Accordingly, organisations should maintain comprehensive consent records identifying the applicable notice, the purposes disclosed, the method through which consent was obtained, relevant timestamps and any subsequent withdrawals. Such records frequently become the decisive evidence during regulatory investigations, internal audits and investor due diligence exercises.
8. Treating Consent as a One-Time Event
Business models evolve continuously. New features, additional services and expanded commercial objectives often require organisations to process personal data for purposes that were not contemplated when consent was originally obtained. The specificity requirement contained in Section 6 means that materially different processing purposes ordinarily require fresh notice and fresh consent. Consent should therefore be viewed as an ongoing governance process rather than a single onboarding activity completed once and forgotten.
Conclusion
The DPDPA requires businesses to rethink consent as an integral component of product governance rather than a compliance formality appended at the end of development. Organisations that prioritise transparency, meaningful user choice and accountable consent management will not only strengthen their regulatory position but also enhance customer trust, investor confidence and organisational credibility. Ultimately, the more useful compliance question is no longer "Did we obtain consent?" Rather, it is "Would our consent mechanism withstand regulatory scrutiny if examined today?" The answer to that question will increasingly determine whether an organisation's data processing activities remain legally sustainable in India's evolving privacy landscape.
For organisations that are unsure of the answer, that uncertainty is exactly where a structured compliance assessment becomes a strategic advantage. At Fathom Legal Corporate & Associates, we help businesses assess, refine and strengthen their consent frameworks in line with the DPDPA and the Draft DPDP Rules, 2025. Through detailed DPDPA readiness assessments, consent-mechanism audits, privacy governance reviews and implementation support, we enable organisations to move beyond box-ticking and build consent frameworks that are robust, defensible and regulator-ready. Our goal is straightforward that when regulators, investors or customers ask whether your consent practices comply with the law, your organisation should be able to answer with clarity, confidence and to stand strong with a governance framework built to withstand scrutiny.