DPDP and consent: why "Accept all terms" no longer works

The main duties of India's Digital Personal Data Protection (DPDP) Act start on 13 May 2027. That is the date from which the old habit of burying permissions inside long terms and conditions stops being safe.

What counts as consent

Under Section 6, consent has to be free, specific, informed, unconditional and unambiguous, and it has to come from a clear action by the customer. A box that is already ticked is not a clear action. A paragraph that bundles marketing into the service terms is not specific.

What you must tell people

Before you ask, the notice has to say, in plain language:

• exactly which personal data you collect, item by item (for example name, phone number, email), and
• exactly what you will use each item for.

It must also tell people how to withdraw consent, how to use their rights, and how to complain to the Data Protection Board.

Changing their mind

A customer who says yes today can say no tomorrow, and withdrawing has to be as easy as giving consent. When they do, you must stop using their data within a reasonable time, make sure anyone processing it for you stops too, and delete it unless a law requires you to keep it (for example, tax records).

What to do this week

• Keep consent forms short and in plain words.
• Never pre-tick a box.
• Ask for marketing permission separately from the service itself.
• When someone says no to marketing messages, apply it everywhere: your email tool, your messaging apps and your spreadsheets.

Simple rule: ask clearly, say exactly why you need the information, and stop and delete when someone tells you to.

We follow this on our own website: every form has an unticked box and the server refuses a request without it. You can see how we practise the DPDP Act, or check your own readiness for free.

General information, not legal advice. Check the Act and Rules before relying on it.