In India, consent now has a notice,a record and an exit.
ConsentCenter shows the itemised notice, captures a clear affirmative action and keeps withdrawal one step away, with a record of every choice.
- 01 Notify
- 02 Record
- 03 Honour
Click a provision to read what it says.
A banner with “OK” is not a DPDP notice.
The Act asks what you collect, why, and how to take it back.
The DPDP Act ties valid consent to a notice that lists the personal data and the purpose, in plain language, with a way to withdraw and to complain. Most sites built for India still show a cookie bar that says none of that.
Where this goes wrong first.
Consent bundled with the service
The Act wants consent limited to the data a stated purpose needs. A single “I agree” that covers analytics, marketing and the service itself cannot show that.
Withdrawal hidden in an email address
Giving consent took one click. Withdrawing it takes a support ticket. The Act asks for the two to be comparable in ease.
No language other than English
Visitors can ask to read the notice in a language listed in the Eighth Schedule of the Constitution. A notice that only exists in English cannot honour that.
What changes for you.
Show an itemised notice of data and purposes before consent is given.
Record each consent with its notice version, purposes and timestamp.
Let people withdraw, and route grievances and rights requests to an owner.
How it works
Notify
Present the itemised notice, in the visitor’s chosen language, before asking.
Record
Store the choice against the notice version and each purpose it covers.
Honour
Apply withdrawals everywhere and route rights and grievance requests to an owner.
How the banner should look.
A ConsentCenter banner set up for the DPDP Act. Click it: accept, reject or open the preferences.
Allowed to run: Strictly Necessary
What it is doing
- Nothing optional runs until the visitor gives consent.
- Purposes are itemised, and each can be given or declined on its own.
- “Decline” sits beside “Give Consent” at the same weight.
- The notice can be read in another scheduled language.
- A link stays on the page afterwards to withdraw consent.
What the text actually says.
- DPDP Act, Section 5
- A request for consent must be accompanied or preceded by a notice describing the personal data, the purpose, and how to withdraw consent and make a complaint.
- DPDP Act, Section 6(1)
- Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the specified purpose.
- DPDP Act, Section 6(4)
- A Data Principal may withdraw consent at any time, with the ease of doing so comparable to the ease with which it was given.
- DPDP Act, Section 9
- Processing a child’s personal data requires the verifiable consent of a parent or lawful guardian; a child is anyone under 18.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Cookie Consent
Hold non-essential trackers until a clear affirmative action, with an itemised notice.
View productUniversal Consent & Preference Management
Keep purpose-level consent and withdrawal in one record across channels.
View productDSAR & Privacy Rights
Handle access, correction, erasure and grievance requests with clear ownership.
View product
Frequently asked questions
The DPDP Rules, 2025 bring the Act into force in phases. Some provisions, including those on the Data Protection Board, started first; the notice, consent and Data Fiduciary obligations follow after a transition period. Check the commencement dates with your counsel for your own planning.
No. A Consent Manager under Section 6 is a specific entity registered with the Data Protection Board. ConsentCenter is software a Data Fiduciary uses to run its own notices, consent records and withdrawals.
The Act regulates digital personal data, and cookies and similar identifiers often carry it. Where optional tracking processes personal data on the basis of consent, the notice, consent and withdrawal rules apply to it as to any other processing.
No product can do that. ConsentCenter is designed to provide the notice, consent record, withdrawal and request workflow. Which obligations apply to you, including whether you are a Significant Data Fiduciary, is a question for your counsel.
Bring us your DPDP Act question.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.