DPDPStack logodpdpstack
← Blog

Consent management under the DPDP Act for developers

Under the DPDP Act, most processing of personal data rests on consent - and the Act is specific about what valid consent looks like. A single "I agree" checkbox doesn't clear the bar. Here's what does, from an implementation point of view.

The notice comes first

Consent is only valid if it follows a proper notice. The notice must:

  • describe the personal data you'll collect and the purpose for each,
  • explain how the user can exercise their rights and complain to the Data Protection Board, and
  • be available in English or any of the 22 languages in the Eighth Schedule of the Constitution.

Practically: store your notice as versioned, translatable content, and record which version a user saw when they consented.

Consent has to be free, specific, informed, unconditional and unambiguous, given for a defined purpose. That rules out bundling. If you process data for three purposes, that's three consents the user can grant or deny independently - not one all-or-nothing toggle.

Withdrawal must be as easy as granting

The user can withdraw consent at any time, and it must be as easy to withdraw as it was to give. When they do, you stop the processing that relied on it - and that withdrawal often triggers a right-to-erasure flow for the data you no longer have a basis to keep.

For every grant and withdrawal, keep a receipt: who, which purpose, which notice version, and when. Put it in a tamper-evident log so the record can't be quietly rewritten later - the same audit trail that backs your deletions.

from dpdpstack import ConsentLedger

ledger = ConsentLedger()
ledger.grant(subject="user_42", purpose="marketing", notice_version="2026-04")
# ...later
ledger.withdraw(subject="user_42", purpose="marketing")

How it fits together

Consent, data rights, retention and deletion are one system, not four. When consent goes, erasure and retention logic decide what happens to the data, and the audit log proves it. See the DPDP compliance checklist for the whole picture, or jump into the Quickstart.