Consent
The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
Any part of consent which constitutes an infringement of the provisions of this Act, the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.
The Data Principal may withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given, and the consequences of such withdrawal shall be borne by the Data Principal.
Every Data Fiduciary shall, upon receipt of a communication for withdrawal of consent, cause the Data Processor to also cease processing the personal data.
- 'Comparable ease of withdrawal' is the operative test — a two-tap consent flow behind a five-step withdrawal process would not meet this standard.
- Consent is purpose-limited and data-minimised by design: you can't collect broadly and later expand use because 'the box was ticked'.
- Withdrawal has to propagate to every Data Processor you've shared that data with, not just stop at your own front door.
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.