Building Trust with Technology: Consent Management Under India’s DPDP Act, 2023

II. The Consent Lifecycle Under DPDPA

The CMS detailed in the BRD is structured around a comprehensive Consent Lifecycle Management module, covering six critical stages:

1. Consent Collection

The starting point is user interaction — when a Data Principal engages with a service and triggers the need for data collection. The CMS ensures that:

• Consent notices are multilingual, accessible (WCAG-compliant), and clear.
• Granular consent options are available for each purpose (e.g., marketing, KYC, analytics).
• Pre-checked boxes are prohibited; consent must be obtained via explicit, affirmative action.
• Metadata — such as timestamp, language, purpose ID, and user ID — is captured to create a Consent Artifact, an immutable record securely stored in the system.

🛠 Example: A user downloading a health app must tick separate boxes to allow use of data for service delivery, personalized wellness suggestions, and third-party sharing.

2. Consent Validation

Before any data processing begins, the CMS enforces real-time consent validation. This ensures:

• Consent exists and matches the processing purpose.
• Consent is active and not withdrawn or expired.
• Any mismatch results in rejection of the processing request and user notification.

This step serves as a legal checkpoint — preventing ultra vires processing and enabling data minimization, another foundational DPDPA principle.

3. Consent Update

As business operations evolve, so may the purposes for data processing. Whenever a data fiduciary seeks to introduce a new use-case, it must prompt users to update their consent:

• Only the affected purposes need to be re-consented.
• The system retains prior consents unless explicitly changed.
• All updates are logged, timestamped, and notified to relevant stakeholders.

📌 Legal implication: Updated consent is treated as a fresh legal act. It cannot be presumed or implied — a cornerstone of informed autonomy.

4. Consent Renewal

Some consents may have a predefined lifespan (e.g., six months). The CMS includes a renewal mechanism that:

• Notifies users before expiry.
• Allows seamless re-confirmation or denial.
• Logs renewals with fresh metadata to maintain validity under audit.

This feature is critical for periodic consents in sectors like insurance or financial services, where data retention obligations intersect with consent requirements.

5. Consent Withdrawal

Arguably the most powerful right granted under the DPDPA, withdrawal of consent must be as easy as giving it. The CMS ensures:

• Users can revoke specific consents through the dashboard.
• Data fiduciaries receive real-time alerts to cease processing immediately.
• Exceptions are allowed only where processing is required by law.

This capability reflects the revocability principle under Section 6(4) of the DPDPA and reinforces the fiduciary’s obligation to respect user agency.

6. Cookie Consent

Separate from general personal data processing, cookie consent deserves special attention. The CMS supports:

• Category-Based Toggles (e.g., Essential, Analytics, Marketing): Users can selectively enable or disable cookies by category, allowing them to grant consent for specific purposes like analytics or marketing while retaining essential functionality.
• Real-Time Modification of Cookie Preferences: The CMS allows users to update or withdraw their cookie consent at any time through a preference center, with changes reflected instantly across the system.
• Auto-Expiry of Cookie Data in Line with Retention Rules: Cookie data is automatically deleted or deactivated after a predefined period, ensuring compliance with data minimization and storage limitation principles.

This module mirrors global best practices (e.g., EU ePrivacy Directive) while adapting to India's multilingual and mobile-first landscape.