Businesses & Professionals
Consent Mechanics
Doing consent right, in practice — writing a notice that actually qualifies, designing a consent flow that holds up, and where common shortcuts like bundled consent and pre-ticked boxes quietly fail. The applied layer on top of what the law requires (s.6 consent, s.7 legitimate use).
What a legally valid consent notice looks like in India — with examplesA valid DPDP consent notice states what data, why, how to withdraw, and how to complain — in plain language, at collection. Worked examples of good vs weak notices.Consent vs deemed consent vs legitimate use under DPDP: clearing the confusion"Deemed consent" no longer exists under India's DPDP Act — it was replaced by the narrower "legitimate uses" (Section 7). The two real lawful routes, and why the old term misleads.Pre-ticked boxes don't count as consent: what good consent design looks likePre-ticked boxes, bundled agrees and 'by continuing you agree' don't count as consent under India's DPDP Act. What good consent design looks like — and the dark patterns to drop.Granular vs bundled consent: why one "I agree" fails, and how to split by purposeOne blanket 'I agree' fails under India's DPDP Act because consent is per purpose. Why bundled consent breaks, and how to split consent granularly by purpose — with examples.How to handle consent withdrawal (business side): what your flow must allowWhen a customer withdraws consent under India's DPDP Act, your systems must stop the processing, tell your processors, and be as easy to use as opt-in. What your flow must do.Re-consent: when a new purpose means you must ask againConsent under India's DPDP Act is tied to the purpose you gave. Use the data for a new purpose and you must ask again. When re-consent is needed — and when it isn't.Just-in-time consent: asking at the moment of collection, not all upfrontJust-in-time consent asks for each permission at the moment it's actually needed, not all at signup. Why it fits India's DPDP Act, and how to design it — with examples.Guardian consent for persons with a disability under DPDPDPDP requires verified guardian consent to process the data of a person with a disability who has a lawful guardian. What Rule 11 requires, and how it differs from parental consent.