Re-consent: when a new purpose means you must ask again

At a glance

Consent under India’s DPDP Act is tied to the specific purpose it was given for. So if you want to use personal data for a new purpose — beyond what the person originally agreed to — you must give a fresh notice and get fresh consent for that purpose. Re-consent isn’t about re-asking for the same thing periodically; it’s triggered when the purpose changes. Continuing to use the data for the original purpose needs no re-ask; repurposing it does.

Educational resource only. This explains re-consent and purpose limitation under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

On this page

• What triggers re-consent
• New purpose vs same purpose: telling them apart
• What re-consent actually involves
• How this differs from legacy data
• FAQ

The situation

You collected data for one reason, and now the business wants to do something else with it — market to a list gathered for orders, feed records into a new analytics product, share data with a new partner. The instinct is to just use the data you already have. Purpose limitation says: not without asking again.

What triggers re-consent

A change of purpose is the trigger — not the passage of time. Consent is specific to the purpose stated when it was given (Section 6), and data must be used only for that purpose (purpose limitation). So the moment you want to use the data for something the person didn’t agree to, the original consent no longer covers you, and you need fresh consent for the new purpose. Re-consent isn’t a periodic renewal ritual; it’s what you do when the use changes.

New purpose vs same purpose: telling them apart

Ask whether the person would recognise this use as what they signed up for. Some lines are clear; some need judgement:

• Same purpose (no re-consent): using an appointment number to send appointment reminders; using order details to fulfil and support the order. Routine, expected, within scope.
• New purpose (re-consent needed): using that appointment number for marketing; using order data to build a profile or train a model; sharing it with a new third party; a materially different use than stated.
• The test: would the person be surprised to learn you’re doing this, given what you told them at collection? Surprise is a strong signal it’s a new purpose.

When it’s genuinely ambiguous, treat it as new and ask — it’s cheaper than a challenge.

What re-consent actually involves

It’s the full consent step again, scoped to the new purpose — not a buried tweak. To re-consent properly:

1. Give a fresh notice naming the new purpose specifically.
2. Get a fresh, specific opt-in for it — a clear affirmative action, separate from the original.
3. Don’t force it — declining the new purpose can’t cost the person the original service.
4. Record it — log the new consent as its own record, so you can show what was agreed and when.
5. Only start the new use once consent is given — not before.

How this differs from legacy data

Re-consent is about a new purpose; the legacy-data rule is about old data used for its original purpose. These get confused. If you simply hold data collected before the Act and want to keep using it for the same purpose, that’s the transition-notice situation — a one-time notice, not fresh consent (covered separately). Re-consent is different: it’s triggered specifically when you want a new use, whether the data is old or new. Old data + new purpose still needs re-consent.

FAQ

When do I need to get consent again? When you want to use the data for a new purpose beyond what the person originally agreed to. A change of purpose triggers re-consent; continuing the original purpose does not.

Do I need to periodically renew consent? The Act ties re-consent to a change of purpose, not to a fixed clock. There’s no general “re-ask every year” rule; there is a “re-ask when the purpose changes” rule.

Can I use my existing customer list for a new marketing campaign? Only if marketing was a purpose they consented to. A genuinely new use needs fresh, specific consent — you can’t repurpose the data on the old consent.

Is re-consent the same as the rule for old databases? No. Old data used for its original purpose needs a one-time transition notice, not fresh consent. Re-consent applies when the purpose itself changes, for any data.