Module 4: Notice & Consent Management
How to write a compliant notice, collect valid consent, run consent withdrawal, and when you can process without consent. This DPDPA 2023 course page explains notice and consent management in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Module 4 lessons (about 4 hours) (notice and consent management)
Read the lessons in order, like chapters of a book. Each has reading, a click-through diagram, an activity and a quiz.
What you will learn about notice and consent management
- Write an itemised notice
- List the six elements of valid consent
- Use legitimate uses correctly
- Keep audit-ready consent records
Notice (Section 5)
Before or when asking for consent, give a clear notice.
- What personal data and for what purpose
- How the principal can withdraw consent and exercise rights
- How to complain to the Board
- Available in English or any language of the Eighth Schedule
- For legacy consents, send a notice as soon as reasonably practicable
Valid consent (Section 6) (notice and consent management)
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the purpose and to data necessary for it.
- Withdrawal must be as easy as giving consent
- The principal bears the consequences of withdrawal
- On withdrawal, stop processing within a reasonable time (and have processors stop too)
- Avoid bundled consent and dark patterns
Legitimate uses (Section 7)
Some processing needs no consent, for example when a principal voluntarily provides data for a purpose and does not object, to comply with law or a court order, to respond to a medical emergency or disaster, for State benefits, or for employment purposes.
Consent Managers (notice and consent management)
Registered entities that give principals a single, interoperable dashboard to give, review and withdraw consent. They act on behalf of the principal and must be accountable to them.
Minimum consent record
Keep who consented, when, to which notice version, for which purposes, through which channel, and when it was withdrawn.
Consent is only as good as the notice and the audit trail behind it.
Check your understanding of notice and consent management
Q1. Which is NOT a requirement of valid consent?
Q2. Withdrawing consent must be…
Q3. Which is a legitimate use without consent?
Quick FAQs (notice and consent management)
Do cookie banners need consent?
Where cookies process personal data for non-essential purposes, treat them as consent-based.
Do old consents still work?
Yes for existing relationships, but you must issue a fresh compliant notice reasonably soon.
Do it yourself: practical guides
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.