How to Manage Consent and Withdrawal
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action (Section 6). This guide shows how to set it up on a website or app and prove it later. This DPDPA 2023 course page explains how to manage consent and withdrawal in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Design the consent screen (how to manage consent and withdrawal)
- One purpose, one choice. Newsletter consent is separate from account creation. Never bundle.
- Unticked boxes. The person must act. No pre-ticked boxes, no “continue means yes”.
- Ask only for needed data. If a field is not needed for the stated purpose, remove it.
- Show the notice next to the box (short version plus link).
- Record it at the moment of consent (see log below).
- Make withdrawal easy. A link in every email and a switch in account settings. It must be about as easy as giving consent.
- Act on withdrawal. Stop that processing within a reasonable time and tell processors. A practical target is 7 days.
Consent log: minimum fields
| Field | Example |
|---|---|
| Person ID | Customer 10482 or email |
| Date and time | 2027-06-02 14:31 IST |
| Notice version | v3, 2027-05-10 |
| Purpose | Marketing emails |
| How given | Checkbox on sign-up page |
| Withdrawn on | 2027-09-01, via unsubscribe link |
When you do not need consent (Section 7) (how to manage consent and withdrawal)
- The person voluntarily gave data for a purpose and did not object (for example, giving a phone number for a delivery update).
- You must comply with a law or court order.
- Medical emergency, public health, disaster response.
- Employment purposes and safeguarding the employer from loss or liability.
- State benefits, subsidies and licences.
A legitimate use still needs a notice in most cases and only covers the specific purpose. Do not use it for marketing.
Consent Managers (Rule 4)
From 13 November 2026, registered Consent Managers can offer people one dashboard to give, view and withdraw consent across companies. They must be Indian companies with at least 2 crore net worth, keep records for 7 years and be audited. As a small company you only need to accept valid consents or withdrawals that come through them, so keep your withdrawal process flexible.
Checklist (how to manage consent and withdrawal)
0 of 7 done
Related guides
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.