Section 6: Consent

Under Section 6, when a Data Fiduciary (the entity determining the purpose and means of processing data) relies on consent to process personal data, that consent must be free, specific, informed, unconditional, and unambiguous. The Data Principal (the individual to whom the data relates) must take a clear affirmative action to agree. Importantly, consent is strictly limited to the personal data that is actually necessary for the specified purpose. Any part of the consent agreement that violates this Act or other laws is automatically invalid.

Requests for consent must be presented in clear and plain language. The Data Fiduciary must give the Data Principal the option to view the request in English or any language listed in the Eighth Schedule to the Constitution. The request must also include the contact details of a Data Protection Officer or another authorized person who can respond to the Data Principal's communications regarding their rights.

A Data Principal has the right to withdraw their consent at any time, and doing so must be as easy as giving it. While the Data Principal bears the consequences of withdrawing consent, the withdrawal does not make past data processing illegal. Once consent is withdrawn, the Data Fiduciary must stop processing the data within a reasonable time and ensure its Data Processors (entities processing data on its behalf) stop as well, unless another law requires the processing to continue.

Data Principals can choose to give, manage, review, or withdraw their consent through a Consent Manager. A Consent Manager is accountable directly to the Data Principal and must be registered with the Board (the Data Protection Board of India) under conditions that may be prescribed by rules. Finally, if a dispute arises, the Data Fiduciary bears the burden of proving that it provided proper notice and obtained valid consent.

Key points

• Consent must be free, specific, informed, unconditional, unambiguous, and limited only to the data necessary for the specified purpose (1).
• Any part of a consent agreement that violates the Act or other laws is invalid (2).
• Consent requests must be in clear language, offer options for English or Eighth Schedule languages, and provide contact details for a Data Protection Officer or authorized person (3).
• Data Principals can withdraw consent at any time, and the process must be as easy as giving consent (4).
• Upon withdrawal, the Data Fiduciary and its Data Processors must stop processing the data within a reasonable time, unless another law requires it (6).
• If challenged in a proceeding, the Data Fiduciary must prove that it gave notice and obtained valid consent (10).

Common misreadings

• Assuming a Data Fiduciary can process any data as long as the Data Principal clicks 'I agree'; the law limits consent only to data strictly necessary for the specified purpose.
• Believing that withdrawing consent makes the previous processing of data illegal; the text states withdrawal does not affect the legality of processing done before the withdrawal.