DPDP Act Part 2: Consent, Notice & the Nine Legitimate Uses
DPDP consent explained: the section 6 validity test, Rule 3 notice contents, the nine legitimate uses and consent managers, for startups and manufacturers.
A D2C skincare startup in Kondapur collects a phone number at checkout “for delivery updates”. Six months later, the marketing team loads that list into a WhatsApp campaign tool. From 13 May 2027, that switch of purpose without fresh consent and notice is exactly the conduct the DPDP Act targets.
- Part 1 — What the DPDP Act is, who it covers, and when it bites
- Part 2 — Consent, notice and the nine legitimate uses (you are here)
- Part 3 — Your obligations: security, breach reporting, retention
- Part 4 — Rights, duties, children’s data, cross-border, exemptions
- Part 5 — Penalties, the Board, appeals and your compliance roadmap
The two lawful grounds under section 4
Every processing activity in your business must map to one of these:
- Consent (sections 5 and 6), with a prior notice.
- Certain legitimate uses (section 7), where consent is not needed.
In either case, the purpose must be lawful, meaning not expressly forbidden by any law. There is no third catch-all ground. India deliberately left out the GDPR-style “legitimate interests” basis, so marketing, analytics and sharing with partners will usually need consent.
What makes consent valid under the DPDP Act?
Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action. It must also be limited to the personal data necessary for the specified purpose.
Four rules that catch businesses out
- Over-collection voids the excess. If any part of the consent infringes the Act, that part is invalid (s.6(2)). An illustration in the Act itself: a telemedicine app cannot use consent to waive the user’s right to complain to the Board.
- Withdrawal must be easy. If consent took one click, withdrawal should too (s.6(4)). On withdrawal, you and your processors must stop processing within a reasonable time, unless the law permits otherwise (s.6(6)).
- Withdrawal is not retrospective. Processing done before withdrawal stays lawful (s.6(5)). The consequences of withdrawing, such as losing access to a feature, fall on the person.
- The burden of proof is yours. If consent is disputed, the Data Fiduciary must prove notice was given and consent obtained (s.6(10)). Keep consent logs with timestamps, notice versions and purposes.
The notice: what you must tell people
Every consent request must be accompanied or preceded by a notice (s.5). Rule 3 of the DPDP Rules, 2025 makes it more concrete. The notice must:
| Requirement | Source | Practical tip |
|---|---|---|
| Be understandable on its own, independent of any other information | Rule 3(a) | Do not bury it inside terms of service |
| Give an itemised description of the personal data collected | Rule 3(b)(i) | List “name, mobile, delivery address”, not “information you provide” |
| State the specified purpose and the goods, services or uses it enables | Rule 3(b)(ii) | One purpose per line; separate optional purposes like marketing |
| Provide a link or means to withdraw consent, exercise rights and complain to the Board | s.5(1); Rule 3(c) | Link to a rights request page and grievance contact |
| Be available in English or any of the 22 languages in the Eighth Schedule to the Constitution | s.5(3) | Offer Telugu and Hindi for consumer-facing businesses in Telangana |
Share your website, app screens or onboarding forms. We’ll review them against section 5, section 6 and Rule 3.
WhatsApp us Email Call 99595 36391The nine legitimate uses in section 7
You do not need consent where processing falls within one of these. They are interpreted narrowly, so document which one you rely on for each activity.
| Clause | Legitimate use | Business example |
|---|---|---|
| 7(a) | Specified purpose for which the person voluntarily provided data and has not objected | Customer shares an email to get a GST invoice; you email the invoice |
| 7(b) | State providing a subsidy, benefit, service, licence or permit | Government schemes |
| 7(c) | State performing a legal function, or in the interest of sovereignty, integrity or security | Government departments |
| 7(d) | Fulfilling a legal obligation to disclose information to the State | Sharing employee data with EPFO or the tax department |
| 7(e) | Complying with a judgment, decree or order | Producing records under a court order |
| 7(f) | Medical emergency involving a threat to life or health | Sharing a worker’s details with a hospital after a shop-floor accident |
| 7(g) | Medical treatment or health services during an epidemic or public-health threat | Pandemic-era health tracking |
| 7(h) | Safety or assistance during a disaster or breakdown of public order | Evacuation lists during floods |
| 7(i) | Employment purposes, protecting the employer from loss or liability (espionage, trade secrets, IP), or providing a benefit the employee seeks | Payroll, attendance, background checks, CCTV in production areas, group insurance |
The 7(a) trap for startups
Section 7(a) is tempting because it avoids a consent form. It is limited to the specified purpose for which the person gave the data. The Act’s own illustration: a person who buys medicine at a pharmacy and shares a phone number for the payment receipt can be sent the receipt, but cannot be added to a promotional list. The opening example in this article fails the 7(a) test for the same reason.
Consent Managers: what changes from 13 November 2026
A Consent Manager is a registered intermediary offering a single, interoperable dashboard through which people give, review and withdraw consent across businesses (s.6(7)–(9)). Under Rule 4 and the First Schedule, a Consent Manager must be a company incorporated in India with a net worth of at least ₹2 crore, adequate technical and financial capacity, and independent certification of its platform. Registration with the Board opens from 13 November 2026.
Most startups and manufacturers will not become Consent Managers. You may, however, receive consent through one, and you must honour withdrawals communicated that way.
Five steps to fix your consent architecture
- Inventory purposes. List every activity that touches personal data: onboarding, delivery, invoicing, marketing, analytics, HR, CCTV.
- Assign a ground. Mark each purpose as consent or a specific section 7 clause.
- Rewrite notices. Draft Rule 3-compliant notices with itemised data and separate optional purposes.
- Rebuild the UI. Use unticked boxes, granular toggles and a one-click withdrawal path.
- Log everything. Record who consented, to which notice version, when and how, and whether they later withdrew.
Hyderabad context
For SaaS and consumer-app startups around HITEC City and Gachibowli, the biggest work is in onboarding flows and marketing stacks. For manufacturers and distributors, it is dealer apps, warranty registrations and loyalty programmes, which nearly always need consent because they go beyond the original transaction.
Why work with ComplianceKart
Getting consent right needs a lawyer for the notice, a compliance mind for the process, and a commercial view of the business model. ComplianceKart is a boutique practice bringing CAs, CSs and advocates under one roof, like a multi-speciality hospital where the specialists discuss the case before advising the patient. We draft notices, map lawful grounds and review consent journeys. We do not guarantee any regulatory outcome.
Frequently asked questions
Is a privacy policy enough under the DPDP Act?
No. A privacy policy can remain, but each consent request needs a standalone notice meeting section 5 and Rule 3, with itemised data and specific purposes.
Can I use pre-ticked consent boxes?
No. Consent must be signified by a clear affirmative action (s.6(1)). A pre-ticked box is not an affirmative act by the user.
Do I need consent to process employee data?
Usually not for core HR, which falls under section 7(i), employment purposes. You still need to secure the data, keep it accurate and delete it when no longer needed.
What happens to consents collected before the Act?
You can continue processing, but must send a section 5 notice as soon as reasonably practicable. The person can then withdraw.
Can I refuse service if a customer won’t consent to marketing?
Generally no. Bundling unrelated consent with a service undermines “free” and “specific” consent, and consent must be limited to data necessary for the purpose.
In which languages must the notice be?
English, plus an option to access it in any of the 22 Eighth Schedule languages (s.5(3)).
Sources
- DPDP Act, 2023: sections 4, 5, 6 and 7 — MeitY
- DPDP Rules, 2025: Rules 3 and 4 and the First Schedule (G.S.R. 846(E), 13 November 2025)
- PIB release on DPDP Rules, 14 November 2025 — pib.gov.in
Previous: Part 1 — the basics. Next: Part 3 — security, breach reporting and retention.
This article is general information on the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as at 24 October 2026. It is not advice on any specific situation. Phased commencement dates and pending government notifications can change; check the official text on meity.gov.in before acting.
Need this done for your business?
Send us one message. A CA, CS or Advocate replies within a working day — no forms, no obligation.