Section 6, DPDP Act [S10-N3T]
As at 7 September 2026. Not commenced. Commencement appointed for 13 May 2027 by Notification G.S.R. 843(E): phased commencement of the Digital Personal Data Protection Act, 2023 [N11-6ZG].
(1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
(2) Any part of consent which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.
(3) Every request for consent shall be presented to the Data Principal in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection Officer, where applicable, or of any other person authorised by the Data Fiduciary to respond to any communication from the Data Principal.
(4) The Data Principal shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
(5) The consequences of the withdrawal of consent shall be borne by the Data Principal, and such withdrawal shall not affect the legality of processing of the personal data based on consent before its withdrawal.
(6) If a Data Principal withdraws her consent, the Data Fiduciary shall, within a reasonable time, cease and cause its Data Processors to cease processing the personal data of such Data Principal unless such processing without her consent is required or authorised under the provisions of this Act or the rules made thereunder or any other law.
(7) The Data Principal may give, manage, review or withdraw her consent to the Data Fiduciary through a Consent Manager. [...]
Defined terms in this text (6)
Consent Manager: Section 2(g), DPDP Act: "Consent Manager" means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform;
data: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "data" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means
data: 5 more definitions.
Data Fiduciary: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data
Data Fiduciary: 3 more definitions.
Data Principal: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "Data Principal" means the individual to whom the personal data relates and, where such individual is a child, includes the parents or lawful guardian, and where a person with disability, includes her lawful guardian acting on her behalf [...]
person: Section 3, General Clauses Act, 1897 [S100SN] (In this Act, and in all Central Acts and Regulations made after the commencement of this Act, unless there is anything repugnant in the subject or context): "person" shall include any company or association or body of individuals, whether incorporated or not
person: 1 more definition.
personal data: Section 2, DPDP Act [S10MZ3] (In this Act, unless the context otherwise requires,— [...]): "personal data" means any data about an individual who is identifiable by or in relation to such data
personal data: 3 more definitions.
Made under this section, or naming it (0)
none
Cited by (1)
Section 5, DPDP Act [S10-N2R], 11 August 2023, Band A. "sub-section (4) of section 6".
Not held (0)
none
Duties published under this section (0)
none