Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsConcept
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs.
TL;DR
Consent under the DPDP Act (Section 6) must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to the data the purpose needs. It is one of two lawful bases for processing, and a Data Principal can withdraw it at any time, as easily as it was given.
The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
Consent is one of the two lawful bases for processing, the other being a certain legitimate use. It cannot be bundled, assumed or buried: the person must actively agree, for a specific purpose, to only the data that purpose needs.
A Data Principal can withdraw consent at any time, as easily as it was given. When they do, the fiduciary must stop processing unless another lawful basis applies.
A telemedicine app asking to process your health details for a consultation has valid consent. Asking for your contact list, which the consultation does not need, is not valid.
See how this term differs from the ones people most often confuse it with.
Consent vs Certain Legitimate Uses →Can consent be withdrawn?
Yes, at any time, as easily as it was given. Processing must then stop unless another basis applies.
Is consent the only lawful basis?
No. The Act also allows certain legitimate uses under Section 7, such as medical emergencies.
Consultant-led and partner-backed.