Concept
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs.
The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
Consent is one of the two lawful bases for processing, the other being a certain legitimate use. It cannot be bundled, assumed or buried: the person must actively agree, for a specific purpose, to only the data that purpose needs.
A Data Principal can withdraw consent at any time, as easily as it was given. When they do, the fiduciary must stop processing unless another lawful basis applies.
A telemedicine app asking to process your health details for a consultation has valid consent. Asking for your contact list, which the consultation does not need, is not valid.
See how this term differs from the ones people most often confuse it with.
Consent vs Certain Legitimate Uses →Can consent be withdrawn?
Yes, at any time, as easily as it was given. Processing must then stop unless another basis applies.
Is consent the only lawful basis?
No. The Act also allows certain legitimate uses under Section 7, such as medical emergencies.