Consent is the door most organisations walk through most often. The Act is specific about what actually counts.
VALID CONSENT MUST BE
1
Free
Given without pressure, and without being a condition for an unrelated service.
2
Specific
Tied to a stated purpose — not a blanket yes to everything an organisation might do.
3
Informed
Given after a clear notice, not buried assumptions.
The Act adds two more conditions on top of those three: consent must also be unconditional and unambiguous, backed by a clear affirmative action — an actual click or statement, never silence, never a pre-ticked box. And it must be limited to only the data that purpose actually needs. A fitness app asking for your health data is reasonable; the same app also asking for your contact list, for no stated reason, is not something your consent to the first automatically covers.
Common misconception — That a long terms-and-conditions checkbox counts as consent. It doesn’t, if the person had no real, specific choice about what they were agreeing to.
Consent under the DPDP Act isn’t a checkbox — it’s five specific conditions, all of which have to hold at once.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf