Giving consent is only the first moment in a much longer relationship with your data. Here’s what the Act expects to happen after that first click.
THE CONSENT LIFECYCLE
GIVE
The initial, specific yes
Tied to a notice, a purpose, and a clear affirmative action.
MANAGE
Review what you've agreed to
See what consents are active, and to whom, ideally in one place.
WITHDRAW
Say no, at any point
And withdrawal has to be genuinely as easy as giving consent was in the first place.
That last point trips up a lot of product design: if signing up takes one tap but withdrawing consent takes a phone call and a two-week wait, that’s not a technical detail — it’s very likely a compliance gap. Consent Managers exist specifically to make the “manage” step easier across multiple organisations at once, rather than leaving each one to build its own dashboard.
Common misconception — That once consent is given, it holds indefinitely. It can be withdrawn at any time, and withdrawal should be no harder than giving it was.
Consent isn’t a single event. It’s an ongoing relationship — and withdrawal has to be as easy as the yes was.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf