Under India's Digital Personal Data Protection Act, 2023, consent to process someone's personal data must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose (Section 6(1)).
Example
Meera's counter tablet explains that her email address will be used to send new arrivals and offers, with an unticked box. A customer who ticks it has given consent for that purpose. If she later clicks unsubscribe, Meera's team must stop sending marketing emails to her within a reasonable time.
How you'll hear it
“Did these people consent to WhatsApp marketing, or only to the order updates?”
Don't confuse it with
- Opt-in: the marketing mechanism; consent is the legal standard that mechanism has to meet.
- Terms and conditions acceptance: agreeing to a purchase is not the same as consenting to marketing.
In India: The Act says a person can withdraw consent at any time, and withdrawing must be as easy as giving it (Section 6(4)). After withdrawal the business must, within a reasonable time, stop processing that person's data and have its processors stop too, unless the Act or another law requires or permits it (Section 6(6)). The Act's obligations are being brought into force in phases through the DPDP Rules, 2025; check the current dates before relying on them.
Related terms
Sources
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Ministry of Electronics and Information Technology, Government of India, 2023