What you agree to when you consent
Notices, valid consent, withdrawing it, and when none is needed
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Two ways your data can be used lawfully
An organisation may use your personal data only for a lawful purpose, and only if you have consented or the law lists the situation as a legitimate use.
This is s.4(1). A 'lawful purpose' is any purpose not expressly forbidden by law (s.4(2)). The ground matters to you: the rights to access, correction and erasure in s.11 and s.12 attach to data processed with your consent, or data you gave voluntarily.
The notice you must be given
Before asking for consent, an organisation must give you a notice. It must say plainly what data it wants and why, and how you can withdraw, use your rights and complain.
You must have the option to read the notice in English or any language listed in the Eighth Schedule to the Constitution, which includes languages such as Hindi, Bengali, Tamil and Urdu (s.5(3)). The consent request must also give contact details of a Data Protection Officer or another person who will answer you (s.6(3)). If you gave consent before the Act starts, the organisation must send you a notice as soon as reasonably practicable, and may keep processing until you withdraw (s.5(2)).
What makes your consent valid
Consent must be free, specific, informed, unconditional and unambiguous, and shown by a clear action from you, such as tapping a button.
These words come from s.6(1). The Act does not define each one, so the short descriptions here are plain-language readings; the Board will decide real cases. If a dispute reaches a proceeding, the organisation must prove that it gave you notice and that you consented (s.6(10)). You do not have to prove that you did not.
Even if you tap yes
Consent is limited to the data needed for the purpose. And you cannot sign away your rights: a clause giving up your right to complain to the Board is invalid.
The telemedicine example is the Illustration to s.6(1). Under s.6(2), any part of a consent that infringes the Act, the Rules or another law is invalid to that extent. The Act's example is an insurance app that asks you to waive your right to complain to the Data Protection Board; that part of the consent is invalid.
Withdrawing your consent
You can withdraw consent at any time, and it must be as easy as giving it. The organisation and its vendors must then stop, and erase your data unless a law requires keeping it.
The Act says 'within a reasonable time' and gives no number of days (s.6(6)). Processing may continue where it is required or authorised without consent under the Act, the Rules or another law. Erasure on withdrawal is in s.8(7), but Rule 8(3) also makes organisations keep data and logs for at least one year, and government bodies are exempt from the erasure duty (s.17(4)). Chapter 3 explains these limits.
Withdrawing has consequences
The law says you bear the consequences of withdrawing. You may lose the service, but what was done with your data before you withdrew remains lawful.
Both examples come from the Illustration to s.6(5), about an online shopping app. The Act does not say an organisation must keep providing a service that depends on data for which you have withdrawn consent.
When your consent is not needed
In some listed situations an organisation can use your data without asking. These include government benefits, legal duties, emergencies and employment.
Under s.7(a), if you give a pharmacy your number to get a receipt by message, it may use it for that receipt, and you can tell it you do not consent. Under s.7(i) your employer needs no consent for purposes of employment or to protect itself from loss or liability, such as guarding trade secrets. The rights of access, correction and erasure are tied to consent and voluntarily given data (s.11, s.12), so they may not be available for the other uses on this list. For government benefits under s.7(b), the Second Schedule requires the State to tell you about the processing and how to use your rights.
Consent Managers: one place for consents
A Consent Manager is a registered platform where you can give, review and withdraw consents to many organisations in one place. Using one is your choice.
The Act says you 'may' use a Consent Manager (s.6(7)); it is accountable to you (s.6(8)). Under the First Schedule it must be an Indian company with a net worth of at least ₹2 crore, keep a record of consents you gave, denied or withdrew and of data sharing, and give you that record on request. It works only with organisations that have joined its platform. Rule 4 starts in November 2026, and the Board is to publish registered Consent Managers on its website (Rule 4(2)). You can raise a grievance against one (s.13) and complain to the Board (s.27(1)(c)).
In one line
Next: how to see what an organisation holds about you, and how to get it corrected or erased.