Consent in the field
Notices, real consent, proof, and when consent is not needed
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Two lawful grounds
Every use of a person's data needs a lawful ground. The Act gives two: the person's consent, or one of a short list of legitimate uses.
s.4(1) allows processing only for a lawful purpose, either with the Data Principal's consent or for 'certain legitimate uses', which are listed in s.7. A lawful purpose is any purpose not expressly forbidden by law (s.4(2)). There is no general 'legitimate interest' or 'public good' ground in the Act.
What your notice must say
Every request for consent must come with a notice. It lists the data, the purpose, and how the person can withdraw, use their rights and complain to the Board.
Rule 3 says the notice must be understandable independently of any other information, so it cannot be buried in a long form. It must give the link to your website or app and describe any other means for withdrawal, rights and complaints. The Rules are written with online services in mind and do not say how this works for an NGO with no website, or for a notice read aloud in a village. Giving a phone number or office address as the 'other means' is a sensible reading, but the text does not confirm it.
Make the notice work in the field
People must have the option to get the notice and the consent request in English or a language listed in the Eighth Schedule to the Constitution. In the field, read it aloud as well.
s.5(3) covers the notice and s.6(3) the consent request; s.6(3) also requires plain language and the contact details of a person authorised to respond about the person's rights. The Eighth Schedule lists the scheduled languages, such as Hindi, Bengali, Marathi, Tamil and Urdu. Many dialects and tribal languages are not listed. The Act does not require them, but consent must still be 'informed' (s.6(1)), so explain in words the person actually understands.
What counts as valid consent
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. It covers only the data needed for the stated purpose.
The Act does not define these words one by one or prescribe a form, so the short explanations here are a practical reading. A signature, thumb impression, ticked box or recorded spoken yes can each be a clear affirmative action; silence or a pre-filled form is hard to defend. Consent is limited to the data necessary for the purpose even if the person agreed to more (s.6(1)), and any part of a consent that infringes the Act is invalid (s.6(2)).
The power gap
People who depend on your help may feel they cannot say no. Ask only for what the programme needs, and make everything else truly optional.
The Act does not mention power imbalance, but 'free' and 'unconditional' are hard to show when a person believes rations, a scholarship or treatment depend on signing. Separate the data needed to deliver the service from data wanted for donor reports, research or publicity, and ask for the extras separately. Train field staff to say clearly that refusing them changes nothing. Agreement to unnecessary data does not help you, because consent is limited to what the specified purpose needs (s.6(1)).
Proof and withdrawal
If consent is questioned in a proceeding, you must prove that you gave notice and got consent. People can withdraw at any time, and it must be as easy as saying yes.
s.6(10) puts the burden of proof on the fiduciary. Withdrawal does not make earlier processing unlawful, and the person bears its consequences, such as leaving a programme that cannot run without the data (s.6(5)). After withdrawal you must stop within a reasonable time, make your processors stop (s.6(6)), and erase the data unless a law requires you to keep it (s.8(7)). If consent was taken by thumb impression at a village meeting, withdrawal should not require an email.
When consent is not needed
A few uses need no consent: data a person volunteers for a stated purpose, medical emergencies, epidemics, disasters and employment. Each one covers only that purpose.
s.7(a) applies where a person voluntarily provides data for a specified purpose and has not indicated that she does not consent, for example a caller who gives your helpline her details to get a referral. s.7(f), (g) and (h) cover medical emergencies, health services during an epidemic or other threat to public health, and safety or assistance during a disaster or breakdown of public order. s.7(i) covers 'the purposes of employment'; the Act does not say whether unpaid volunteers count, so consent is the safer basis for them. None of these uses lets you reuse the data for publicity or fundraising.
Government schemes and old records
On a government scheme, the State's own ground may cover the scheme data. For people who consented before the law starts, send a notice as soon as reasonably practicable.
s.7(b) lets the State and its instrumentalities process data to provide benefits, services, certificates and the like under law, policy or public funds (Rule 5), where the person earlier consented to the State's processing or the data is in a notified State database; the Second Schedule standards apply. The Act does not say that an NGO can rely on s.7(b) for itself, so the cautious view is that it helps only where you act as the department's processor. s.5(2) covers consent given before commencement: the notice must describe the data, the purpose, and how to withdraw, use rights and complain. It does not rescue old data collected with no consent at all, which needs a valid ground going forward.
In one line
That is consent in the field. Next: the extra rules for children and for people who have a lawful guardian.