Consent, notice and specified legitimate uses

DPDP — not yet effective

Act sections 5–7 and Rule 3 are scheduled for 13 May 2027.

Processing routes

Personal data may be processed for a lawful purpose for which the Data Principal has consented or for a use expressly listed in section 7. The Act does not contain a general GDPR-style “legitimate interests” basis.

The purpose registry therefore offers only:

1. consent;
2. a specific section 7 category with a recorded factual test; or
3. open_legal_review, which blocks production approval.

Specified legitimate uses include the exact statutory cases, such as voluntary provision for a specified purpose without an indication of non-consent, certain State benefits/services, State functions, legal obligations to disclose, court/judicial functions, medical emergencies, health threats, disasters/public-order breakdown and prescribed employment-related purposes. Each has conditions; none is a general convenience ground.

Standalone notice

Rule 3 requires the notice to be independently understandable and clear. At minimum it identifies:

• itemised personal data;
• the specified purpose and the goods, services or uses enabled;
• a route to withdraw consent with comparable ease;
• routes to exercise rights and make a Board complaint.

The notice object binds purpose_version_id, data_category_ids, recipients, channel, language, approved copy, effective period, hash and reviewer. A collection surface may not send an unknown or draft version.

Consent proof

A valid receipt should record more than true:

{
  "receipt_id": "cr_synthetic_01",
  "subject_ref": "subj_H7K4Q2",
  "purpose_version": "PUR-CREDIT-OFFER-3",
  "notice_version": "NOT-CREDIT-OFFER-5",
  "notice_hash": "sha256:…",
  "action": "grant",
  "channel": "mobile_app",
  "occurred_at": "2026-07-29T09:31:22+05:30",
  "recorded_at": "2026-07-29T09:31:23+05:30",
  "proof": { "method": "authenticated-session", "session_ref": "sess_synthetic" },
  "locale": "en-IN",
  "schema_version": "1.0"
}

This is tamper-evident evidence, not an excuse to store a raw identity document or device fingerprint.

Withdrawal

The Data Principal may withdraw at any time with ease comparable to grant. Consequences of withdrawal attach to the Principal, but the Fiduciary must cease consent-based processing within a reasonable time and cause processors to cease unless processing without consent is authorised or required by law.

The product:

1. acknowledges immediately;
2. freezes new use of the withdrawn purpose;
3. creates idempotent downstream tasks;
4. separates suppression, deletion and lawful retention;
5. retries and reconciles partial failure;
6. shows the Principal what has completed and what remains lawfully retained.

Existing consent

For personal data processed on consent given before commencement, section 5(2) requires the prescribed notice after commencement. OpenDPDP models a versioned campaign with recipient population, delivery outcome, undeliverable route and withdrawal path. It does not manufacture a new historic consent receipt.

Dark-pattern controls

Consumer protection overlay

The 2023 CCPA Guidelines are relevant to covered interfaces now. The review checks bundled choices, pre-selection, false urgency, confirmshaming, forced action, interface interference, nagging, bait-and-switch and harder withdrawal.

Acceptance tests

• Given consent was collected in two taps, when the Principal withdraws in the same authenticated channel, then confirmation takes no more taps unless documented risk requires step-up.
• Given a purpose uses section 7, when a user selects generic “legitimate interest,” then approval fails.
• Given a notice translation changed after approval, when deployed, then the hash mismatch blocks collection.
• Given one processor times out, when withdrawal propagates, then successful destinations remain complete and the failed destination enters reconciliation rather than rolling back the receipt.