s.6 · s.5 · s.4
Consent
Consent under Section 6 must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data needed for the specified purpose.
Every word in the standard does work. Free: no penalty for refusing. Specific: for a named purpose, not "and related purposes". Informed: preceded by the Section 5 notice. Unconditional: the service cannot be tied to consent for something the service does not need. Unambiguous, by a clear affirmative action: no pre-ticked boxes, no consent by scrolling, no consent by continuing to browse.
Consent must come before processing. A script that loads analytics, a font service or a chat widget in the head of a page has already sent the visitor’s IP address and device details to a third party before any banner appears. The Gevox Readiness Index found this on 19 of 20 websites of firms selling DPDP advice.
Section 6(10) places the burden of proving that valid consent was given on the Data Fiduciary. Consent that cannot be evidenced, with what was shown and when, is consent that cannot be relied on.
Questions people ask
- Is a cookie banner enough for consent?
- Only if nothing that needs consent runs before the visitor acts, the banner lets them refuse as easily as accept, and the choice is recorded. A banner that appears after the trackers have fired is not consent under Section 6.
- Can consent be implied from use of the service?
- No. Section 6(1) requires a clear affirmative action. Continued use is not one.
- How long is consent valid?
- Until it is withdrawn, or the specified purpose is no longer served. Section 8(7) and Rule 8 then require erasure.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.