Section 6
Consent
Sets the standard for valid consent, the right to withdraw it as easily as it was given, and the rule that the Data Fiduciary carries the burden of proving both.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, signifying agreement to processing for the specified purpose and limited to the data necessary for it.
- (2)
- Any part of a consent that infringes the Act, its rules or any other law is invalid to the extent of the infringement.
- (3)
- Every consent request must be in clear and plain language, available in English or an Eighth Schedule language, and must give contact details for the Data Protection Officer where one applies, or another authorised person.
- (4)
- Where consent is the basis of processing, the Data Principal may withdraw it at any time, with ease comparable to the ease with which it was given.
- (5)
- The consequences of withdrawal are borne by the Data Principal, and withdrawal does not make processing done before it unlawful.
- (6)
- On withdrawal, the Data Fiduciary must stop processing within a reasonable time, and must make its Data Processors stop, unless a law requires or authorises the processing to continue.
- (7)
- A Data Principal may give, manage, review and withdraw consent through a Consent Manager.
- (8)
- A Consent Manager is accountable to the Data Principal and acts on her behalf as prescribed.
- (9)
- Every Consent Manager must be registered with the Board as prescribed.
- (10)
- Where consent is the basis of processing and a question about it arises in a proceeding, the Data Fiduciary carries the burden of proving that notice was given and that valid consent was obtained.
In practice
Sub-section (10) is the provision that decides what a compliance programme actually has to produce. Because the burden sits with the fiduciary, the deliverable is not the policy document but the record: what the notice said on a given date, what the person actually saw, and how withdrawal was offered. A screenshot taken today evidences none of that for a consent collected last year. Note also that consent has no penalty band of its own in The Schedule; a consent failure falls to item 7.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 6 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.