Template · Consent request
Consent request wording: banner, form and record
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Valid consent under Section 6 is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, before processing. The request is the moment all of that is tested: what the person sees, what they can refuse, what fires before they act, and what you keep as proof under Section 6(10).
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
What the request must do
Come after the notice or with it. Ask for one purpose at a time. Offer refusal with the same effort as acceptance. Do nothing that needs consent until the person has acted. Record what was shown, what was chosen and when. That record is the only way to meet the Section 6(10) burden of proof.
What a checklist misses
A checklist sees a banner. The Act sees the load order: on nineteen of twenty advisor sites, analytics, fonts or chat had fired before the banner appeared. It also sees the reject option: a banner with Accept in green and Manage preferences in grey is not offering refusal as easily as acceptance.
What a valid request has
- 01Nothing before the choiceNo non-essential script, cookie or tracker runs until the person accepts.Section 6(1), Section 4
- 02Notice firstThe request is accompanied or preceded by the Rule 3 notice, linked directly.Section 5(1)
- 03One purpose per choiceAnalytics, marketing and personalisation each get their own toggle; none is pre-ticked.Section 6(1), specific
- 04Refusal as easy as acceptanceReject all sits beside Accept all, same size, same effort.Section 6(1), free and unconditional
- 05Withdrawal as easy as givingA persistent control to change the choice, one click.Section 6(4)
- 06A recordWhat was shown, the version of the notice, the choice, the time, and how the choice was expressed.Section 6(10)
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Consent notice: the consent action and deployment notes. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
CONSENT ACTION
[ I ACCEPT ] [ I DECLINE ]
By selecting "I ACCEPT", you confirm that you have read and understood this notice and give your free, specific, informed, unconditional, and unambiguous consent, with clear affirmative action, for the purpose stated above (Section 6(1), DPDP Act 2023). Declining will not deny you access to any service that does not depend on this data.
Implementation notes:
Deployment standard for this notice: under Section 6(1) of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. Under Section 6(4), withdrawal must be as easy as the giving of consent. Every implementation note and gap below is an application of that standard to this specific touchpoint.
Display format: Layered notice above the sign-up button. Present ACCEPT and DECLINE with equal prominence.
Confirmed: no pre-ticked checkboxes are used (Section 6(1), consent requires clear affirmative action).
Purposes are presented as separate checkboxes (itemised consent): compliant with Section 6(1).
Withdrawal is possible in one click/action: meets the Section 6(4) standard (as easy as giving consent).
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample wording
Plain language, no dark patterns. This is the pattern gevox.in itself uses.
Banner
Your privacy choices. We use essential cookies to keep you signed in. Analytics is optional and off unless you turn it on. [Reject all] [Accept all] [Choose]
Analytics toggle
Analytics and product improvement. Pages you visit and how long you spend on them, sent to our analytics provider. Off by default.
Record kept
Notice version 2026-09-13.1, choice: analytics on, given by tap on Accept all, at 14:02 IST on 14 Sep 2026.
Questions people ask
- Is scrolling or continuing to browse consent?
- No. Section 6(1) requires a clear affirmative action.
- Can essential cookies run without consent?
- Processing strictly necessary to provide the service the person asked for rests on Section 7(a). Everything else needs consent.
- How long must we keep consent records?
- For as long as you rely on the consent, plus the period needed to evidence it if challenged. Section 6(10) puts the burden on you.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.