“Your website has a cookie banner. Your signup form has a checkbox. Your privacy policy exists. But does that actually mean your consent mechanism is legally valid under DPDPA?”
For most organisations operating in India, the answer is probably not, at least not entirely. And that gap between appearing compliant and being compliant is exactly where regulatory and operational risk lives.
Many companies collect some form of user agreement. Far fewer can demonstrate a valid, auditable consent record that holds up to scrutiny under the Digital Personal Data Protection Act, 2023 (DPDPA). This article walks you through a practical self-audit to find out where your gaps are before someone else does.
Why consent under DPDPA is not what you think
Under the DPDPA, consent is not a formality. It is a legal requirement. The Act defines valid consent with specificity: It must be informed, specific, unambiguous, freely given, and tied to a defined purpose. Each word carries weight.
Think of it this way: Consent is not about collecting a checkbox. It is about proving that users understood what they agreed to and had a genuine choice.
A buried line in a 12-page privacy policy, a pre-ticked marketing box or a single “I agree to everything” checkbox does not meet this standard. And the risks of getting this wrong are not merely regulatory. They are operational, affecting your ability to process, store, and act on user data at all.
The self-audit checklist: 10 questions to ask right now
Go through each question and mark your honest answer. Your score at the end will tell you where you stand.
Mark each item you can confidently answer “Yes” to
A. Do users clearly understand why their data is being collected?
Purpose must be specific. “For business purposes” or “to improve experience” is not enough.
B. Is consent collected separately from terms & conditions acceptance?
Different purposes need separate consent choices, not a single bundled checkbox.
C. Are all consent options unchecked by default?
Pre-ticked boxes, particularly for optional activities such as marketing communications, may undermine the requirement that consent be freely given and demonstrable.
D. Can users easily withdraw consent, with the same effort as giving it?
Withdrawal should be via one-click unsubscribe, a preference centre, or account settings, not a buried email request.
E. Can your organisation prove when and how consent was collected?
You need a timestamp, the purpose stated at collection, the user action taken, and the source system.
F. Are users informed when their data is shared with third-party vendors or partners?
Covers cloud providers, analytics platforms, marketing tools, and any data processors.
G. Do you have age verification and parental consent processes in place?
If your platform processes personal data of children, age verification and parental consent obligations may apply.
H. If you change how you use data, do you seek fresh consent?
Example: You collected an email for account creation. Later you used it for marketing. That requires a new consent event.
I. Do you have a defined process for responding to consent withdrawal requests?
Not just receiving the request, but acting on it consistently across all systems and data stores.
J. Is your consent language plain, specific, and written at a general reading level?
Legal jargon that obscures meaning undermines the “informed” requirement, even if it is technically accurate.
0 / 10
items confirmed compliant
Check the items above to see your score
8–10 Yes: Strong foundation. Focus on maintaining records and periodic re-review.
5–7 Yes: Moderate risk. Gaps exist that could expose you to scrutiny. Address the unchecked items.
Below 5: High likelihood of compliance gaps. A structured consent health check is advisable before your next product or data change.
Common mistakes organisations make
These are the patterns that come up again and again and each one creates compounding risk:
- Copying privacy policies from the internet without adapting them to actual data practices
- Bundling multiple permissions into a single consent action
- No audit trail, meaning users agreed but there is no evidence to prove it
- No real withdrawal option, or one that is harder than opting in
- Collecting more data than the stated purpose requires
- Assuming a cookie banner alone covers all DPDPA consent obligations
The practical risks of non-compliance
Consent failures do not just create regulatory exposure. They can create operational fragility, the kind that surfaces at the worst possible moment.
Operational risks:
· Customer trust erosion when data use is questioned
· Inconsistent data handling across systems
· Inability to respond to user data requests or audits
Compliance risks:
· Regulatory scrutiny from the Data Protection Board
· Remediation costs when gaps are discovered
· Governance issues affecting enterprise contracts
The organisations that navigate DPDPA well are not necessarily the ones with the most complex systems. They are the ones with clear, documented, repeatable consent processes that they can demonstrate on demand.
“Consent management is not a one-time implementation. Organisations need continuous visibility into how data is collected, processed, and governed.”
If your audit surfaced gaps or raised more questions than it answered, a structured consent health check may be the next logical step.
Need help evaluating your DPDPA readiness? Start here.