DPDP Consent Management Guide
Learn how to collect, manage and withdraw consent under India's DPDP Act without breaking customer journeys.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Consent Management Guide, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Managing Consent Logs and Versioning
Consent management requires tracking “meta-data” about a user’s choice. This includes the specific version of the privacy notice the user viewed, the timestamp of their click, and their language preference. If you update your terms, your system must track which users remain on the old version versus the new version to ensure you do not process data based on expired permissions.
Multilingual Notice Requirements
DPDP requires that every consent request be preceded or accompanied by a notice. If a user prefers an Indian language listed in the 8th Schedule, your system must provide the notice and consent options in that specific language. Most global “Cookie Banners” or consent tools do not support all 22 Indian languages, which creates a compliance gap for diverse Indian user bases.
Workflow and Data Mapping
| Workflow | Personal Data Collected | DPDP Risk |
|---|---|---|
| Preference Center | Language choice, opt-out status | Failing to provide notices in the chosen 8th Schedule language |
| Withdrawal Request | User ID, revocation timestamp | Processing data after a user uses the “easy” withdrawal path |
| Consent Logging | IP address, Notice version ID | Inability to prove exactly which notice version the user saw |
| Marketing Opt-in | Phone number, Email address | Bundling marketing consent with core service delivery |
| Notice Archiving | Historical consent records | Retaining consent logs longer than the underlying data relationship |
This week
Test your “Withdraw Consent” flow. If a user must email support or fill out a form to stop data processing, but only clicked one button to start it, your system fails the “ease of withdrawal” rule. Ensure the withdrawal path is as simple as the sign-up path.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Can I use a global consent tool that only supports English?
No, DPDP requires that notices be available in any of the 22 languages listed in the 8th Schedule. Your tool must allow users to switch to their preferred Indian language.
Is a pre-ticked box for newsletter signups allowed?
No, DPDP requires an affirmative action for consent. Pre-ticked boxes are invalid because the user did not actively choose to opt in.
How do I handle users who signed up before the DPDP Act?
You must send a fresh notice to these users. This notice must explain what data you have and how they can withdraw their consent or exercise their rights.