I. BACKGROUND
The Digital Personal Data Protection (“DPDP”) Act, 2023, is India’s first comprehensive data protection legislation, organising its data protection provisions into a single statute and adding to the previously relied upon framework built by the IT Act, 2000, and SPDI Rules, 2011.
Although the DPDP Act was passed on August 11, 2023, when the President of India gave assent to the DPDP Bill, 2023, it has not yet come into force. In its anticipation, India’s Ministry of Electronics and Information Technology (“MeitY”) released the Draft Digital Personal Data Protection Rules, 2025 (“Draft Rules”) to the public in January 2025 for scrutiny and suggestions. The Draft Rules were designed to provide clarity on the implementation of the DPDP Act, such as data security obligations and data retention periods, allowing individuals and businesses to better understand their obligations and rights in light of this statutory update. The feedback period for the Draft Rules has since closed, as we wait for the publishing of the final rules.
In June 2025, MeitY further released a Business Requirement Document (“BRD”) for Consent Management, aiding the early planning that businesses will be making in the wait for the DPDP Act’s effective date. Whilst not legally binding, it does offer clear guidance for businesses looking to align their technical implementations with the expected legal standards set by the DPDP Act. Crucially, the BRD provides support in developing a functional Consent Management System (“CMS”), designed to enable transparent, revokable and lawful consent from individuals, maintaining compliance with the DPDP Act.
II. OBJECTIVES OF CMS
The CMS serves three primary purposes:
- Consent Lifecycle Management – to track the entire lifecycle of consent (collection, validation, updates, renewal and withdrawal) and keep a record of this activity as evidence of compliance.
- Empowerment of Individuals – to allow individuals whose data is being used (“Data Principal”) greater accessibility in managing consent preferences and data rights through the development of a user-centric interface.
- Regulatory compliance – to ensure adherence to legal obligations, such as purpose limitation, data minimisation and audit readiness.
III. CORE COMPONENTS OF AN EFFECTIVE CMS
1. Consent Lifecycle Management
To properly manage consent lifecycles, each stage must be diligently addressed:
1.1 Consent Collection
a. Consent must be explicit in invitation, specific only to the communicated purpose of consent collection, and require affirmative voluntary action from the user.
b. It should have granular purpose selection, giving users clear, separate options to consent or reject different purposes or types of data processing.
c. It should offer support for multilingual notices when asking for consent.
d. It should support WCAG-compliant designs for users with disabilities to ensure inclusive access to consent rights.
1.2 Consent Validation
a. Verifies whether consent exists before allowing data to be processed.
b. Ensures that only the items Data Principals select and consent to can be used for processing.
c. Provides real-time API responses that are encrypted and time-stamped to either approve or reject processing based on consent status.
1.3 Consent Updates
a. Enables Data Principals to revise consent preferences when purposes change or are added.
b. The CMS must notify users of such changes, track modifications, and update Consent Artifacts accordingly.
1.4 Consent Renewal
a. Designed for time-bound consents, where an individual or business can use data only for a specific, limited period.
b. The CMS must issue renewal prompts before expiry and log the updated consents after renewal.
1.5 Consent Withdrawal
a. Data Principals have the right to withdraw their consent for one or more specific purposes at any time.
b. The process of withdrawing consent should be simple.
c. Users must be informed of their right to withdraw consent and the procedure to do so before initial consent is collected.
d. Withdrawal should take immediate effect — data processing should stop for that Data Principal.
e. Data should be deleted where applicable, and any third parties to whom data was shared must be informed about the withdrawal of consent.
2. Consent Notifications
2.1 User Notifications
a. Consent approvals, withdrawals, renewals, and data request updates must be communicated via email, SMS, or in-app notifications, based on the user’s preference.
2.2 Processor Notifications
a. Data processors must receive real-time alerts for consent changes through secure APIs.
b. This ensures immediate and appropriate adjustments in data processing activities.
3. User Dashboard
3.1 Dashboard Capabilities
a. Allows users to view detailed consent history.
b. Enables users to modify or revoke consent instantly.
c. Provides users with the ability to raise grievances or request data access, correction, or erasure.
3.2 Security Requirements
a. Dashboards must support secure downloads of user data.
b. All downloadable data should be encrypted and protected from unauthorized access.
4. Grievance Redressal Mechanism
4.1 Complaint Logging and Tracking
a. Allows Data Principals to raise complaints related to consent violations or misuse.
b. Enables requests for data access, correction, or erasure.
c. A unique reference ID should be generated for each complaint.
d. Real-time status updates must be provided to users.
4.2 Escalation Workflow
a. Consent-related issues should be triaged according to urgency and complexity.
b. An escalation workflow must be in place to ensure appropriate handling of technical or unresolved issues.
c. Actions taken to resolve the complaint must be logged.
d. Optional post-resolution feedback can be collected to improve the process.
5. Logging and Audit Trails
Every consent-related activity must be logged in a structured and immutable format to support compliance and dispute resolution.
a. Each log entry should include the user ID, purpose, action type, timestamp, and cryptographic audit hash.
b. Logs must be tamper-proof and immutable.
c. Logs should support regulatory audits and ensure transparency in case of any consent-related disputes.
IV.CONCLUSION
A well-designed Consent Management System is not yet a compliance requirement under the DPDP Act, 2023; it is however, central to building digital trust and taking the utmost care in data protection both for the users and business. The BRD outlines a clear path forward for organizations to operationalise consent in a structured, secure, and legally compliant manner. By embedding user-centric design, robust logging, and real-time integrations, organizations can proactively manage consent while aligning with India’s evolving data protection landscape.
