Consent notices, preferences and records in one workflow

DPDP consent management for Indian businesses

Give people a clear choice about each purpose for using their personal data. DPDPConsentKit helps you present notices, record choices, make withdrawal accessible and pass preference changes to connected systems.

Take the free readiness check See how it works
Purpose-specific
Clear choices
Language options
Indian languages
Core duties scheduled
13 May 2027
sharmacoaching.inNew student form

Sharma Coaching Centre asks for your consent

Choose what we may use your information for. You can change your choice later.

Change or withdraw choices anytime
Example consent recordIllustrative

    Illustration only. It does not submit or store your choices.

    Consent follows the purpose and the person

    Consent is part of an ongoing relationship. Select a step to see what an organisation should consider at each point.

    What a consent workflow needs to cover

    A banner alone is not a complete consent process. Notices, choices, withdrawal and downstream systems need to work together.

    Explain the purpose clearlySections 5 and 6

    Tell people what personal data is involved and why it will be processed, in clear language and with the required information.

    Prepare a separate, understandable notice for each purpose.

    Keep optional choices voluntarySection 6

    Consent should be free, specific, informed, unconditional and unambiguous, and indicated through a clear affirmative action.

    Keep optional marketing or analytics choices distinct from necessary service activity.

    Offer language accessSection 5

    Give people the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution.

    Review translations for accuracy and fit them to the context where the data is collected.

    Make withdrawal accessibleSection 6(4)

    Provide a way to withdraw consent that is as easy as the way it was given, and stop processing that relied on it when required.

    Route withdrawals to the relevant teams, processors and connected tools.

    Keep evidence of choicesSection 6(10)

    The Data Fiduciary must be able to demonstrate that notice was given and consent was obtained in accordance with the Act.

    Record the choice, purpose, notice version and relevant time, then define access and retention.

    Use the right basis for each purposeSections 4 and 7

    Consent is not the only basis under the Act. Certain specified legitimate uses may apply, depending on the facts.

    Map each purpose and have the organisation review its basis with appropriate advisers.

    A practical way to get started

    Begin with the data and systems you already have. Then design consent around the actual purposes your organisation needs.

    1. Map purposes and data

      List the personal data collected, the purpose for each use, the systems involved and the teams responsible.

    2. Review notices and basis

      Check notice content, language access and whether each purpose relies on consent or another basis under the Act.

    3. Connect choice to action

      Make sure systems respect consent, changes and withdrawals across forms, messaging, analytics and vendors.

    4. Keep records and review

      Retain evidence under a defined policy, handle requests, and revisit the workflow when purposes or systems change.

    Consent workflows for different teams

    Start with the interactions where your organisation collects digital personal data.

    Websites and online stores

    Forms, account sign-up, analytics and marketing preferences.

    Education providers

    Admissions, student communications and parent or guardian flows where applicable.

    Healthcare organisations

    Appointments, patient communications and operational systems.

    Financial services

    Customer onboarding, service communications and optional outreach.

    HR and recruitment

    Candidate applications, talent pools and employee processes.

    Software and SaaS

    Product sign-up, customer preferences and processor workflows.

    Questions about DPDP consent management

    For the wider legal context, read our DPDP Act summary and compliance checklist.

    What is DPDP consent management?

    It is the process of presenting clear information about a purpose, collecting and recording a person’s choice, and honouring later changes or withdrawals.

    Does every use need consent?

    No. Consent is one permitted basis for processing. The Act also describes specified legitimate uses. Identify and document the basis that applies to each purpose in your circumstances.

    Can someone withdraw consent?

    Yes. A Data Principal can withdraw consent, and the way to withdraw should be as easy as the way consent was given. Processing that relied on the consent must stop as required by the Act, subject to other legal requirements.

    Is DPDPConsentKit a registered Consent Manager?

    No. DPDPConsentKit is software for organisations to manage their own consent processes. A registered Consent Manager is a separate role under the Act.

    Does consent software make my organisation compliant?

    No. Software can help with notices, choices and records, but your organisation remains responsible for deciding its purposes, legal basis, integrations and processes. DPDPConsentKit is not legal advice or a certification.

    Make consent easier to manage

    Get a first view of your website’s readiness, or talk with us about consent workflows for your organisation.

    Take the readiness checkBook a demo