What Is This Module For?
The Consent Management module helps you collect, store, track, and honour consents from individuals whose personal data you process — as required under the DPDP Act, 2023.
Which Law Requires This?
- DPDP Act 2023, Section 6 — Consent must be a clear affirmative action. Bundled consents are not valid.
- DPDP Act 2023, Section 7 — Legitimate uses where consent is not required (employer-employee, emergency, legal obligation).
- DPDP Rules 2025, Rule 3 — Notice must be in plain language stating what data is collected, for what purpose, and how to withdraw consent.
Penalty: Processing personal data without valid consent can attract penalties up to ₹250 crore for significant data fiduciaries.
Step-by-Step Guide
- Go to Consent Management in the sidebar.
- Create a Consent Purpose — enter purpose name, data categories, legal basis, and retention period.
- Deploy the Consent Widget — copy the embed code and add it to your website.
- View Consent Records — see who gave consent, when, for what purpose, and current status.
- Handle Withdrawal — dcomply records the withdrawal timestamp and flags the 7-day SLA to stop processing.
- Run the Purge — delete consent records that have exceeded the retention period (required by Section 8(7)).
Common Mistakes to Avoid
- One consent for all purposes — Each distinct processing purpose needs its own consent.
- Pre-ticked checkboxes — Consent must be an active affirmative act.
- Ignoring children — If any data subjects might be under 18, use the Children's Data module alongside this one.
Frequently Asked Questions
Q: Do we need consent for employee data?
A: Generally no — employment contracts create a legitimate use basis under Section 7(b).
Q: What happens when consent is withdrawn?
A: You must stop processing data for that specific purpose. Future processing must cease immediately.