Frequently Asked Questions about DPDP Consent Management
A: A Consent Manager is a specialized entity registered with the Data Protection Board (DPB) that acts as a single point of contact for users (Data Principals). Our tool serves as a bridge, allowing users to give, review, and withdraw consent across multiple platforms through a transparent, interoperable interface.
A: Likely not. The DPDP Act requires a Section 5 Notice that is specific and available in multiple languages. Unlike traditional policies, your notice must clearly state:
- The specific items of personal data being collected.
- The exact purpose of processing.
- How a user can exercise their rights or file a grievance.
- The contact details of your Data Protection Officer (DPO).
A: The stakes are high. Failure to obtain valid, informed consent or failing to provide a withdrawal mechanism can lead to penalties of up to ₹50 Crore per instance. In cases of data breaches resulting from poor security safeguards, fines can reach ₹250 Crore.
A: Section 6 of the DPDP Act mandates that withdrawing consent must be as easy as giving it. Our tool provides a “One-Click Withdrawal” toggle in the user’s preference center. Once a user withdraws consent, our system automatically triggers a notification to your data processors to stop processing and erase the data.
A: Yes. For existing users, you must send a fresh notice as soon as the Act’s relevant sections are enforced. This notice must describe the data you already have and the purpose for which it is being used, giving the user the option to continue or opt out.
A: If your business processes data for users under 18, the Act requires verifiable consent from a parent or legal guardian. Our platform includes built-in age-gating and OTP/Aadhaar-based verification workflows to ensure you meet the strict requirements of Section 9.
A: Only if that data is strictly necessary for the service. For example, a food delivery app can deny service if a user refuses to provide a delivery address, but it cannot deny service if the user refuses to share their contact list for marketing. Our tool helps you distinguish between “Essential” and “Optional” consent.