Consent customers can trust. Proof auditors accept.

The Digital Personal Data Protection Act, 2023 is India’s data protection law. It governs how digital personal data is collected and used, gives individuals rights over their data, and makes the companies that process it accountable. The DPDP Rules, 2025 set out the detailed procedures.

It applies to digital personal data processed in India, whether collected online or collected offline and later digitised. It also applies to processing outside India when it is connected to offering goods or services to people in India. Data used for purely personal or domestic purposes, and data a person has made public themselves, are outside its scope.

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. Pre-ticked boxes, silence or inactivity do not count, and a company cannot make an unrelated service conditional on extra consent.

Yes, at any time, and it must be as easy as giving it. After withdrawal, the company must stop processing the data within a reasonable time, and make sure its processors stop too, unless a law requires the data to be kept. Withdrawal does not make processing that already happened unlawful.

An individual can ask for a summary of their data and who it was shared with, have it corrected, completed, updated or erased, withdraw consent, get a grievance resolved, and nominate someone to act for them. If a grievance is not resolved, they can complain to the Data Protection Board.

Yes. An individual must not impersonate someone else, suppress material information when providing data for official documents, or file false or frivolous complaints. Breaching these duties can attract a penalty of up to ₹10,000.

Anyone under 18 is a child under the Act. A company needs verifiable consent from a parent or lawful guardian before processing a child’s data, and must not track, behaviourally monitor or target advertising at children.

A company registered with the Data Protection Board that gives individuals one accessible, transparent and interoperable place to give, manage, review and withdraw consent. It acts on their behalf, is accountable to them, and must avoid conflicts of interest with the companies asking. myconsentapp is a proposed Consent Manager; we are not yet registered with the Board.

Start with the company’s grievance channel, or raise it through a Consent Manager. Companies must respond within the time set by the Rules. If the individual is not satisfied, they can file a complaint with the Data Protection Board of India.

No. It is free for individuals, and always will be. Businesses pay to integrate, which is how it stays free for individuals, without ads or selling data.

If it decides why and how personal data is processed, yes. Vendors that process data on its instructions are Data Processors, but the business remains responsible for what they do with it, so it needs contracts and controls in place. With myconsentapp you register each processor and its contract, and we track every processor’s confirmation that it stopped using or erased the data after a withdrawal or erasure request.

Only for the “legitimate uses” listed in the Act, such as data a person voluntarily gave for a specific purpose and did not object to, legal obligations, medical emergencies, certain employment purposes and some government functions. Everything else needs consent.

The personal data and the purpose it will be used for, how to withdraw consent and exercise other rights, and how to complain to the Board. It must be clear, stand on its own, and be available in English or any of the 22 languages in the Eighth Schedule of the Constitution.

Up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach or meet obligations for children’s data, up to ₹150 crore for breaches by Significant Data Fiduciaries, and up to ₹50 crore for other breaches of the Act.

Inform the Data Protection Board and every affected person without delay. The Rules then require a detailed report to the Board, generally within 72 hours, covering what happened, its likely impact and the steps taken.

A company the Government notifies based on factors such as the volume and sensitivity of data and the risk to people’s rights. It must appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic impact assessments and audits.

Generally yes, except to countries the Government restricts by notification. Sector rules that are stricter, such as RBI requirements for payment data, continue to apply.

The Rules were notified in November 2025 with a phased start: the Board straight away, Consent Manager registration after about a year, and most fiduciary obligations after about 18 months. Building consent, notices and rights handling now avoids a last-minute rush.

No, but the Act lets people give and withdraw consent through one, and the business must honour it. Integrating with a Consent Manager gives it itemised notices, signed records to show an auditor, and withdrawals delivered automatically.