Skip to content
VITI Security
Contact

DPDP Act 2023

DPDP Consent Readiness Checker

Is your consent flow DPDP-ready? Check notice, withdrawal, language and dark-pattern requirements.

What valid consent means

Section 6 of the Digital Personal Data Protection Act says consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action, and limited to the personal data needed for the stated purpose. If there is ever a dispute, it is for you to prove that notice was given and consent obtained (s.6(10)).

The notice comes first

Before or when you ask for consent, you must give a notice (s.5). Under Rule 3 it must make sense on its own and describe the personal data item by item, the specific purpose, and how the person can withdraw consent, exercise their rights and complain to the Data Protection Board. People can ask to read it in English or in any language in the Eighth Schedule to the Constitution.

Withdrawal must be as easy as consent

Withdrawing consent must be as easy as giving it (s.6(4)). A one-click opt-in paired with an email-us opt-out does not meet that. After withdrawal you must stop processing, and have your processors stop, within a reasonable time.

Other rules that shape a consent flow

  • Children: verifiable consent from a parent for anyone under 18, and no tracking, behavioural monitoring or targeted advertising directed at children (s.9).
  • Certain legitimate uses: a few situations, listed in s.7, allow processing without consent. Most commercial processing still needs it.
  • Consent Managers: registered intermediaries through which people give, manage and withdraw consent. Registration opens on 13 November 2026 (Rule 4).
  • Dark patterns: the Central Consumer Protection Authority's 2023 guidelines prohibit 13 specified patterns, including false urgency, confirm shaming, forced action and nagging. Consent flows that use them invite trouble under consumer law as well.

When it applies

The consent and notice duties apply from 13 May 2027, with the rest of the DPDP Rules. Penalties for the general obligations go up to ₹50 crore, and up to ₹200 crore for children's data. Read the DPDP Act and Rules 2025 guide or see our DPDP compliance services.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Each of the eight questions is one consent requirement drawn from the DPDP Act (ss.5, 6 and 9), the DPDP Rules 2025 and, for dark patterns, the Central Consumer Protection Authority’s 2023 guidelines; each Yes counts as one in place.
  2. Readiness = requirements in place divided by eight, rounded to a whole percentage. 80% or more is green, 50% to 79% amber, below 50% red.
  3. Every No becomes a gap note explaining the risk, including the relevant Schedule ceiling where one applies.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Weight per requirement
Equal (12.5 percentage points each)
Colour thresholds
Green from 80%, amber from 50%

Worked example

The calculator run on its default inputs:

Consent is free, specific, informed, unconditional & unambiguous
No
Clear notice with itemised description of data & purposes
No
Withdrawing consent is as easy as giving it
No
Consent Manager support planned or implemented
No
Verifiable parental/guardian consent for children
No
Notice available in English + 22 scheduled languages (on request)
No
Consent records maintained (who, when, for what)
No
No dark patterns in the consent UX
No

0/8 controls in place

0% ready

Controls in place
0 of 8
Gaps to close
8
Readiness
0%

All eight answers default to No, so the result is 0/8 controls in place (0% ready) with eight gaps listed. Seven Yes answers (88%) are the first result in the green band.

Sources

Sources last checked September 2026.

Limitations

Consent is only one lawful basis: s.7 lists legitimate uses that need no consent, which this checker does not assess. A Yes cannot show whether your notice and flow actually meet the standard, and the Rules add detail on notice content and children’s consent that a checklist compresses. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.