TL;DR

• Set up your Consent Collection system following the BRD-CMS guidelines and gather consent
• Work with a government-registered Consent Manager so people can handle their consent for many businesses from a single dashboard. Under the DPDPA, businesses must get clear, informed, and specific consent before they collect personal data.
• Identify every spot where your business collects personal data, such as your website, mobile apps, employee portals, and offline forms. Check your website for first-party and third-party cookies.
• Show a cookie consent banner that allows visitors to pick which categories they accept. Find every form in the customer journey where personal data is collected, such as registration, lead generation, loan application etc.
• At each collection point, note the personal data you gather and state why you collect it in clear, simple words.
• Show a consent notice before you collect personal data. Begin processing data only once the person has given consent. Make your consent notice WCAG-compliant and offer it in the languages your customers speak. Add contact details for your Data Protection Officer, Consent Manager, and grievance redress team.
• Keep every consent record in a secure, tamper-proof, machine-readable consent repository for at least seven years.
• Create a self-service preference centre so people can view and update their consents at any time.

If your business gathers personal data in India via a website, mobile app, or any other means, you have to follow the DPDPA,2023 and the DPDP Rules, 2025. The law says you must plainly state what personal data you collect and why, and get informed consent before you process it. We have created guide that breaks the consent collection process down into nine easy steps that business, legal, and technical teams can use to set up a consent management process that complies with the DPDPA.

Step 1: Find Out Where your Business Need to Collect Consent

Find all the places where your business gathers personal data from people. This covers your website, mobile apps, employee portals, customer support channels, and paper forms that get digitized afterward.

Step 2: Scan and Collect Consent for Cookies

Identify all the places where your business gathers personal data, such as your website, mobile apps, employee portals, support channels, and paper forms that have been digitized. Make a full list of every point where data is collected, since you cannot protect data you do not know is there.

Check your website to find every cookie, including ones placed by outside services such as analytics and advertising tools. Next, add a cookie consent banner that plainly describes each cookie category and allows visitors to pick what they agree to. Keep a record of every consent choice along with a timestamp, and make sure non-essential cookies stay blocked until the visitor agrees.

Step 3: Identify places where you should Collect Consent

Go through your customer journey and find every page or form that gathers personal data. This covers sign-ups, lead generation, loan applications, careers pages, contact forms, and profile updates. Handle each collection point on its own, since the data gathered and its purpose can vary.

Step 4: List the Exact Data You need to Collect Consent

At every collection point, write down all the personal data fields you gather, like name, email address, phone number, or identity details. Gather only the information needed for the purpose you stated, and take out any fields that are not truly required.

Step 5: Work With Your Legal Team to Write Honest, Simple Consent Statements

Partner with your legal team to spell out the exact reason for gathering personal data at each point where you collect it. State each purpose using plain, easy-to-understand words, and ask for consent for each one on its own rather than lumping several purposes into one consent choice. Below is the contrast between an incorrect approach and a correct one.

Sample of a wrong statement: “By submitting this form, you agree to our terms and allow us to use your information as described in our privacy policy and for any other business purposes.” This is wrong since it is unclear, it groups several unrelated purposes into one, and it conceals the actual reasons behind a link that hardly anyone opens.

Sample of a right statement: “We will use your phone number to send you an OTP to verify your identity. We will use your email address to send you your loan approval status. You may separately decide whether we can also send you offers on other products.”

Spell out each purpose clearly, tie it to the exact personal data you gather, and let people give consent for each purpose on its own. Keep a record of every purpose statement, including when it was approved and who approved it, so you can show compliance if a regulator asks.

Step 6: Build a DPDPA-Compliant Notice and Show It Before You Collect Anything

Display a consent notice before collecting any personal data. Show the notice, obtain consent, and only then begin collecting and processing the data. Do not collect or process personal data before the individual has given consent.

Step 7: Make Sure Your Notice Is Accessible to Everyone

Design consent notices that are easy to understand and accessible to everyone. Follow WCAG accessibility guidelines, provide notices in the languages your customers use, and include contact details for your Data Protection Officer, grievance redress team, and, where applicable, your registered Consent Manager.

Step 8: Store Consent Records Safely for at Least Seven Years

Record every consent event—whether given, refused, or withdrawn—in a structured, machine-readable format. Store these records in a secure, tamper-evident consent repository that maintains a complete history of every change. Retain consent records for at least seven years and protect them from unauthorised access, as they serve as key evidence of your compliance.

Step 9: Build a Preference Centre So People Can Manage Their Own Consent

People change their minds, relocate to new cities, take different jobs, and no longer want certain kinds of messages. The law says your business must make it just as easy for them to take back consent as it was to give it. A preference centre is an easy self-service page. There, a customer who is logged in can view all the consents they have given, see what each one means in simple words, and turn any of them on or off whenever they like. This one page does two jobs: it builds trust with your customers, since they feel in control, and it keeps your consent repository up to date on its own, because every change goes straight back into your records.

Step 10: Connect With Government-Approved Consent Managers

Under the DPDP Rules and it is expected that Consent Manager integration will be requirement in near future. A registered Consent Manager lets people see, give, take back, and handle their consents with many organizations, all from one platform. Your business can create its own consent management system, but to work as a recognized Consent Manager, you have to register with the Data Protection Board of India and meet the eligibility and operational rules set out in the DPDP Rules.

Bringing It All Together

The biggest change the DPDPA requires of every business is a shift in how you think, not just a shift in technology. Rather than gathering data first and explaining later, you must now explain first, using clear and simple words, and collect data only after someone has truly understood and accepted your request. Every step in this guide, from listing your assets to working with a Consent Manager, is there to back one simple promise: people should always know what is being done with their information, and they should always be the ones making the choice.

Begin with something small if the whole picture feels like too much. Choose the one place where you collect the most data, like your registration page, and go through all nine steps for that page alone first. Once you see how the process works from start to finish on a single page, doing the same across the rest of your business feels much easier, and your organisation will be well on its way to meeting the standards set by the Digital Personal Data Protection Act, 2023 and its 2025 Rules

Frequently Asked Questions

1. What is the DPDPA, and who does it apply to?

The Digital Personal Data Protection Act, 2023 (DPDPA) is India’s primary data privacy law. It applies to any organisation that collects or processes the personal data of individuals in India, regardless of where the organisation is located. This includes websites, mobile apps, employee systems, and other business processes that handle personal data.

2. Do small businesses also need to follow these consent rules?

Yes. The DPDPA applies to businesses of all sizes that collect or process personal data. While the scale of your compliance may vary, every business must obtain clear and informed consent before processing personal data.

3. What is the difference between a privacy policy and a consent notice?

Understand the difference between a privacy policy and a consent notice. A privacy policy explains your organisation’s overall data practices, while a consent notice explains why you are collecting specific personal data at the point of collection. Display the consent notice before collecting personal data, as a privacy policy alone is not sufficient under the DPDPA.

4. Can I collect consent for multiple purposes using a single tick box?

No. Collect consent separately for each distinct purpose. This allows people to agree to some purposes and decline others. Do not combine unrelated purposes, such as service delivery and marketing, into a single consent option.

5. What happens if someone withdraws their consent?

Allow people to withdraw consent as easily as they gave it. Once they withdraw consent, stop processing their personal data for that purpose as soon as reasonably possible and record the withdrawal with a timestamp in your consent repository.

6. How long do we need to keep consent records?

Store all consent records—including consent given, denied, and withdrawn—in a secure, tamper-evident system for at least seven years. Maintain these records as evidence to demonstrate compliance during regulatory reviews.

7. Do we need to translate our consent notices into regional languages?

Provide consent notices in the languages your customers understand. Offering notices in commonly used Indian languages helps people make informed decisions and ensures everyone can understand what they are consenting to.

8. What is a Consent Manager, and is it recommended for every business?

Integrate with a government-registered Consent Manager so people can view and manage their consents across multiple businesses from a single platform. Most businesses only need to support integration with registered Consent Managers rather than becoming one themselves.

9. Is cookie consent the same as DPDPA consent?

Treat cookie consent as part of your broader DPDPA consent process. Clearly explain what each cookie category does, let visitors choose which categories to accept, record their choice, and honour it immediately.

10. What should we do first if we have not started DPDPA compliance yet?

Start with your highest-traffic data collection point, such as your registration or sign-up page. Document the data you collect, display a compliant consent notice, and record consent. Once the process works for one page, repeat it across the rest of your business.

This article is for general guidance only and does not constitute legal advice. Always consult a qualified data protection lawyer to confirm how the DPDPA applies to your specific business.