By the CoralMetrix team · Bangalore & Chennai · November 2026
Quick answer
India's Digital Personal Data Protection (DPDP) Act, 2023 requires businesses to collect personal data only for a clear purpose, show a privacy notice, obtain valid consent, and let people withdraw it easily. A DPDP consent management system automates this — capturing, storing, proving and honouring consent across your website, apps, email and WhatsApp.
Who does the DPDP Act apply to?
Any organisation that processes digital personal data in India — including companies, startups, apartment associations, CA firms, hospitals, schools and recruiters. It also covers processing outside India when it relates to offering goods or services to people in India. Size does not matter: a 20-person firm collecting customer details through a website form has obligations too.
What valid consent looks like
- Free and specific — given for a stated purpose, not bundled with unrelated terms.
- Informed — preceded by a clear notice of what data is collected and why.
- Clear affirmative action — no pre-ticked boxes or silence-as-consent.
- Easy to withdraw — withdrawing must be as easy as giving consent.
- Provable — you must be able to show when and how consent was given.
How Coral Consent Management helps
Coral Consent Management brings the whole checklist into one platform: consent lifecycle management, PII inventory, privacy risk assessment, vendor management and breach response. It is compliant to the NeGD BRD for DPDP, and our team supports implementation from offices in Bangalore and Chennai. For example, we delivered a consent management implementation for an HR recruitment firm, covering record of processing activities, email and WhatsApp consent campaigns, a personal data register and vendor registration — see our case studies.
7-step DPDP compliance checklist
- 1
Map your personal data
List every place personal data enters the business — website forms, apps, WhatsApp, email, HR and vendor systems — and record it in a personal data register.
- 2
Define a purpose for each data point
Record why each item is collected. Data collected without a clear purpose should be stopped or deleted.
- 3
Publish clear privacy notices
Tell people what you collect, why, how to withdraw consent, and how to complain, in plain language. Notices should be available in English and in Indian languages where needed.
- 4
Capture consent properly
Use unticked checkboxes or explicit actions, separate consent per purpose, and store a timestamped record of every consent.
- 5
Make withdrawal easy
Provide a one-click way to withdraw consent and make sure downstream systems actually stop processing.
- 6
Manage vendors and processors
Register vendors who process data for you and make sure contracts and controls match your obligations.
- 7
Prepare for breaches and audits
Keep an incident response process ready and maintain an audit trail of consents, notices and requests.
Frequently asked questions
What is the DPDP Act 2023?+
The Digital Personal Data Protection Act, 2023 is India's law on how organisations (Data Fiduciaries) collect and process the digital personal data of individuals (Data Principals). It requires a lawful purpose, a clear notice, and in most cases valid consent.
What makes consent valid under the DPDP Act?+
Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data needed for the stated purpose. It must be as easy to withdraw as it was to give.
What is a DPDP consent management system?+
It is software that records who consented to what, when and for which purpose; shows privacy notices; handles withdrawals and requests; and keeps an audit trail you can show to the Data Protection Board of India.
What are the penalties for non-compliance?+
The Act allows the Data Protection Board to impose penalties of up to ₹250 crore per instance for certain failures, such as not taking reasonable security safeguards to prevent a personal data breach.
Does a small or mid-sized business need consent management?+
Yes. The Act applies to any organisation processing digital personal data in India, regardless of size. Businesses that collect customer, employee or candidate data through forms, apps, email or WhatsApp need a reliable way to capture and prove consent.
Get DPDP-ready
Book a free 15-minute consultation with our DPDP team in Bangalore or Chennai.
Book a Free ConsultationThis article is general information, not legal advice. Please consult the Act, the DPDP Rules and a qualified advisor for your specific situation.