What Is the DPDPA?
India's data protection legislation, known as the Digital Personal Data Protection Act, 2023 (DPDPA), received Presidential assent on August 11, 2023. As India's first comprehensive data protection law, the DPDPA replaces the limited provisions previously contained in Section 43A of the Information Technology Act, 2000.
The DPDPA altered the rules for organizations that use clickwrap agreements with users in India. Two features distinguish the law from other consent regimes: the Section 6 requirement that consent be unconditional, prohibiting non-essential processing as a precondition for service access, and the introduction of Consent Managers, registered intermediaries that allow individuals to manage consent across services from a single accessible platform.
Who Does DPDPA Apply To?
The DPDPA applies to every entity, regardless of its location, that processes digital personal data of individuals in India. Both Data Fiduciaries (entities that determine the purpose and means of processing) and Data Processors that process data on their behalf are within scope.
The DPDPA is applicable when you:
- Process digital personal data of individuals located in India.
- Offer goods or services from outside India to data principals within India.
- Process personal data collected offline in India and subsequently digitized.
There is no general small-business exemption, though the Central Government may exempt classes of Data Fiduciaries through notification. Organizations designated as Significant Data Fiduciaries face additional obligations under Section 10, including a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments. Uniquely, the DPDPA also imposes duties on data principals (Section 15), including not filing false or frivolous complaints.
DPDPA and Clickwrap Agreements
DPDPA imposes specific requirements on how consent is collected through clickwrap agreements. Sections 5, 6, 9, and 11 establish that consent must be free, specific, informed, unconditional, and unambiguous, supported by an itemized notice issued before any consent action. Each condition carries direct implications for clickwrap design, disclosure, and recordkeeping.
How DPDPA Affects Clickwrap Design
Section 6(1) defines consent as a free, specific, informed, unconditional, and unambiguous indication of agreement, given through a clear affirmative action and limited to such personal data as is necessary for the specified purpose. The inclusion of "unconditional," a term largely absent from other data protection statutes, has direct implications for clickwrap interface design.
The unconditional standard, read with the purpose-limitation in Section 6(1), prevents organizations from bundling consent for non-essential processing into a single agreement. A clickwrap flow that requires acceptance of marketing data processing or third-party analytics sharing as a prerequisite for account creation undermines this requirement. Essential-purpose consent must be captured separately from non-essential processing, and users must be able to decline the latter without losing access to the core service.
Consent Managers reshape the consent capture paradigm. Section 6(6) introduces a pathway for Data Principals to give, manage, review, and withdraw consent through a Consent Manager, a registered intermediary that is accountable to the individual under Section 6(7) and registered with the Data Protection Board under Section 6(8). For clickwrap platforms, this means the consent interface cannot be a closed system. Organizations must be technically prepared to receive consent signals from registered Consent Managers, honor consent preferences managed through external platforms, and synchronize consent states across systems.
Section 6(4) requires that withdrawing consent be as easy as giving it. If consent is captured through a single button click, the withdrawal mechanism cannot require navigating multiple settings pages or submitting a manual request. Under Section 6(5), the consequences of withdrawal are borne by the Data Principal, and processing carried out before withdrawal remains lawful.
Section 9 prohibits processing that is detrimental to the well-being of a child and bans tracking, behavioural monitoring, and targeted advertising directed at children. Section 9(1) also requires verifiable parental consent before processing the personal data of a child, so any clickwrap flow involving users who may be minors must include age verification before data collection begins.
What Must Be Shown Under DPDPA
Section 5 requires Data Fiduciaries to provide an itemized notice before requesting consent. The notice is not a general privacy policy. It must be specific, granular, and presented as a discrete step in the clickwrap flow. The itemized notice must contain:
- The personal data the Data Fiduciary intends to collect and the specific purpose for which it will be processed.
- The manner in which the Data Principal may exercise the right to withdraw consent under Section 6(4) and the right of grievance redressal under Section 13.
- The manner in which the Data Principal may make a complaint to the Data Protection Board.
Section 5(2) specifies that if consent has already been given for the same processing activity and the Data Fiduciary retains records, the notice need not be repeated. However, any new purpose or new category of data requires a fresh notice and fresh consent.
The DPDPA does not mandate a specific format, but the requirement that the notice be "itemized" implies a structured, line-by-line disclosure rather than a narrative privacy policy.
What Records You Must Keep Under DPDPA
Section 8(3) requires Data Fiduciaries to maintain the accuracy, completeness, and consistency of personal data, particularly where it is used to make decisions affecting the data principal or is disclosed to another Data Fiduciary. The burden of demonstrating that valid consent was obtained rests entirely on the Data Fiduciary, and Significant Data Fiduciaries face elevated documentation obligations under Section 10, including periodic Data Protection Impact Assessments.
A defensible clickwrap consent record under the DPDPA must capture:
- Subject identity - Verified through the authentication mechanism in place at the consent action.
- Action timestamp - The exact date and time of each consent or withdrawal event.
- Itemized notice - The Section 5 disclosure presented before the consent request, including each data item and its purpose.
- Terms version - The version of the terms or privacy notice in effect at the time of consent.
- Consent mechanism - Whether consent was given directly or via a registered Consent Manager, and which interface element captured it.
- Children's data evidence - Where applicable, evidence of verifiable parental consent.
When consent is given, modified, or withdrawn through a Consent Manager, the Data Fiduciary must maintain synchronized records that reflect the current consent state across both systems. Section 8(7) further requires Data Fiduciaries to erase personal data when the specified purpose has been fulfilled or consent is withdrawn, unless retention is required by law. The clickwrap system must link each consent record to the corresponding personal data holdings so that withdrawal triggers an auditable erasure workflow.