What counts as valid consent for processing personal data under the DPDP Act?

The notice accompanying a consent request must be in clear and plain language, itemize the specific personal data being collected, and describe the specific purpose for which it will be processed - a generic privacy policy referenced by a single checkbox does not satisfy this requirement if it bundles multiple unrelated processing purposes into one blanket consent. Each purpose that isn't necessary for providing the core service or function the individual is seeking should ideally have its own separable consent request, so the individual can decline optional processing without losing access to the core service.

Consent must also be as easy to withdraw as it was to give - if a company designs a multi-step consent flow but only offers a single point to withdraw everything at once, or makes withdrawal significantly harder than granting consent, that asymmetry itself can be a compliance gap. For companies already GDPR-compliant, most of this consent architecture will already be in place, but it's worth specifically checking that consent flows aren't relying on legitimate interest or contractual necessity as a substitute for consent in situations where the DPDP Act requires consent as the primary legal basis, since the two laws don't treat processing grounds identically.