DPDP Consent Audit Checklist: Is Your Consent Valid?

DPDP Consent Audit Checklist: Is Your Consent Valid?

The Digital Personal Data Protection (DPDP) Act, 2023, places strict requirements on how Indian businesses collect and manage personal data consent. Invalid consent can lead to significant penalties, making a thorough audit essential.

This checklist provides actionable steps to evaluate if your current consent mechanisms comply with DPDP. Sushant Pasamarty, founder of Meridian Bridge Strategy, recommends reviewing these areas regularly.

Phase 1: Initial Consent Collection Audit

Verify the initial touchpoints where you collect personal data. Consent must be free, specific, informed, unconditional, and unambiguous.

1. Action: Identify all data collection points (forms, cookies, sign-ups).
   Owner Role: CTO/Product Manager
   Time Estimate: 1-2 days
   External Cost (if needed): Part of Data Mapping (₹1.5L – ₹3L)
   MBS Tier: Data Mapping
2. Action: Confirm consent is sought for each specific purpose of processing.
   Owner Role: Legal/Compliance Officer
   Time Estimate: 2-3 days
   External Cost (if needed): Part of DPDP Readiness Audit (₹2L – ₹6L)
   MBS Tier: DPDP Readiness Audit
3. Action: Check if consent language is clear, concise, and in plain language (not hidden in T&Cs).
   Owner Role: Product/Legal
   Time Estimate: 1-2 days
   External Cost (if needed): Part of DPDP Workshop (₹5L – ₹10L)
4. Action: Verify if Data Principals can give consent through an affirmative action (e.g., ticking a box, clicking a clear button).
   Owner Role: Product Manager
   Time Estimate: 1 day
   External Cost (if needed): Part of DPDP Workshop (₹5L – ₹10L)
5. Action: Ensure you inform Data Principals about their right to withdraw consent and the mechanism to do so.
   Owner Role: Legal/Compliance Officer
   Time Estimate: 1 day
   External Cost (if needed): Part of Full DPDP Consulting (₹7L – ₹12L)

Phase 2: Consent Management & Record-Keeping Audit

DPDP requires you to maintain clear records of consent. This phase focuses on how you manage and document consent throughout its lifecycle.

6. Action: Document the exact date, time, and method of consent collection for each Data Principal.
   Owner Role: CTO/IT Manager
   Time Estimate: Ongoing setup, 3-5 days initial audit
   External Cost (if needed): Part of Full DPDP Consulting (₹7L – ₹12L)
7. Action: Verify if you maintain records of consent withdrawal, including the date and time.
   Owner Role: CTO/IT Manager
   Time Estimate: Ongoing setup, 2-3 days initial audit
   External Cost (if needed): Part of Full DPDP Consulting (₹7L – ₹12L)
8. Action: Confirm that withdrawing consent is as easy as giving it and is effective immediately.
   Owner Role: Product Manager/CTO
   Time Estimate: 2-3 days
   External Cost (if needed): Part of DPDP Workshop (₹5L – ₹10L)
9. Action: Audit if data processing ceases promptly upon consent withdrawal, unless another lawful basis exists.
   Owner Role: Compliance Officer/CTO
   Time Estimate: 3-5 days
   External Cost (if needed): Part of Full DPDP Consulting (₹7L – ₹12L)
10. Action: Review consent mechanisms for children's data, ensuring verifiable parental consent where applicable.
    Owner Role: Legal/Compliance Officer
    Time Estimate: 2-3 days
    External Cost (if needed): Part of DPDP Readiness Audit (₹2L – ₹6L)

Phase 3: Ongoing Consent Compliance Audit

Consent is not a one-time event. This phase ensures your processes support continuous DPDP compliance for consent.

11. Action: Establish a process to periodically review and refresh consent if purposes change or after a significant time.
    Owner Role: Compliance Officer
    Time Estimate: Ongoing policy, 1 week setup
    External Cost (if needed): Part of Full DPDP Consulting (₹7L – ₹12L)
12. Action: Verify that third-party vendors (data processors) you share data with are also operating on valid consent or a lawful basis.
    Owner Role: Compliance Officer/Procurement
    Time Estimate: Ongoing, 1-2 weeks for initial vendor audit
    External Cost (if needed): Part of Vendor Audit Checklist / Full DPDP Consulting (₹7L – ₹12L)
13. Action: Ensure your privacy policy clearly articulates data processing purposes and consent requirements.
    Owner Role: Legal/Compliance Officer
    Time Estimate: 2-3 days
    External Cost (if needed): Part of DPDP Workshop (₹5L – ₹10L)
14. Action: Test the user experience for giving and withdrawing consent to ensure it is intuitive and frictionless.
    Owner Role: Product Manager/UX Designer
    Time Estimate: 2-3 days
    External Cost (if needed): Part of DPDP Workshop (₹5L – ₹10L)

What This Consent Audit Costs Your Business

Performing a comprehensive DPDP consent audit can be done in-house, but it requires dedicated time, legal expertise, and a deep understanding of DPDP nuances. Many Indian businesses find external expertise more efficient.

The cost reflects the depth of analysis and support. Simple identification of collection points (Data Mapping) is less intensive than implementing new consent flows and training your team (Full DPDP Consulting).

Next Step: Validate Your Consent Strategy

Valid consent is the cornerstone of DPDP compliance. An incomplete or incorrect consent framework leaves your business vulnerable. Use this checklist to begin your audit, then consider your next steps.

Sushant Pasamarty, founder of Meridian Bridge Strategy, offers tailored services to ensure your consent practices are robust and compliant. From identifying your data flows to implementing a full consent management system, MBS provides clear, actionable pathways.