Consent as a Technical Artefact, Not a Checkbox
The DPDP Act requires consent to be free, specific, informed, unconditional, and unambiguous, expressed through a clear affirmative action. That standard rules out pre-ticked boxes and bundled consent buried in a terms-of-service wall of text. Practically, your consent capture needs to record exactly what was agreed to, generate a time-stamped consent artefact for every capture event, and make withdrawal exactly as easy as granting — the same bar Malaysia's PDPA sets, applied here to a different statute with its own enforcement mechanism.
Data Fiduciary Obligations, Engineered
- Itemised notices: Each purpose for processing needs its own clear notice — not one blanket disclosure covering everything you might ever do with a user's data.
- Purpose-based retention: Retention periods are tied to the specific purpose data was collected for, which means your deletion jobs need to key off purpose, not just a single account-level retention clock.
- Reasonable security safeguards: Encryption, access controls, and monitoring sized to the sensitivity of the data — the Act doesn't prescribe a specific standard, but "reasonable" is judged against what a comparable organisation would implement, not the minimum you can justify after the fact.
- Verifiable parental consent: Products handling data belonging to children require a verifiable consent mechanism from a parent or guardian — a materially harder problem than adult consent capture, and one that needs a designed verification flow, not an age-gate checkbox.
The 72-Hour Breach Notification Clock
Breach notification is required within 72 hours of becoming aware of a personal data breach. That timeline only works if your systems can actually detect and scope a breach fast — logging, anomaly detection, and a rehearsed incident response process need to exist before an incident, not get built during one.
The Consent Manager Framework — What's Coming
The DPDP Rules introduce a Consent Manager framework: a registered intermediary through which individuals can view and manage the consents they've granted across data fiduciaries. Phase II of this framework — Consent Manager registration — takes effect from 13 November 2026. The Business Requirement Document behind it specifies secure APIs for interoperable communication between data fiduciaries, consent managers, and data principals, with encryption and time-stamped consent artefacts as baseline requirements. If your consent architecture already produces structured, timestamped records rather than a single boolean flag, integrating with a Consent Manager later is a much smaller lift.
"The DPDP Act rewards teams that treat consent as structured data from day one. Retrofitting itemised, timestamped consent onto a system built around a single 'agreed to terms' flag is a rebuild, not a patch."
The Practical Engineering Checklist
- Purpose-itemised consent capture: Structured records per purpose, not a single blanket agreement flag.
- Time-stamped consent artefacts: Every consent event logged with what was agreed to, when, and under which notice version — built for eventual Consent Manager interoperability.
- Purpose-keyed retention jobs: Automated deletion or anonymisation tied to the specific purpose's retention window, not a single account-level timer.
- Role-based access control: Particularly for administrative accounts, which the DPDP technical guidance calls out specifically.
- Verifiable parental consent flow: A designed verification mechanism if your product's users could plausibly include children — not an unverified age checkbox.
- 72-hour breach response rehearsal: A tested incident process that can detect, scope, and notify within the statutory window, not just a policy document describing one.
We build compliance architecture for regulated and data-sensitive products across Malaysia, Singapore, and India — the specific statutes differ, but the underlying discipline of structured consent, purpose-bound retention, and rehearsed breach response carries across all three. If you're building for an Indian data fiduciary or expanding an India-built product into a market with its own separate data protection law, we're happy to walk through what changes and what doesn't.
