Consent under India's DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, after a notice stating what data is used and why. When an AI agent processes the data, consent must cover each purpose the agent serves, and the fiduciary must be able to prove it. Withdrawal must stop the agent too.
What does the Act require for consent and notice?
The Digital Personal Data Protection Act 2023 makes consent the main ground for processing personal data, alongside a set of legitimate uses. In substance:
- consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the data necessary for the specified purpose;
- any request for consent comes with, or after, a notice stating the personal data and the purpose, how to withdraw consent and exercise rights, and how to complain to the Data Protection Board;
- the notice and request must be in clear and plain language, and available in English or any of the scheduled Indian languages;
- withdrawal must be as easy as giving consent, and once consent is withdrawn the fiduciary and its processors must stop processing within a reasonable time;
- registered consent managers can give data principals one place to give, review and withdraw consent;
- if challenged, the fiduciary must prove that notice was given and consent obtained.
Legitimate uses allow processing without consent in listed cases, such as where a person voluntarily provides data for a specified purpose and has not objected. For the Act overall, see DPDP Act and AI agents in India.
Who has to obtain consent?
The data fiduciary: the organisation deciding the purpose and means of processing. If it uses a vendor's agent, the vendor is usually its processor, and the fiduciary remains responsible for consent. That wider responsibility is covered in DPDP Act data fiduciary duties for AI agent deployers.
What changes when an agent collects consent or relies on it?
Agents interact with people in chat and voice, which makes them a natural place to ask for consent, and a risky one.
Clear affirmative action in conversation. A customer saying "okay" in the middle of a chat about a delayed refund is not a clear, specific consent to use their data for a credit offer. If an agent asks for consent, the request should be separate from the task, name the purpose, and record an unambiguous yes. A button or explicit confirmation is safer than inferring consent from free text.
Specific, not bundled. "We use your data to serve you and improve our services" covers too much. If the agent's conversations are used to improve the agent, that is a separate purpose and needs its own consent or ground.
Purpose at the capability. Consent for one purpose does not cover another just because the same agent handles both. A service agent with consent to resolve a complaint should not use that data to profile the customer for marketing.
Voice. Consent given by voice must be recorded well enough to prove later. Whether to ask before recording at all is discussed in should a support agent ask for consent before recording a conversation.
Withdrawal reaching the agent. When a customer withdraws, the agent must lose access to the data for that purpose, and erasure must reach its memory, summaries and indexes.
How do you meet the consent duties when agents are involved?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Notice before or with the request | Agent presents approved notice text before asking | Conversation record showing notice |
| Plain language and scheduled languages | Notices approved in each language the agent uses | Approved notice versions |
| Clear affirmative action | Consent captured by explicit confirmation, not inferred from free text | Consent record with time, channel and words used |
| Specific purpose | Separate consent per purpose; agent cannot bundle | Purpose list per consent record |
| Limited to necessary data | Agent capability can reach only the data the purpose needs | Capability-to-data map |
| Easy withdrawal | Customer can withdraw through the agent in the same channel | Withdrawal records |
| Processing stops on withdrawal | Withdrawal changes agent access and triggers erasure | Access change and erasure logs |
| Burden of proof | Consent and notice filed with the conversation | Retrievable consent evidence per data principal |
What will the Board or an auditor ask?
- Show us how this customer gave consent, and what notice they saw.
- How does the agent decide that a customer has consented?
- Are customers asked separately for consent to use conversations to improve the agent?
- Can a customer withdraw consent by telling the agent?
- After withdrawal, how quickly does the agent stop using the data?
- In which languages is the notice available?
What does the consent duty not cover?
It does not apply where a listed legitimate use applies, although the fiduciary must still be confident the use fits. It does not make consent a cure for excessive processing; the data must still be necessary for the purpose. It does not cover non-digital data. And it does not settle sector rules on consent, such as those from RBI for financial data. For the wider map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme limits each agent capability to the sources its purpose needs, so consent for one purpose does not quietly extend to another capability. Consent and notice can be filed with the conversation in the append-only record, giving the fiduciary the proof the Act puts on it, and a withdrawal can remove a capability's access at once.
Questions people ask
Can an AI agent collect consent on our behalf?
Yes, if it presents the required notice, captures a clear affirmative action for a specific purpose, and records it so you can prove it. The fiduciary stays responsible.
Is a customer's message volunteering information consent?
It may fall under the legitimate use for voluntarily provided data, for the purpose they provided it. It does not extend to other purposes.
Do consent managers change how agents work?
They give customers a central place to manage consent. Agents should check the current consent state before using data, including withdrawals made through a consent manager.