Lawful basis, notice and consent — the mechanics — DPDPA Learning

When you need consent, what the notice must contain, and the 'legitimate uses' you can rely on.

Two lawful grounds — that's all

You may process personal data only:

With the Data Principal's consent, or
For certain legitimate uses listed in the Act.

There is no GDPR-style "legitimate interests" balancing test. If a purpose isn't a listed legitimate use, you need consent.

Certain legitimate uses (no consent needed)

Data the individual voluntarily provided for a specified purpose and has not indicated they object to (e.g., handing a card at reception to be contacted).
The State providing subsidies, benefits, services, licences, permits or certificates.
Performance of a legal obligation or a court order.
Responding to a medical emergency, epidemic, disaster or public-order breakdown.
Employment purposes — safeguarding the employer from loss/liability, preventing corporate espionage, maintaining confidentiality, providing services/benefits sought by the employee.

Employment is the one most organisations lean on. It is narrower than it looks: monitoring for security is in; using employee data for marketing a new product is not.

The notice (Section 5 + Rules)

Every request for consent must be accompanied or preceded by a notice, in clear and plain language, available in English or any of the 22 Scheduled languages, that gives:

an itemised description of the personal data,
the specified purpose for each,
how the Data Principal can exercise rights (withdraw consent, access, correction, erasure, grievance),
how to complain to the Data Protection Board.

The Rules require the notice to be a standalone, self-contained document — not buried in terms of service — with the exact link/steps to withdraw.

Consent must be

Free — no detriment for refusing beyond not getting the service that needs the data.
Specific — one purpose per consent; bundling "marketing" with "account creation" fails.
Informed — the notice above.
Unconditional & unambiguous — clear affirmative action.
As easy to withdraw as it was to give. After withdrawal you must stop processing within a reasonable time and instruct Processors to do the same, unless retention is required by law.

Legacy data: for personal data collected before the Act with consent, you must serve the notice "as soon as reasonably practicable" — and may continue processing until consent is withdrawn.

Practical patterns

Consent ledger: store notice version, purpose IDs, timestamp, channel, evidence artefact.
Purpose taxonomy: a controlled list your product, legal and engineering teams share.
Withdrawal API: withdrawal must propagate to every Processor — model it as an event.
Consent obtained through a Consent Manager is treated as given directly to you.