Consent Mechanism Checklist

Substantive consent obligations under the DPDP Act take effect on 13 May 2027. Rule 3 of the DPDP Rules 2025 sets out what a consent notice must contain, Rule 4 introduces the Consent Manager framework effective November 2026, and Section 6 of the Act sets out what valid consent looks like. The implementation is not a single banner — it is a chain that runs from the notice text, through the consent capture event, through the retained record, through the granular toggles per purpose, through the withdrawal mechanism, through the downstream-processor notification, and into the audit log. For a retail bank with consumer apps, web, branch journeys, partner channels, and IVR, each channel needs its own compliant flow, in English plus every Eighth Schedule language relevant to its customer base, with full audit traceability per channel. The checklist below covers the practitioner-side preparation for designing, deploying, and proving a compliant consent chain.