Granular Consent

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), granular consent refers to a consent approach where a Data Principal is provided with clear and separate choices for different purposes of processing their personal data. Instead of asking individuals to provide a single broad consent for multiple unrelated activities, granular consent enables individuals to understand and choose which specific processing purposes they agree to.

The DPDP Act requires consent to be free, specific, informed, and unambiguous, with a clear affirmative action by the Data Principal. Organizations acting as Data Fiduciaries need to ensure that consent requests clearly communicate the purpose for which personal data will be processed. Granular consent practices help organizations separate processing purposes, improve transparency, and provide Data Principals with better control over their personal data.

Granular consent is not separately defined as a term under the DPDP Act. However, it aligns with the Act’s requirements around valid consent, purpose-specific processing, and transparency. Data Fiduciaries should ensure that consent mechanisms are designed in a manner that allows individuals to understand the purpose of processing and make informed choices.

In practice, gaps emerge when:

• Organizations combine multiple processing purposes into a single consent request.
• Consent notices do not clearly explain individual processing activities.
• Data Principals cannot easily understand what they are agreeing to.
• Consent records do not capture purpose-specific choices.
• Organizations continue processing personal data after consent preferences change.

Organizations address these challenges by designing clear consent journeys, separating processing purposes, maintaining consent records, enabling preference management, and ensuring that consent withdrawal is supported. Within Privy, capabilities such as consent management, preference workflows, consent tracking, and compliance reporting help organizations manage consent processes and maintain visibility into Data Principal choices.