# Informed consent from beneficiaries: oral, assisted and low-literacy consent under DPDP

> The DPDP Act does not require a signature. It requires consent that is free, specific, informed and given by a clear affirmative action, after a notice she can access in English or an Eighth Schedule language, and proof of both (s. 5, 6). A spoken yes recorded in an app, a keypress on a call or a thumbprint per purpose can all work. This guide covers dialect audio, assisted consent, dependence, parents without smartphones, guardians, fundraising photos, records and withdrawal, with illustrative scripts and checklists.

Source: https://dpdp.commons.inc/dpdp-field-consent · Updated 25 October 2026 · By the Commons Trust team (commons.inc)

The DPDP Act does not ask for a signature. It asks that consent be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (s. 6(1)), that it follow a notice she can access in English or one of the 22 Eighth Schedule languages (s. 5(1), 5(3)), and that you can prove both (s. 6(10)). For a woman who cannot read, a notice in Hindi or another Scheduled language played as audio in her own dialect, followed by a spoken yes recorded in an app, a keypress on a call or a thumbprint beside each purpose, can meet that test. These duties apply from 13 May 2027. The harder questions are whether consent from someone who depends on you is free, who consents for children and adults with guardians, and how you keep proof when the work happens on a doorstep.

Like the Act (s. 2(y)), we say "she" and "her" for every person. Where we go beyond the text, we say so.

**Jump to what you need.**

- **Programme heads:** [When she depends on you](#when-she-depends-on-the-service-consent-or-another-basis), [Photos and stories](#photos-videos-and-stories-for-fundraising), [Rollout plan](#rolling-this-out-across-a-programme).
- **Field coordinators and trainers:** [A clear yes without a signature](#a-clear-yes-without-a-signature), [Assisted consent](#assisted-consent-when-a-facilitator-reads-it-aloud), [Field scripts](#illustrative-field-scripts-for-adults-and-for-parents), [Call-back checks](#a-call-back-check-for-consent-quality), [Withdrawal](#withdrawal-in-the-field).
- **MIS and tech teams:** [Recording methods](#recording-methods-and-what-each-record-must-hold), [Paper register](#a-paper-consent-register).
- **Lawyers and DPOs:** [Children](#children-parental-consent-without-smartphones-or-digilocker), [Guardians](#persons-with-disabilities-and-lawful-guardians), [Where the law is unclear](#where-the-law-is-unclear-in-the-field).

The notice itself, with a paper form in English and Hindi and an IVR script, is in our guide on [writing a DPDP notice](/dpdp-consent-notice). The wider NGO picture is in [DPDP for NGOs](/dpdp-for-nonprofits).

## What the Act asks of a field team

| The Act asks | Provision | In the field |
|---|---|---|
| A notice before or with the request: data, purpose, withdrawal, grievance, how to complain to the Board | s. 5(1), Rule 3 | A fixed, versioned script or sheet, read or played to her, and a slip she keeps |
| Notice and request available in English or an Eighth Schedule language | s. 5(3), 6(3) | Hindi, Odia, Santali or another Scheduled language, with dialect audio |
| A clear affirmative action for each specific purpose | s. 6(1) | A spoken yes, keypress, tap or thumbprint per purpose |
| Only the data necessary for the purpose | s. 6(1) | Cut fields before the survey goes out |
| Withdrawal as easy as giving | s. 6(4) | A route as simple as the doorstep conversation |
| A named contact | s. 6(3), Rule 9 | A phone number printed on the slip |
| Proof of notice and consent | s. 6(10) | A record per person, per purpose, per decision |

The Act prescribes no form, signature, witness or medium, so the quality of your evidence is up to you. Paper on its own is outside the Act, but once a form is typed up, photographed or scanned, the data is covered (s. 3(a)(ii)). Plan as if every field form will become digital.

## A clear yes without a signature

Our view of how common field methods measure up against "a clear affirmative action" (s. 6(1)):

| Method | Affirmative action? | Evidence strength | Notes |
|---|---|---|---|
| Spoken yes, audio-recorded in an app after the notice plays | Yes | Strong | Store the clip with the notice version; tell her first that it is recorded |
| She taps "yes" herself on the facilitator's tablet | Yes | Strong if logged | Hand her the device; log that she tapped |
| Keypress on an IVR call after the notice | Yes | Strong | Log the prompt version and each key |
| Thumbprint or signature beside each purpose on a versioned paper form | Yes | Good with a back-check | Digitise with the form version |
| Missed call to a purpose-specific number | Yes, for a simple choice already explained | Moderate | Better for withdrawal than for consent |
| Facilitator ticks a box after she nods | Doubtful | Weak | The act is the facilitator's |
| Hands raised at a village or SHG meeting | Not for individual consent | Very weak | Explain in a group; record each person separately |
| Silence, or "if you don't object" | No | None | The Act has no implied consent |

A yes must be per purpose: one thumbprint at the foot of a form covering enrolment, photographs and research is bundled (s. 6(1)). It must also follow the notice, so the record needs the time the notice was given as well as the time of each answer.

## Language and dialect on the doorstep

The notice must be available in English or a Scheduled language, so a notice only in Bhili, Gondi or another non-Scheduled language does not meet the rule on its own (s. 5(3), 6(3)); the rules and the language list are in the [notice guide](/dpdp-consent-notice#language-english-or-an-eighth-schedule-language). For field teams:

- **Keep an authoritative text** in a Scheduled language the community uses, such as Hindi, Marathi or Odia. This is what you produce to the Board.
- **Deliver dialect audio** translated from that text, under the same version number, played from the app or phone. Every woman then hears the same words, which an improvised translation cannot promise.
- **Test the hard words.** "Share", "delete" and "complain" are where dialect translations drift. Back-translate them and test with ten community members.
- **Record** the Scheduled-language text offered, the audio played, and the language she answered in.

Whether you must be ready to offer any of the 22 Scheduled languages on request is unsettled; our position is in the [notice guide's grey areas](/dpdp-consent-notice#where-the-law-is-unclear-on-notices).

## Assisted consent: when a facilitator reads it aloud

A facilitator, community resource person or volunteer reading the notice, answering questions and recording the answer is lawful. The risks are practical, and each can make consent less free or less informed:

| Risk | What goes wrong | Control we recommend |
|---|---|---|
| Paraphrase drift | The facilitator leaves out withdrawal, or that photos are optional | Play recorded audio, or read a fixed script; spot-check recordings |
| Pressure from targets | Facilitators judged on enrolments push for yes to everything | No targets on optional consents; review yes-rates by facilitator |
| Power and gratitude | She agrees because the facilitator's organisation helps her family | Say that no changes nothing; let her answer to the device |
| Family speaking for her | A husband or mother-in-law answers | Ask her directly; record her answer or none |
| Mistranslation | A dialect word for "share" sounds like "keep safe" | Back-translate; community testing |
| Fabrication | Consent recorded for visits that did not happen | Random call-backs, audio clips, supervisor visits |

Where you can, separate the person who records consent from the person who decides benefits. Monthly call-backs on a random sample (below) are themselves evidence of a reasonable process if a consent is disputed.

## When she depends on the service: consent or another basis

When refusing would cost her food, a scholarship, a loan or treatment, her agreement is hard to call "free" (s. 6(1)). For the data you need to deliver the service, section 7 often gives a more honest basis. Our mapping for field work is below; the grounds in detail are in our guide on [legitimate uses](/dpdp-legitimate-uses).

| Activity | Basis | Why |
|---|---|---|
| Recording her details to give her the service she came for | 7(a), voluntary provision for a specified purpose | She gives the data to receive the service. Tell her the purpose: a "specified purpose" is the one in the notice (s. 2(za)) |
| Relief distribution while a flood or cyclone lasts | 7(h) | Measures to "provide assistance or services to, any individual during any disaster". Longer-term rehabilitation needs another basis |
| Treatment during an outbreak | 7(g) | Medical treatment or health services during an epidemic or threat to public health |
| Medical emergency in a camp | 7(f) | Threat to life or immediate threat to health |
| Delivering a government scheme for a department | Usually as the State's processor under contract (s. 8(2)) | Section 7(b) is for the State and its instrumentalities; a private NGO does not rely on it in its own right |
| Photos, stories, research follow-up, sharing with funders, newsletters | Consent, refusable | None of these is needed to deliver the service |

Section 7(a) has limits. She must not have indicated that she objects; it covers only the purpose she gave the data for; and her rights of access, correction and erasure still apply (s. 11(1), 12(1)).

Our position: rely on 7(a), or a disaster or health ground, for the core service, with a short notice explaining it, and take real, refusable consent for every extra. Make sure that saying no to an extra changes nothing about her support in practice, and check it in your call-backs.

## Children: parental consent without smartphones or DigiLocker

A child is anyone under 18 (s. 2(f)). Before processing any personal data of a child you need the verifiable consent of a parent or lawful guardian (s. 9(1)). Our reading is that this applies whatever the basis, including 7(a), unless a Fourth Schedule exemption covers the processing (s. 9(4), Rule 12). A lawful guardian means one recognised by law, such as a guardian appointed by a court or by a parent's will. You must also avoid processing likely to harm the child's well-being (s. 9(2)), and tracking, behavioural monitoring and targeted advertising directed at children (s. 9(3)).

Rule 10(1) requires due diligence that the person identifying herself as the parent is an identifiable adult, checking both her identity and her age, by reference to:

- reliable details of identity and age you already hold (Rule 10(1)(a)); or
- details of identity and age she provides voluntarily, herself (Rule 10(1)(b)(i)) or through a virtual token from an authorised entity such as DigiLocker (Rule 10(1)(b)(ii)). The illustrations to Rule 10 point to government-issued details for parents new to you.

Finish this check before you process the child's data. Where parents have basic phones or none:

| Field situation | Method | Record |
|---|---|---|
| You hold a family record that shows the parent's age or date of birth, such as a ration card copy listing ages | Match the parent in front of you to it (Rule 10(1)(a)) | "Matched to ages on ration card on file, ref [internal ID]" |
| You hold a record with only the parent's name, such as a school admission form | Not enough: it shows identity, not age. Use another row | — |
| She shows a voter ID card, which only adults hold (Constitution, art. 326) | View it (Rule 10(1)(b)(i)); we recommend not copying it | "Voter ID seen", not the number |
| She shows another document with her date of birth | View it; record the type and that age was checked | Document type, facilitator ID |
| She has no document | A fallback only. Rule 10(1)(b)(i) accepts details "voluntarily provided by the individual", but the Rule's illustrations describe checking a new parent against government-issued identity and age details or a token. Record what she stated plus a known community worker's confirmation, count these cases, and check a document at the next contact. Our view; confidence low | Stated name and age, confirming worker, what is pending |
| A smartphone and DigiLocker are available | Token-based check (Rule 10(1)(b)(ii)) | Token reference |

Do not photograph Aadhaar cards for this. You need to show that you checked, and a copy adds risk without adding proof. Rule 10 checks identity and age; it does not say how to confirm she is this child's parent. We record the basis for the relationship too, such as the name on the school or ration record.

The Fourth Schedule lifts parental consent and the tracking ban only for named classes, such as health establishments and professionals providing health services, and named purposes, such as a duty under law in the child's interest (Rule 12). An NGO's own education or livelihood programme usually fits none of them; our guide on [children's data](/dpdp-childrens-data) goes through each row.

We also recommend asking the child. The Act does not require her assent, but a 14-year-old who does not want her photograph taken should not have it taken because her father agreed.

## Persons with disabilities and lawful guardians

Where a person with disability has a lawful guardian, the guardian gives verifiable consent (s. 9(1)) and is a Data Principal acting for her (s. 2(j)(ii)). Rule 11 requires due diligence that the guardian was appointed by a court, a designated authority under section 15 of the Rights of Persons with Disabilities Act, 2016, or a local level committee under the National Trust Act, 1999.

- **Ask for the appointment order.** Record its type, issuing body and date. A relative who looks after her is not a lawful guardian without one.
- **No guardian means she decides.** An adult with a disability and no appointed guardian is her own Data Principal. Make the notice accessible to her with audio, sign-language video, easy-read pictures and more time.
- **Rule 11 uses a narrow definition.** Both limbs, a long-term impairment or one of the conditions under the National Trust Act, apply only to someone who, despite adequate and appropriate support, is unable to take legally binding decisions (Rule 11(2)(d)). A physical disability alone does not change who consents.
- **Offer nomination.** She can nominate someone to exercise her rights if she dies or becomes incapable (s. 14, Rule 14(4)). This matters most in programmes for older people.

## Photos, videos and stories for fundraising

Using her photograph, video or story in donor reports, social media or appeals is a separate purpose from delivering the programme, and we treat it as needing its own refusable consent (s. 6(1)).

- **Show before you ask.** Show her the photograph or read back the story, and say where it will appear: the annual report, the website, a funder's presentation, Facebook.
- **Name the audience.** "Our donors" and "anyone on the internet" are different decisions.
- **Treat a story as identifying.** Village, caste, illness and a badly blurred face are enough for neighbours.
- **Set an end date,** such as three years (our recommendation), and re-ask after it.
- **Explain withdrawal honestly.** You must stop further use within a reasonable time (s. 6(6)), and earlier use stays lawful (s. 6(5)). You can take a photograph off your website and stop sending it to funders; you cannot recall a printed report or a post others have shared. Tell her before she says yes.

For children, the parent consents verifiably (s. 9(1)) and the duty not to harm the child's well-being applies (s. 9(2)). Other laws can forbid publication whatever anyone consents to. The Juvenile Justice (Care and Protection of Children) Act, 2015 (s. 74) prohibits reports in the media or other forms of communication about any inquiry, investigation or judicial procedure from disclosing details that could identify the children it protects, unless the Juvenile Justice Board or Child Welfare Committee permits it; the POCSO Act, 2012 (s. 23) has a similar bar for child victims, lifted only with the Special Court's permission. A consent that conflicts with another law is invalid to that extent (s. 6(2)).

For group photographs, tell the group before the camera comes out, give anyone who does not want to appear a way to step aside, and do not use group photographs of children without parental consent for each child shown.

## Recording methods and what each record must hold

Section 6(10) puts the burden of proof on you, so every method must leave a record you can produce for one named person, years later. Every consent record should hold:

- the person's programme ID, and for children the parent's ID;
- the notice version, the Scheduled-language text offered, and the audio or language used;
- the channel, device or form number, and the facilitator's ID;
- the time the notice was given and of each answer;
- each purpose and her decision, and how she gave it (voice, tap, key, thumbprint);
- for children, how the parent's identity and age were checked (Rule 10); for guardians, the appointment order (Rule 11);
- any withdrawal: date, route, who processed it.

| Method | Strengths | Weak points | Extra fields |
|---|---|---|---|
| App on a facilitator's phone or tablet, offline-first | Same audio every time; captures voice or tap; timestamps | Shared devices, lost phones, sync failures | Device ID, sync time, audio clip reference |
| IVR, inbound or outbound | No facilitator influence; full log | Dropped calls cut notices short | Call ID, whether the notice played to the end, keys pressed |
| Paper form, digitised later | Works anywhere | Lost forms, entry errors, delay | Form version, scan reference, who entered it and when |

**If the audio fails or she stops halfway.** If the recording will not play, the facilitator reads the fixed script from the same version and the record says "read, not played". If the call drops or she stops before answering, record no consent for any purpose not yet answered, and do not fill gaps from memory. If she stops after the core explanation but before the extras, she has said nothing to the extras, which means no.

For paper, scan the form into your system within a fixed period, check a sample of entries against the scans, then store the originals securely or destroy them under your retention schedule. Keep photographs of forms out of facilitators' galleries and WhatsApp groups.

Consent records are personal data. Protect them like the rest (s. 8(5), Rule 6), and keep them for as long as you rely on the consent plus a period to answer complaints; the Act sets no period, so set and justify your own. Rule 8(3) separately requires you to keep personal data, associated traffic data and processing logs for at least one year.

## A paper consent register

Where tablets are not available, a bound register kept at the centre or carried by the facilitator works if it has fixed columns. Print at the top of every page the programme, the notice version and the basis for the core service, for example "Core service: section 7(a); notice v3". Our recommended columns, one row per person per visit:

| Column | What goes in it |
|---|---|
| Date and time | When the notice was read |
| Enrolment number | Matches the slip she keeps |
| Name and village | As on the enrolment form |
| Notice version and language | e.g. "v3, Hindi read, Bhili explained" |
| Core service | Explained (7(a)), or Yes/No with thumbprint (consent; always for a child's data, s. 9(1)) |
| Optional purpose 1, 2, 3 | Yes or no, each with her thumbprint or signature |
| Parent or guardian check | For children: how identity and age were checked |
| Facilitator name and ID | Signature |
| Slip given | Tick |
| Withdrawal | Date, purpose, route, initials of who logged it |

Number the pages, never tear one out, and scan each completed page within the week.

## Illustrative field scripts for adults and for parents

Both scripts are illustrative and take about 90 seconds each, plus questions. The adult script relies on 7(a) for the core service and asks only about extras, which is why it differs from sample 5 in the [notice guide](/dpdp-consent-notice#sample-5-a-paper-form-for-field-use), where enrolment itself is a consent. The parent script asks the parent's verifiable consent for the core service too, because a child's data needs it whatever the basis (s. 9(1)). Choose one basis per programme and keep forms, scripts and records consistent. In both, the facilitator hands over the slip and gives the whole notice before the first yes or no (s. 5(1)).

**For an adult enrolling in livelihoods training:**

> "Namaste. I am [name] from [Organisation]. I would like to record our conversation so we can show what you chose. If you prefer, I can write it on paper with your thumbprint instead. Which would you like?
>
> For the training, we will write down your name, age, village, phone number, self-help group and bank account. We use these only to enrol you, mark your attendance and pay your allowance. If you do not want us to use these, tell me; we may then be unable to enrol you.
>
> Please keep this slip. You can change your mind any time: tell me, or give a missed call to the number on it. On that number you can also ask what we hold, correct or delete it, or complain. If our answer does not satisfy you, you can complain to the Data Protection Board of India; the slip says how.
>
> Now two questions. Your answer will not change your training or allowance. May we photograph you at the training for our report to [Funder] and our website? Yes or no? May we call you next year about your work? Yes or no?
>
> Do you have any questions? [Pause.] Can you tell me in your own words what you said yes and no to?"

**For a parent enrolling a child in an after-school centre:**

> "Namaste. I am [name] from [Organisation]. I would like to record this so we can show what you chose, or I can write it on paper with your thumbprint. Which would you prefer?
>
> Because [child] is under 18, we need your permission as parent before we write anything about [her]. First, about you: we will write down your name, phone number, how you are related to [child], and which card I saw. I need to check that you are over 18. Do we have your family's ration card with ages on our file, or can you show me your voter card or another card with your date of birth? I will write down only which card I saw, not its number.
>
> About [child], we will write down [her] name, age, class, school, attendance, and reading and maths scores, to teach [her] at the right level.
>
> Please keep this slip. You can change your mind any time by telling the teacher or calling the number on it. On that number you can ask what we hold about you or [child], correct or delete it, or complain, and the slip says how to complain to the Data Protection Board of India.
>
> Now the questions. Do you agree to [child] joining, with these details recorded? Yes or no? One more, and your answer will not affect [her] place: may we use photographs of [her] at the centre in reports to donors, without [her] name? Yes or no?
>
> Any questions? [Pause.] Can you tell me what you agreed to?"

The teach-back at the end is a simple check that she understood. If she cannot say what she agreed to, explain again before recording the answers. Each script meets Rule 3 only together with the printed slip, which carries the web link (Rule 3(c)), the named contact (s. 6(3)), the full list of rights and the route to the Board.

A one-line slip that carries all of this: **[Named role], [number] · missed call [number] · [web address] · Board complaints: [web address]/board** (illustrative).

**The same scripts in Hindi** (illustrative). These are the Scheduled-language texts. Where families speak Bhili, Bundeli or another dialect, play a dialect recording translated from this text under the same version number.

> **वयस्क के लिए:** "नमस्ते। मैं [नाम], [संस्था] से आई हूँ। हमारी बातचीत मैं रिकॉर्ड करना चाहती हूँ, ताकि बाद में दिखा सकें कि आपने क्या चुना। आप चाहें तो रिकॉर्ड करने के बजाय मैं कागज़ पर लिखकर आपका अँगूठा लगवा सकती हूँ। आप क्या चाहेंगी?
>
> प्रशिक्षण के लिए हम आपका नाम, उम्र, गाँव, फ़ोन नंबर, स्वयं सहायता समूह और बैंक खाता लिखेंगे। इनका इस्तेमाल सिर्फ़ प्रशिक्षण में आपका नाम दर्ज करने, हाज़िरी लगाने और भत्ता भेजने के लिए होगा। अगर आप नहीं चाहतीं कि हम इनका इस्तेमाल करें, तो मुझे बताइए; तब शायद हम आपका नाम दर्ज न कर पाएँ।
>
> यह पर्ची अपने पास रखिए। आप कभी भी अपना फ़ैसला बदल सकती हैं: मुझे बताइए, या पर्ची पर लिखे नंबर पर मिस्ड कॉल दीजिए। उसी नंबर पर आप पूछ सकती हैं कि हमारे पास आपकी क्या जानकारी है, उसे ठीक करवा सकती हैं या हटवा सकती हैं, या शिकायत कर सकती हैं। हमारे जवाब से संतुष्ट न हों, तो भारतीय डेटा संरक्षण बोर्ड से शिकायत कर सकती हैं; कैसे, यह पर्ची पर लिखा है।
>
> अब दो सवाल। इनका जवाब आपकी मर्ज़ी है, और इससे आपके प्रशिक्षण या भत्ते पर कोई असर नहीं पड़ेगा। क्या हम प्रशिक्षण में आपकी तस्वीर लेकर [फ़ंडर] की रिपोर्ट और अपनी वेबसाइट पर लगा सकते हैं? हाँ या नहीं? क्या हम अगले साल आपके काम के बारे में पूछने के लिए आपको फ़ोन कर सकते हैं? हाँ या नहीं?
>
> कुछ पूछना है? [रुकें।] अब अपने शब्दों में बताइए, आपने किस बात के लिए हाँ कहा और किसके लिए नहीं?"
>
> **माता-पिता के लिए:** "नमस्ते। मैं [नाम], [संस्था] से आई हूँ। मैं यह बातचीत रिकॉर्ड करना चाहती हूँ, ताकि दिखा सकें कि आपने क्या चुना; या मैं कागज़ पर लिखकर आपका अँगूठा लगवा सकती हूँ। आप क्या चाहेंगी?
>
> [बच्चे का नाम] अभी 18 साल से छोटा/छोटी है, इसलिए उसके बारे में कुछ भी लिखने से पहले हमें माता-पिता के रूप में आपकी अनुमति चाहिए। पहले आपके बारे में: हम आपका नाम, फ़ोन नंबर, [बच्चे का नाम] से आपका रिश्ता, और मैंने कौन-सा कार्ड देखा, यह लिखेंगे। मुझे देखना है कि आपकी उम्र 18 साल से ज़्यादा है। क्या हमारे पास आपके परिवार का राशन कार्ड है जिसमें उम्र लिखी हो, या आप अपना वोटर कार्ड या जन्मतिथि वाला कोई और कार्ड दिखा सकती हैं? मैं सिर्फ़ यह लिखूँगी कि कौन-सा कार्ड देखा, उसका नंबर नहीं।
>
> [बच्चे का नाम] के बारे में हम नाम, उम्र, कक्षा, स्कूल, हाज़िरी, और पढ़ाई व गणित के अंक लिखेंगे, ताकि उसे उसके स्तर के हिसाब से पढ़ा सकें।
>
> यह पर्ची अपने पास रखिए। आप कभी भी अपना फ़ैसला बदल सकती हैं: टीचर को बताइए या पर्ची पर लिखे नंबर पर फ़ोन कीजिए। उसी नंबर पर आप पूछ सकती हैं कि हमारे पास आपकी या बच्चे की क्या जानकारी है, उसे ठीक करवा सकती हैं या हटवा सकती हैं, या शिकायत कर सकती हैं। भारतीय डेटा संरक्षण बोर्ड से शिकायत कैसे करें, यह भी पर्ची पर लिखा है।
>
> अब सवाल। क्या आपकी सहमति है कि [बच्चे का नाम] केंद्र में आए और ये जानकारी लिखी जाए? हाँ या नहीं? एक और सवाल, जिसके जवाब से केंद्र में उसकी जगह पर कोई असर नहीं पड़ेगा: क्या हम केंद्र में ली गई उसकी तस्वीरें, बिना नाम के, दानदाताओं की रिपोर्ट में लगा सकते हैं? हाँ या नहीं?
>
> कुछ पूछना है? [रुकें।] क्या आप बता सकती हैं कि आपने किस बात के लिए सहमति दी?"

The Hindi parent script is written for a mother. For a father or male guardian, change the verb forms (for example "चाहेंगी" to "चाहेंगे", "सकती हैं" to "सकते हैं").

## A call-back check for consent quality

Our recommendation: each month, a supervisor or M&E officer who did not take the consents calls a random 5% of each facilitator's records, with at least five calls per facilitator. For 20 facilitators who each record around 100 consents a month, that is about 100 calls. She asks:

1. What did the person from [Organisation] tell you they would write down about you?
2. Can you tell me what you agreed to? (Pass if she names the core service and gets her optional answers right.)
3. If you had said no to the photographs, what would have happened? (Pass if she says nothing would change.)
4. How would you change your mind? (Pass if she mentions the slip, the number or the facilitator.)
5. Did anyone else answer for you?

A consent passes if answers 1, 3 and 5 are as expected and either 2 or 4 is correct. Flag a facilitator for retraining and a full re-check if more than one in five of her sampled consents fail, or if her yes-rate on optional purposes exceeds 95% over 20 or more consents; a rate that high suggests the question was not really asked. These thresholds are our suggestion; set your own and write them down.

## Withdrawal in the field

Withdrawal must be as easy as giving consent (s. 6(4)). If she gave it on her doorstep, an email address is not comparable. Routes that work:

- **Tell the facilitator** at any visit; it is logged in the app or register the same day.
- **A missed call** to a dedicated number, matched to her mobile.
- **A free call** to a helpline that speaks the dialect.
- **The tear-off slip,** with her enrolment number and these numbers printed on it.

Behind the routes:

1. Log the withdrawal: which purpose, route and time.
2. Stop the processing within a reasonable time (s. 6(6)), including at processors such as the SMS gateway and survey vendor.
3. Erase the data for that purpose unless a law requires you to keep it (s. 8(7)), subject to the one-year minimum in Rule 8(3).
4. Confirm to her by SMS or at the next visit.
5. Check monthly that nothing withdrawn is still in use.

"Reasonable time" is undefined. We recommend publishing your own deadline, such as seven days to stop and thirty to erase, and measuring against it.

## Where the law is unclear in the field

These are our positions until the Board, a court or a rule decides otherwise.

**Can a grandmother or other caregiver consent for a child?** Only if she is a lawful guardian. Otherwise seek the parent's consent, by phone if the parent has migrated, with the caregiver present, and record how you checked the parent's identity and age. *Why:* section 9(1) names "the parent of such child or the lawful guardian". *Would change if:* guidance recognises de facto caregivers. *Confidence:* medium.

**Who consents for a child in institutional care?** Whoever holds legal authority for her under the order placing her. Where a child care institution acts under a duty in law in the child's interest, Part B, item 1 of the Fourth Schedule may lift parental consent to the extent needed for that duty. Get legal advice for each institution. *Why:* the DPDP Act does not address institutional care directly. *Confidence:* low.

**Does Rule 10 require proof of the parent–child relationship?** Its words check identity and age only. We record the relationship anyway. *Would change if:* the Board expects relationship checks as part of due diligence. *Confidence:* medium.

**Is a facilitator's tick after a nod a clear affirmative action?** Doubtful, because the act is the facilitator's. Use voice, a tap by her, or a thumbprint. *Confidence:* medium.

## Rolling this out across a programme

None of these steps is a legal requirement. A programme starting in November 2026 has time to pilot before 13 May 2027.

| Step | Who | When |
|---|---|---|
| List every point where field teams collect data, and the basis for each purpose | Programme head with M&E | November 2026 |
| Cut fields you do not need | M&E | November |
| Write the Rule 3 notice in a Scheduled language; record dialect audio; back-translate | Programme and communications | December |
| Choose the recording method per site: app, IVR or paper register | MIS lead | December |
| Build withdrawal routes: missed-call number, helpline, app log | MIS and operations | January 2027 |
| Train facilitators on the scripts, photo consent and family pressure | Field coordinators | January to February |
| Pilot in two villages; run the call-back check on every pilot consent | Field coordinators | February |
| Fix the scripts and process; start monthly call-backs | Programme head | March |
| Go live across sites; begin section 5(2) notices for older records ([existing data](/dpdp-existing-data)) | All | April to May |

For a CSR-funded programme, agree with the funder who sends notices and holds consent records before you train anyone ([CSR foundations](/dpdp-for-csr-foundations)).

**How we wrote this guide.** We worked from the text of the Digital Personal Data Protection Act, 2023, sections 2, 3, 5 to 9, 11, 12 and 14, read with the DPDP (Removal of Difficulties) Order, 2026, which corrects the wording of section 9(1); and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), Rules 3, 6, 8, 10, 11, 12 and 14 and the Fourth Schedule, as published in the Gazette of India, last checked 25 October 2026. References to the Juvenile Justice Act, POCSO Act, Rights of Persons with Disabilities Act and National Trust Act are to their published text. The scripts, register, call-back check and tables are illustrations; the law prescribes none of them. Statements marked as our view, position or recommendation are our judgement. This guide explains the law; it is not legal advice.
{: .note }

## Questions people ask

### Can an ASHA or anganwadi worker take consent for our programme?

She can deliver your notice and record answers, but the consent is given to your organisation as Data Fiduciary, for your purposes, on your notice (s. 5(1), 6(1)). She is not your employee, and you remain responsible for processing done on your behalf (s. 8(1)). We recommend agreeing the arrangement in writing with the department, using your own script and recording method, keeping her apart from any benefit decision, and never attaching your consent to a government survey she is already running.

### Is a WhatsApp voice note good enough as a consent record?

It can capture a clear spoken yes, but on its own it is weak evidence. A voice note in a chat does not show which notice version she heard, is hard to link to her record, and sits on a phone you may not control, which raises security and erasure problems (s. 8(5), 8(7)). If you must use one, we recommend moving it into your system the same day, logging the notice version and facilitator, and deleting it from the phone.

### A 17-year-old mother is enrolling her baby in our nutrition programme. Who consents?

For her own data, her parent or lawful guardian gives verifiable consent, because she is a child (s. 2(f), 9(1)). For the baby, the text leaves no clearly compliant consenter: Rule 10 requires the consenting parent to be an adult, and a grandparent is not the baby's parent or lawful guardian unless appointed. Check whether a Fourth Schedule row fits, such as health services by a clinical establishment or healthcare professional, or a duty under law in the child's interest (Part B, item 1); consider formalising guardianship; and take legal advice. Confidence: low.

### We take consent in March 2027. Do we need to give another notice after 13 May?

Section 5(2) asks for a notice, as soon as reasonably practicable, to people who consented before commencement. If your March notice already contained everything section 5(2)(a) requires and you can prove she received it, our view is that a second notice adds little; record the reasoning against each notice version. If the March notice fell short, include those people in your section 5(2) campaign. Confidence: medium.

### What if her husband will not let her answer at all?

Do not take his answer as hers: consent must be her own clear affirmative action (s. 6(1)). The only people who act for another adult are a lawful guardian of a person with disability, verified under Rule 11 (s. 9(1)), and a nominee, who can exercise her rights, not give consent, after her death or incapacity (s. 14). We recommend recording that no consent was given, processing nothing optional, and offering another time or place, such as an SHG meeting with a woman facilitator. If you suspect coercion or harm, follow your safeguarding policy.

## About Commons Trust

Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. Contact: hello@commons.inc · https://dpdp.commons.inc/#start