India’s Digital Personal Data Protection Act (DPDPA 2023) has placed consent at the heart of lawful data processing. For organizations, this means moving beyond checkbox compliance to a systematic taxonomy that defines, captures, and evidences consent across the data lifecycle.
This blog introduces a Consent Taxonomy Framework that enterprises can adopt to ensure compliance, accountability, and trust.
Consent Taxonomy – Defining the Building Blocks
A robust taxonomy requires clarity on the following dimensions:- Processing purpose: Every consent must be tied to a specific purpose — e.g., service delivery, fraud prevention, marketing, analytics.
- Data category: Classify personal data into categories such as identifiers, financial data, health data, or sensitive personal data.
- Data Principal category: Differentiate between adults, minors (requiring parental consent), or vulnerable groups.
- Collection channel: Capture how consent was obtained — web form, mobile app, call center, paper form.
- Consent requirement: Explicit, informed, granular, and affirmative consent is mandatory unless another lawful basis applies.
- Alternative lawful basis: Legitimate uses such as compliance with law, employment obligations, or emergencies may substitute consent.
- Mandatory vs optional processing: Distinguish between processing essential for service delivery vs optional (e.g., marketing).
- Consent evidence requirement: Define minimum evidence standards to prove consent validity.
Target Architecture – Consent Lifecycle
A consent architecture ensures that every step is traceable and auditable: Data Principal → Notice → Consent Choice → Consent Capture → Consent Repository → Purpose Mapping → Processing System → Withdrawal → Propagation → Audit This lifecycle ensures consent is collected, stored, validated, withdrawn, and audited consistently.Consent Evidence – Minimum Requirements
Organizations must maintain verifiable records of consent. Evidence should include:- Who provided consent (identity of Data Principal or guardian)
- When consent was provided (timestamp, versioning)
- What was communicated (notice content, language used)
- Purpose authorised (specific processing purpose)
- Data category involved (sensitive vs non-sensitive)
- Version of notice/consent (to track updates)
- Source/channel (web, app, call center, paper)
- Withdrawal status (active, withdrawn, pending)
- Audit trail (logs of consent lifecycle event
Why This Matters
- Compliance: Satisfies DPDPA’s explicit consent requirements.
- Trust: Builds transparency with customers.
- Auditability: Ensures regulators can verify lawful processing.
- Scalability: Enables organizations to manage consent across multiple systems and jurisdictions
