Re-consent under DPDP: is your existing consent still valid?
Most existing consent does not meet the DPDP standard, so re-consent is near-universal. Consent collected through old sign-up forms, pre-ticked boxes, or bundled terms and conditions fails the Act's test of free, specific, informed, and unambiguous consent. You will need to collect fresh, verifiable consent from your current user base before the obligations bite.
Why legacy consent fails
This is the gap companies discover last and regret most. Years of users signed up under flows that predate the DPDP Rules. Those flows almost never separated purposes, rarely recorded consent in a usable form, and often bundled data use into terms nobody read. None of that survives the new standard.
Re-consent is a project with three parts
- 01Decide which purposes you actually need consent for, because asking for less raises your completion rate.
- 02Build the re-consent flow into the product, capturing fresh consent against each purpose and storing it correctly.
- 03Run a campaign to reach existing users, in app and over email, and handle the ones who decline or ignore it, which means knowing what processing has to stop for them.
Timing matters
Re-consent depends on your new consent system being live first, so it sits late in the build. Companies that leave it to the final weeks before 13 May 2027 find they cannot reach their whole base in time. Starting early gives the campaign room to run.
"A clean re-consent gives you a user base whose permissions you can actually prove, which is worth more than the obligation that forced it."
Next step
Ready to scope the work?
Book a free 30-minute call. We will map your gaps and tell you exactly what needs building.
Written by Smoketrees Digital LLP, a product engineering studio based in Bengaluru. We implement DPDP compliance directly into codebases for Indian product companies.