Consent Logging & Audit
Plain English Translation
Under Section 6(10) of the Act, if a dispute ever arises regarding data processing, the burden of proof DPDP places is entirely on the organization to demonstrate valid consent. You cannot simply say a user agreed; you must provide irrefutable evidence. This requires a robust consent logging DPDP strategy that captures exactly what version of the notice was shown, the specific timestamp, and the clear affirmative action taken by the user. A simple checkbox in a database is insufficient; you need a forensic compliance audit trail to prove the consent was free, specific, and informed.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Store consent timestamps and version IDs in a standard relational database table.
- Keep a manual archive of privacy policy PDF versions.
- Backup logs daily.
Required Actions (scaleup)
- Implement a structured audit trail for consent using a dedicated service or CMP.
- Automate the capturing of User-Agent and IP address metadata.
- Ensure logs are write-protected.
Required Actions (enterprise)
- Deploy a blockchain-backed or immutable ledger for DPDP proof of compliance.
- Real-time replication of logs to a WORM (Write Once Read Many) storage bucket.
- Automated retrieval system for legal discovery.
While the Act doesn't specify a day count for logs, Section 6(10) refers to proving consent in a proceeding. Logs should be retained as long as the data is processed and for a subsequent limitation period to defend against disputes.
To meet the burden of proof, logs should likely contain the user identity, timestamp, specific notice version presented (to prove Section 5 compliance), and the specific affirmative action taken (to prove Section 6(1)).
Standard logs can be edited. To ensure credible DPDP proof of compliance, organizations should use immutable storage (WORM), cryptographic hashing, or blockchain-based ledgers.
You must log the withdrawal event. However, you should retain the original consent log to prove that the processing prior to withdrawal was lawful under Section 6(5).
Yes, because they link a user identifier (like email or user ID) to their choices. These logs themselves must be protected with reasonable security safeguards under Section 8(5).
"Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder."
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-08 | WatchDog Security GRC Wiki Team | Initial publication from DPDP Workbook |
