Step 5 of DPDPA compliance is fixing your privacy notice and consent flow to meet Section 5 and Rule 3—consent must be specific, informed, freely given, and easily withdrawable, with users able to access services without clicking the marketing checkbox.
Every consent request must be preceded by a clear notice explaining what data is collected, why, how to exercise rights, and how to complain to the Board—captured via unticked checkboxes with timestamped consent stored in your CRM.
Ankur Technology implemented three practical fixes: inquiry forms with privacy notice links, newsletter checkboxes with unsubscribe options, and webinar consent clearly stating follow-up use—with "remove from marketing list within 7 days" honored.
The key principle: a simple click or email to privacy@yourcompany.com should be enough to withdraw consent—no obstacle courses.