How to Maintain Consent Records for DPDP Compliance
What needs to be recorded in consent records, how to maintain an audit trail, retention, and engineering best practices for consent evidence.
Executive Summary
Consent records are your evidence of compliance. This article explains what must be recorded, how to maintain an immutable audit trail, and engineering considerations.
What Must Be Recorded
User Identifier
Email, phone, or unique ID to track whose consent it is
Timestamp
Exact date and time consent was given
Purpose
The specific purpose for which consent was granted
Notice Version
Which version of the notice they saw
Channel
Website, app, email, etc.
Consent State
Granted or Withdrawn
IP Address / Device ID
Optional but helpful for verification
Immutability and Audit Trail
Consent records should be:
- Append-only (cannot be modified retroactively)
- Timestamped
- Traceable to audit events
- Cryptographically verifiable (optional but recommended)
Retention and Deletion
Keep consent records as long as:
- The data is being processed
- Legal/regulatory requirements require retention
- They're needed to defend against complaints
Delete when no longer needed, following your data retention policy.
Engineering Considerations
- Use a dedicated event store or append-only log
- Implement access controls around consent records
- Enable fast querying (by user, date range, purpose)
- Consider encryption of sensitive records
Key Takeaways
Consent records are your compliance evidence. Design them to be immutable, queryable, and audit-ready.
Sources & Further Reading
Digital Personal Data Protection Act, 2023
Parliament of India
https://indiacode.gov.in/act/c058fa9f-eaf0-4ca3-98f1-3443b087bca9/sectionsRelated Articles
What Is Consent Under the DPDP Act?
A deep dive into consent under India's DPDP Act: requirements, notice, informed decision-making, withdrawal, and how to implement consent properly.
How to Implement DPDP Consent Management
An implementation guide to DPDP consent management: consent models, notice versions, event recording, withdrawal, and downstream propagation.
Building your DPDP compliance infrastructure?
ConsentLog helps Indian businesses operationalize DPDP consent requirements across their systems. Learn how we're approaching consent infrastructure.