# Digital Personal Data Protection Act LB-001 — Consent Quality & Management

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_dpdp_lb001_b68b8f0c40-digital-personal-data-protection-act-lb-001-consent-quality-management
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [DPDP Act (India)](https://support.icompaas.com/support/solutions/c_gen_dpdpa) › [Lawful Basis](https://support.icompaas.com/support/solutions/folders/f_gen_cgendpdpa_lawfulbasis)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Digital Personal Data Protection Act · Control LB-001 · Priority: critical · Component: Lawful Basis

### What this control covers

Implement a consent management system ensuring all consents meet DPDPA requirements: free from duress, specific (per-purpose), informed, unconditional, unambiguous, and expressed through clear affirmative action. Prohibit: pre-ticked boxes, bundled consent, and retrospective consent. Maintain immutable, timestamped consent logs for the duration of processing. Objective: Ensure the quality and validity of all consents collected, making all consent-based processing lawful and auditable.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policies, procedures, and registers document the safeguard. Focus: Consent Quality & Management.

### Quick checklist

-   Maintain — Consent Quality / Management
-   Implement — Consent Quality / Management
-   Ensure — Consent Quality / Management

### Related articles on this site

-   [NIST 800-171 3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to](https://support.icompaas.com/support/solutions/articles/62000229333-nist-800-171-3-12-4-develop-document-and-periodically-update-system-security-plans-that-describe-sy)
-   [NIST 800-171 3.13.3 Separate user functionality from system management functionality.](https://support.icompaas.com/support/solutions/articles/62000229336-nist-800-171-3-13-3-separate-user-functionality-from-system-management-functionality-)
-   [NIST 800-171 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.](https://support.icompaas.com/support/solutions/articles/62000229338-nist-800-171-3-13-5-implement-subnetworks-for-publicly-accessible-system-components-that-are-physical)
-   [Ensure Amazon WorkSpaces storage volumes are encrypted in order to meet security and compliance requirements](https://support.icompaas.com/support/solutions/articles/62000229590-ensure-amazon-workspaces-storage-volumes-are-encrypted-in-order-to-meet-security-and-compliance-requi)

## Related compliance guidance

- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): The DPDP Act and 2025 Rules explained as an implementation plan, including what is in force today.
- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): A GDPR programme covers most DPDP obligations; the guide shows the overlap and the India-specific gaps.