Keeping evidence of consent without keeping everything forever

A business needs to explain why it believed a person agreed to a particular use. That does not mean it needs an indefinite archive of every page the person visited, every message they sent and every field in their profile. The evidence should answer a defined question: what was the person told, what did they choose and what happened afterwards?

As of 22 October 2026, the main DPDP consent duties are scheduled for 13 May 2027 under the commencement notification. A records design can be prepared now, while applying any current requirements relevant to the business.

Start with the evidence the Act asks the business to provide

Under section 6(10) of the Act, where consent is the basis and a question arises in a proceeding, the fiduciary must prove that notice was given and consent obtained in accordance with the Act and Rules. The provision does not prescribe a universal database schema, blockchain record or mandatory signature for every consent event.

A useful record typically connects the person or relevant identifier, the specified purpose, the notice version, the choice, the time and the channel. These are recommended design elements to support the legal question, not a claim that the Act mandates those exact field names.

Keep the notice text or a reliable version reference that can retrieve it. A timestamp alone does not explain what the person agreed to. A current notice cannot necessarily prove what an earlier screen displayed.

Record change as part of the history

A hypothetical optician records a customer’s choice to receive appointment reminders and a separate choice about promotions. Six months later, the customer withdraws promotional consent. The evidence should show both the original choice and the subsequent withdrawal, together with the operational actions taken.

Deleting the withdrawal event while keeping the customer in an old marketing export creates an obvious failure. Keeping the entire customer profile indefinitely to remember the withdrawal creates a different retention question. The design should retain enough justified information to honour the outcome without treating the whole profile as necessary evidence.

The future withdrawal provisions in section 6 require cessation of the relevant processing within a reasonable time, subject to lawful continuation. A record system should help implement that duty rather than merely prove that a button was clicked.

Apply retention rules without borrowing the wrong number

Rule 8(3) requires personal data, associated traffic data and other processing logs to be retained for at least one year from processing for the Seventh Schedule purposes. After that period, erasure is required unless further retention is required by other law or notified by the Government. Rule 6 contains a separate security-related retention requirement.

These provisions need to be considered in the records schedule. They should not be replaced by a simple instruction that consent evidence can always be erased as soon as the active use stops.

At the same time, the First Schedule’s minimum seven-year retention for specified Consent Manager records is a duty for that registered statutory role. The Consent Manager registration framework has a separate phase scheduled for 13 November 2026 under the commencement notification. It is not a blanket command that every shop must keep every ordinary consent record or customer profile for seven years. The role and record category matter.

Limit what the evidence record contains

Store the fields needed to support the permission history and the applicable retention purpose. Avoid copying sensitive attachments, full identity documents or unrelated transaction details into a consent ledger by default.

Restrict access according to the function. Marketing staff may need the current choice, while a smaller group can access historical evidence for requests or disputes. An immutable history, if used, still needs a lawful retention and access design; the word “immutable” does not answer those questions.

Decide how identifiers are handled when an account closes. If the business needs a limited suppression or request record, document its purpose, scope and retention. Do not assume that a transformed identifier has ceased to be personal data when it can still be linked to an individual.

Test whether the record can answer a real question

Select an old consent event and ask a colleague to reconstruct the purpose, notice, choice and later changes. Then ask whether the same evidence can be produced without revealing unrelated information.

Check supplier exports and system migrations. A new platform that imports only the current yes-or-no choice may lose the evidence behind that choice. Plan the migration before retiring the old system.

The resulting retention schedule should identify the evidence categories, relevant requirements, owner and disposal trigger. The aim is a defensible history with controlled scope, not a permanent collection of everything that might someday seem useful.