The DPDP Act 2023 does not set a fixed expiry date for consent, but consent is only valid for as long as it remains free, specific, informed and tied to the original purpose. It effectively lapses when the purpose is fulfilled, when the Data Principal withdraws it, or when your processing drifts beyond what was consented to. This calculator estimates how long a given consent realistically stays valid based on the purpose, whether it is ongoing, and how much your processing has changed — and tells you when to refresh it.
How long does your consent actually stay valid? Estimate the realistic validity window and get a clear signal on when you must refresh consent.
The DPDP Act 2023 does not attach a fixed calendar expiry to consent. Instead, consent stays valid only for as long as it remains free, specific, informed and confined to the purpose it was given for. In practice this means consent has three natural endpoints: the purpose is fulfilled, the Data Principal withdraws it, or your processing drifts into new purposes the original consent never covered. When any of those happens, the consent no longer authorises the processing.
This is why thinking of consent as a permanent, one-off checkbox is risky. A consent captured three years ago for one purpose, now being stretched to cover new uses, is difficult to defend as current and informed. The safer mental model is that consent has a realistic shelf life that depends on the purpose — short for a one-time transaction, service-lifetime for an ongoing subscription, and periodically refreshed for marketing.
Refreshing consent is not busywork; it is how you keep your lawful basis demonstrably alive. Re-confirming consent when purposes change, when a long period has passed, or when you can no longer evidence that the original consent was informed, keeps your processing on solid ground and gives you a clean, current record if the Data Protection Board ever asks. Stale consent is one of the quietest ways a compliant-looking company becomes non-compliant.
Niti Bharat sets up consent lifecycle management for Indian mid-market companies as part of its fixed-price DPDP engagements — defining refresh cycles per purpose, wiring in easy withdrawal, and keeping the record current. Building this rhythm now means your consent stays defensible right through the expected May 2027 enforcement window rather than quietly ageing out.
A consent lifecycle planner mapping each purpose to a realistic validity window and refresh cadence, with a withdrawal-handling checklist.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
