Data rules: What’s welcome need not be smooth sailing

At its core, India’s Digital Personal Data Protection Act (DPDPA), whose Rules were issued recently, makes consent king.

- VIKRAM KOPPIKAR

No personal data may be processed without “free, specific, informed, unconditional and unambiguous” consent for a “specific purpose.” Such precision, in theory, should assure individuals of meaningful notice and control. But the Act also recognizes “Legitimate Use,” a carve-out allowing data fiduciaries to process personal data without consent, unless the individual explicitly objects. Here lies an interpretative fork: if every usage must be individually specified and notified, when does ‘legitimate use’ ever truly apply? In effect, organizations are left with a puzzle: how to exhaustively abide by the rules while relying on loosely defined ‘legitimate use’ exceptions.

Unlike Europe's General Data Protection Regulation (GDPR), which offers flexible “legitimate interest” uses, provided rights are not overridden, India’s model keeps the compliance screws tight. Indian businesses may find it challenging to draft consent forms that are both granular and operationally viable. The lack of exceptions such as those for fraud prevention or service improvement found in other jurisdictions adds yet another burden, particularly as the digital landscape evolves with AI, IoT and data-driven services.

Minors and consent—An untested frontier: