The enactment of the Digital Personal Data Protection Act (DPDPA), 2023, marks the culmination of India’s long and contested legislative journey toward a statutory data protection regime. Built upon the constitutional bedrock of the right to privacy affirmed in K.S. Puttaswamy (Retd.) v. Union of India (2017), the Act nominally centres the individual as the sovereign of her personal data. Yet a close doctrinal reading reveals a regime in which consent — the Act’s primary lawful basis for processing — is structurally compromised by broadly drawn “deemed consent” provisions, an absence of genuine withdrawal mechanisms, and a regulatory architecture that subordinates individual control to state and commercial interests. This paper interrogates the DPDPA’s consent framework as a site of constitutional tension, examining whether the Act’s design meets the proportionality standard mandated by Puttaswamy and provides meaningful individual control over personal data in an age of algorithmic surveillance. Through doctrinal analysis and comparative reference to the GDPR and the California Consumer Privacy Act, this paper argues that the DPDPA’s consent framework is constitutionally underspecified and recommends six targeted legislative remedies to restore the individual to the centre of India’s data governance design.
Rohan S (Mon,) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: