Earlier this month, the IT Ministry notified the Digital Personal Data Protection Rules (DPDP Rules, 2025) and, with them, operationalised parts of the Digital Personal Data Protection Act (DPDP Act, 2023). As India finally starts implementing its data protection regulation, a lot may change for the average internet user. From requiring businesses to seek consent for processing personal data to allowing deletion of the said data, the data protection regulation seeks to provide users more control over their data.
Here is a practical look at what the key rights of a data principal (customer/internet user) will be under the DPDP Act and rules.
Right to notice:
The Digital Personal Data Protection Act and rules require companies to give their customers a consent notice that informs them of:
- The personal data they intend to use and the purpose for which they intend to use it
- How the customer can withdraw their consent
- The manner in which they can raise complaints to the Data Protection Board against the company.
Picture this, you sign up for a shopping app (say Myntra or Nykaa), before collecting information about you like your name, your address, date of birth, and contact number, the app must give you a notice with an itemised list of the data they are collecting about you and its purposes.
However, if you are already a customer of these services, platforms will not have to seek fresh consent. “Platforms will just update their privacy policies to reflect that they are DPDP compliant, but will not seek a fresh batch of consent provided that they do not expand the scope of how they use data beyond what they previously sought consent for,” GV Anand Bhushan, founder of Bhushan Rajaram, Advocates and Consultants, mentioned in a conversation with MediaNama. He argued that the majority of companies today already state in their policies that they use customer data for platform improvement, customisation, and marketing purposes.
How will consent work for surprise purchases?
Picture this: it’s your mother’s birthday, and you want to send her a cake and some flowers. To do so, you provide the delivery service with her address and contact number. However, the fact that platforms need to seek user consent before processing data could make this entire exercise challenging.
A plain reading of the law suggests that you can only give consent for yourself, not your mother or your father, Bhushan explained.
“To bypass this legal issue while still allowing gift giving, companies implement policies where they send a confirmation or follow-up message to the gift receiver. This message will state that ‘ABC is being delivered to your house’ and could have a consent flow where the receiver can agree to accept the order. This will be a secondary consent flow that the market may implement,” he pointed out.
Bhushan emphasised that these sorts of scenarios are edge cases, and as long as there is no…
Source link
Disclaimer
We strive to uphold the highest ethical standards in all of our reporting and coverage. We blogs.grocliq.com want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.
Website Upgradation is going on for any glitch kindly connect at [email protected]
