Background
Unlike the General Data Protection Regulation
("GDPR") of the European Union which
allows non-consensual data processing under various circumstances,
India's recently published Digital Personal Data Protection
Act, 2023 (the "DPDP Act") relies
heavily on consent as a ground for processing personal data.
Thus, other than a few 'legitimate uses' (such as when
an individual voluntarily provides their personal information for a
specified purpose or if processing is necessary for
employment-related purposes), consent is the only legal basis for
processing personal data under the DPDP Act.
Since the legal framework under the DPDP Act ultimately aims to
protect personal data for the benefit of specifically
identifiable individuals related to such data ("data
principals"), it imposes corresponding obligations
on, and limits, the processing of such data by "data
fiduciaries", i.e., those entities which
determine the purpose and means of data processing,
