Consumer Rights Under the Digital Personal Data Protection Act 2023
The Digital Personal Data Protection Act, 2023, establishes India's first comprehensive data protection framework, granting individuals, referred to as Data Principals, specific rights over their personal data processed by businesses, including e-commerce platforms and other digital service providers handling consumer information.
Consent as the Foundation for Data Processing
The Act generally requires a Data Fiduciary, the entity determining the purpose and means of processing personal data, to obtain free, specific, informed, and unambiguous consent from the individual before processing their personal data, with the consent request required to be presented in clear language, independent of other unrelated terms, and accompanied by a notice describing the personal data being collected and the purpose of processing.
Right to Access and Correct Personal Data
Individuals hold the right to obtain a summary of their personal data being processed and the processing activities undertaken, along with the right to correction, completion, updating, and erasure of their personal data, subject to the data being no longer necessary for the purpose it was collected, giving consumers direct recourse against businesses holding inaccurate or outdated personal information.
Right to Grievance Redressal and Nomination
The Act entitles individuals to a readily available means of grievance redressal provided by the Data Fiduciary regarding any act or omission connected with their personal data, and additionally allows an individual to nominate another person to exercise their rights under the Act in the event of death or incapacity, a provision of particular relevance for digital assets and online accounts.
Obligations of E-Commerce and Digital Platforms
E-commerce platforms and other digital businesses processing consumer personal data are required to implement reasonable security safeguards to prevent personal data breaches, notify the Data Protection Board and affected individuals in the event of a breach, and refrain from processing personal data for purposes not disclosed to the individual at the time consent was obtained, with the Data Protection Board empowered to impose substantial penalties for non-compliance.
Special Protection for Children's Data
The Act imposes additional obligations regarding the personal data of children, requiring verifiable parental consent before processing a child's personal data and prohibiting tracking, behavioural monitoring, or targeted advertising directed at children, provisions of direct relevance to e-commerce and digital platforms with a significant base of underage users.
Remedies for Violation of Data Rights
An individual whose data rights have been violated can lodge a complaint with the Data Protection Board of India, which is empowered to investigate and impose penalties on the Data Fiduciary, and separately, a consumer whose financial or personal loss results from a data breach or misuse of personal data may pursue a complaint before a consumer forum on the ground of deficiency in service where the platform's inadequate data protection practices are established.
Frequently Asked Questions
Can a consumer ask an e-commerce platform to delete their personal data?
Individuals hold the right to erasure of their personal data under the Digital Personal Data Protection Act, subject to the data no longer being necessary for the purpose it was originally collected.
What must a business do if consumer data is breached?
A Data Fiduciary is required to notify the Data Protection Board and affected individuals in the event of a personal data breach, along with implementing reasonable security safeguards to prevent such breaches.
Is parental consent required for children's data on e-commerce platforms?
The Act requires verifiable parental consent before processing a child's personal data and prohibits behavioural tracking or targeted advertising directed at children.
Where can a consumer complain about misuse of their personal data?
A complaint can be lodged with the Data Protection Board of India, and a consumer who suffers loss can additionally pursue a deficiency in service complaint before a consumer forum.
This content is for general informational purposes and does not constitute legal advice. For a specific consumer protection matter, consult a qualified legal professional.
