Reading the DPDP Act: What Consent Really Demands of You

The Digital Personal Data Protection Act reframes a question most Indian businesses have never seriously asked: on what basis do we hold the data we hold?

Consent, under the Act, is not a checkbox. It must be informed, specific and as easily withdrawn as it was given. For businesses built on frictionless data collection, this is a structural challenge, not a compliance footnote.

The obligations that bite hardest are not the visible ones. They are the quiet architectural choices — retention, purpose limitation, the right to erasure — that must be designed in, not bolted on.