Abstract

The following article examines the various deficiencies in the Digital Personal Data Protection Act, 2023. Specific attention is directed to the vacuum created for the consensual use of personal data and the transferring of such data to third parties in the said Act. The extent of the fiduciary relation between the Data Principal and the Fiduciary is liable to be corrected as this has serious repercussions on implementation of the said Act. Specific loopholes in the wording of the DPDP Act, 2023 demonstrate that the Act is insufficient to protect intentional illegal processing of personal data. In the opinion of the author, the grievance redressal mechanism has to be radically altered to ensure decentralised redressal of data leaks and violation of privacy. The article, inter alia, explores how even with the existence of consent, data privacy is likely to be exploited for commercial gain, specifically in relation to insidious marketing practices.

Keywords