The rise of digital platforms has changed the structure of labour markets significantly in the twenty-first century. In India, the National Institution for Transforming India (NITI Aayog) has estimated that in 2020-21 around 7.7million workers were engaged in gig and platform work. This is projected to rise to 23.5 million by 2030.1 In EU, the Commission has estimated that there are more than 28 million platform workers.2
The platform-based work is data-intensive in nature. From ride-hailing apps like Uber and Ola, to deliver apps like Swiggy and Zomato, platforms have a common habit of collecting various kinds of data from workers like location details, productivity indicators, behavioural trends and even biometric data. This data is then used by the algorithmic management systems employed in these companies to make decisions related to task allocation, compensation, performance assessment and, more critically, suspension or deactivation from the platform.3
This paper narrows the focus down to the question of whether the approach to the concept of consent adopted by the DPDP Act and GDPR is functional in this situation. The principle of consent in data protection law is that it is essential to have the free, specific and informed consent of a data subject for processing his or her personal data. This ensures equality between the parties, which is clearly not the case between a gig worker and a digital platform. A delivery guy has to agree with the privacy policy of a platform as a prerequisite to using that platform for his livelihood. This does not look like an act of free consent.4
The paper first seeks to understand the position of gig workers within the existing framework of data protection law of both jurisdictions. Then it tries to understand the legal framework in the EU and India and how it approaches the topic of consent, starting from the GDPR, then the DPDP Act, and finally, the PWD. Keeping this in mind, the paper finally compares the adequacy of each framework and their consent architecture in accommodating the gig economy.
Workers as Data Principals
Both laws define their main subject in neutral terms. In the GDPR, the term “natural person” is protected under Article 4(1). The DPDP defines the term “Data Principal” in Section 2(j) as the natural person to whom personal data relates to. However, neither of the statutes provide any provision where workers are treated as a specific category of data subjects. Although Recital 155 of GDPR recognises the need for specific regulation on data processing in an employment setting.5
This gap is crucial for gig workers, whose legal status is still a question. Whether they are “employees”, “workers” or “independent contractors” is a huge debate in both jurisdictions. In India, platform agreements formally classify gig workers as “independent contractors”. However, their working conditions show that they are not really independent, and more often reflect characteristics of subordinate employment: mandatory dress code, algorithmic monitoring and consequences for non-compliance.6 This confusion on employment status becomes the basis for the applicability of data protection laws: if the gig worker is an employee, data processing without specific consent on employment-related grounds may be justified, but if he or she is an independent contractor, consent becomes the primary legal basis.7
The Data-Intensive Nature of Platform Work
The data-intensive nature of platform work is structural and not by chance. Data run these platforms, whose commercial value is largely based on the data collected from the gig workers on the platform: real-time location data for route optimisation and street mapping; productivity and acceptance-rate data for algorithmic task allocation; rating data for performance management; and the aggregate of these data points for understanding the demand and deciding dynamic pricing.8
The concern regarding such data collection is that platforms like Uber have been reported to sell worker data to third parties, like Meta, for targeted advertising purposes. This is done without individually notifying the workers on each occasion.9 The vulnerability of Indian gig workers in this regard is clear from the fact that the Fairwork Project has consistently benchmarked major platforms in India, like Zomato, Swiggy, Uber and Ola, among the lowest-scoring platforms across the globe on measures like data transparency and worker representation.10
Consent under GDPR
Consent in GDPR can be understood through three provisions. Article 4(11) defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." Article 7 adds on to this by giving essential conditions of consent: the controller should be able to demonstrate the consent, the data subject should be as free to withdraw the consent as to give, and when it comes to determining whether the consent is freely given, “utmost account” must be taken to check whether the performance of the contract or the provision of the service, is dependent on the consent to processing data that is not necessary for such performance.11
Further, Recital 43 of the GDPR provides that consent “should not provide a valid legal ground for the processing, where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority." Even though this is specifically directed to public authorities, the European Data Protection Board (EDPB) and other national authorities have applied this reasoning to the employment context, arguing that employees who are economically dependent on employers face a similar imbalance.12
EDPB’s Argument
EDPB’s position is stated in its Guidelines 05/2020 on consent and is based on the general power asymmetry in the employer-employee relationship. It explicitly states that in such a relationship, consent may not be “the appropriate lawful basis for processing…”.13 This is because they further reasoned that an employee cannot freely give, refuse or withdraw consent, especially when it is a prerequisite for employment.14
That being said, this interpretation, however convincing, still won’t help the position of gig workers, as it is applied only to the traditional employer-employee relationship. Platforms consider gig workers as independent contractors; they are neither employees nor “dependent” as contemplated by the EDPB Guidelines. But in the practical sense, there is a more acute “dependency”: an employee has statutory protections regardless of consent. But if a gig worker does not consent to data processing, he may not just face a disadvantage, but may be excluded from the platform, thereby losing his entire means of livelihood.15
GDPR and Right against Automated Decision- Making
Another GDPR provision that is very important to note in the context of gig workers is Article 22(1). This provision gives data subjects the right “not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significant effects." This provision is very relevant for gig workers who are subject to algorithmic deactivation, earnings profiling, and dynamic pricing.16
But a major challenge in invoking this provision is the exception given in Article 22(2), which exempts from prohibition such automated decision-making which is “necessary for entering into, or performance of, a contract between the data subject and a data controller", or where the data subject has given “explicit consent”. This is highly problematic, especially when gig workers’ contractual relationship with the platform is constantly invoked to argue against prohibiting automated decision-making. Even the “explicit consent” mandate fails to match this coercive argument.17
The Structure of Consent under the DPDP Act
Under Section 6 of the DPDP Act, personal data may be processed, but only with the consent of the Data Principal. This consent should be free, specific, informed, unconditional and unambiguous, and there should be a “clear affirmative action” backing it.18 Section 6(4) limits the consent to such personal data which is “necessary for the specified purpose”.19 This section also protects the right of the data principal to revoke the consent at any time, and it should be as easy as it is to give the consent. These clauses seem sound but just like GDPR, poses structural gaps when applied to the context of gig workers.20
The “Legitimate Uses” Framework and Its Application to Gig Workers
Section 7 of DPDP Act provides certain “legitimate uses”, where consent is not required for data processing.21 This gives three uses- one, data given for government benefits, two, data given for medical emergencies, and most relevant for the purpose of this paper, data given for purposes related to employment. These purposes include recruitment, prevention of corporate espionage, maintenance of confidentiality of trade secret and assessment of performance of Data Principal (Section 7(f)).22
Now the gap in applying Section 7(f) to the situation of gig workers is that the DPDP Act is silent on how the term “employment” is to be defined for its purpose. This creates a confusion on whether gig workers, who are formally classified as independent contractors by platforms, are covered by this provision. If this is the case, data processing pertaining to consultants, interns, gig workers and other workers outside the traditional employer-employee relationship, providing services, may still require consent. That brings us to the problem: gig workers are too dependent to give freely-given consent, but are not “employees” to benefit from the waiver of consent under Section 7(f).23
Absence of Algorithmic Transparency Obligations
The most significant loophole in the DPDP Act, from the point of view of gig workers, is that it doesn’t address the issues posed by algorithmic management or automated decision making. The DPDP Act doesn’t have a parallel provision to Article 22 of GDPR, which empowers a data principal to challenge decisions solely made by automated processing, nor does it make data fiduciaries to be transparent on how their algorithmic systems work.24
This is a gaping hole, especially when all aspects of a gig worker’s professional life are dictated by algorithmic systems. From task allocation by proximity and rating algorithms and deciding compensation by dynamic pricing systems, to evaluation of performance and deactivation, all managerial tasks are affected through automated system, with no human intervention at all.25 And DPDP does not provide any legal recourse for this “algorithmic despotism”.26
The Structure of PWD
The European Parliament adopted Directive (EU) 2024/2831 on improving the working conditions in platform work (PWD) on 24th April 2024 and the Council adopted it on 14th October 2024. It officially came into force on 1st December 2024. Member States of the European Union should include the PWD into their national law by 2nd December 2026.27 The PWD is not the usual labour legislation, but probably the first instrument of EU law that is made specifically for the purpose of gig workers, including provisions on data protection and aligned with the GDPR framework.28
The core of PWD is Article 7, which expressly prohibits basing data processing by automated decision-making systems solely on the consent of platform workers. The Directive recognises “the consent of persons performing platform work to the processing of their personal data cannot be assumed to be freely given” due to the power gaps between gig workers and digital labour platforms.29 This is a novel take by the PWD, as this prohibition applies not only to the case of “employees”, but also to platform workers who are exposed to the consent deficit.30
Specific Prohibitions on Sensitive Data Processing
Article 7 also introduced certain categories of data on which automated processing is completely prohibited, even with the consent of the platform worker. These categories of data are quite personal in nature and include such data that can be used to makes inferences about the person’s emotional and psychological state, private conversations and other behavioural data generated when the platform worker is not working on the platform, data that can be used to predict the exercise of fundamental rights, like freedom of association and personal data which can be used to infer sensitive characteristics like race, ethnic origin, medical information and sex life and sexual orientation. 31
These specific prohibitions are important as here PWD recognises the unethical nature of such automated data processing and how such data is prone to misuse by platforms. In such cases, adequate protection cannot be achieved through a consent mechanism alone. This imposes a restriction on the liberal consent mechanism of GDPR.32
Mandate on Algorithmic Transparency
Chapter III of the PWD is a comprehensive set of algorithmic management rights which ensures transparency between the platform and the workers. Article 9 requires digital platforms to share meaningful information regarding automated management systems, especially how they work and how it affects working conditions. Article 10 also mandates human oversight on automated decisions that significantly affect workers, including decisions like deactivation. Here, the PWD gives workers the right to request for a review by human representative within two weeks of such decision.33
Further, Article 11 mandates an impact assessment of automated systems every two years and this should be conducted by involving representatives of the workers. This is enriching the individualised rights framework of the GDPR, by rightly identifying the need for collective institutional responses where individual consent alone might fail.34
Difference in Consent Theory
The key difference between the frameworks is in how they approach the theory of consent. Both the GDPR and DPDP Act can be called liberal and autonomy centred model, as they treat the data subject as a rational agent capable of making their own choices about data processing. But this view is more suited for the consumer context, where the interest of the data subject in a service is a personal preference rather than a necessity. However, in the context of gig workers, this model might turn out to be defective. 35
When a delivery boy accepts Zomato’s privacy policy, which permits data sharing with advertising partners without specific notification, he has no choice but to give consent. If he doesn’t consent, he is losing his access to a livelihood. Critics of the DPDP Act has noted that while the Act requires the consent to be “free, specific, informed and unambiguous”, it is not practical where gig workers are forced to consent giving aggregators "absolute control over both the labour process and personal data."36
This structural gap is what the PWD addresses. What it does is expressly recognise the reality that consent from gig workers may not be freely given and prohibiting processing certain data regardless of consent. The DPDP Act does not make any such clarification or recognition. It just considers gig worker equivalent to any other data subject, overlooking their economic dependence.37
Comparing the approach to Employment- Related Data
Another critical difference is the how the statutes approach processing of employment related data. The GDPR doesn’t have any specific provision in this regard except the general consent requirements. However, Article 88 gives Member States to establish specific rules. The PWD supplements this with platform work specific rules on data processing. On the other hand, Section 7(f) of the DPDP Act provides the “legitimate use” exception for processing employment-related data. That being said, the DPDP Act falls short as it does not define the term “employment” or expressly provide whether the act applies to gig workers.38
This poses as a trap for gig workers. If platforms invoke Section 7(f) to process gig worker data, this will be without the consent safeguards. And if companies take the other route, that proceed with consent of the worker, such consent might be coerced structurally. There is no other option under the DPDP Act, like categorical prohibitions, mandatory algorithmic transparency, or obligation to review by a human overseer, to bridge this gap.39
Comparing the provisions regulating algorithmic management
The sharpest difference between the two regimes is with respect to algorithmic management. The EU framework creates a faceted regime comprising of multiple instruments on algorithmic rights which can be said to be the most comprehensive attempt to regulate automated work setting. 40 An analysis by Yale Law Journal comments that this will make EU as “the leader in digital rights, and, in particular, in providing affirmative digital rights for workers whose labour is mediated by a platform."41
The DPDP Act does not have a parallel provision to this. There is no review option for automated decisions, nor mandatory explanations about how the algorithm affects. Even provisions requiring human oversight and impact assessment on systems are absent. To illustrate, a gig worker whose behaviour is monitored by the platform has no remedies against such misuse under the DPDP Act or its rules. This throws light on a major legislative gap under that is yet to be addressed. 42
Enforcement and Structural Guarantees
Both the frameworks differ in how they have brought up the enforcement mechanism. The GDPR, which was enforced back in 2016, has independent enforcement mechanisms, called the Data Protection Authorities, that have a considerable investigative and adjudicatory power. These authorities have introduced significant outcomes in the context of platform work. For example, Foodinho, a food delivery app was sanctioned by the Italian Data Protection Authority following an investigation into discriminatory algorithms. Another instance is when the Dutch Court addressed the automated decision-making system used by Uber especially for deactivation.43
The DPDP Act, enacted in 2023, is a very recent development with a phased implementation timeline. It was only in November 2025, that the Data Protection Board of India (DPBI) was partially notified, and the complete operational provisions are not to be expected until May 2027. The DPBI’s composition under Section 18 includes a Chairman and members appointed by the Central Government. This has led to significant debate over its independence as such appointment is provided without any express provision related to judicial review of appointments.44
The comparative analysis shows that India’s DPDP Act in its current form is inadequate in providing data protection to gig workers. The formal consent model, the confusion regarding employment-related legitimate uses, the lack of provision regulating algorithmic management systems, and the delayed implementation of its enforcement machinery, all create an environment in India where the data rights of India’s rapidly growing gig workforce are violated.
On the other hand, EU’s Platform Work Directive, which was adopted in 2024, is an exemplary legislative response to the gaps in GDPR’s consent-based data protection framework, in the context of platform work. Some points where the PWD score against the DPDP Act include how it expressly prohibits basing automated data processing of gig workers solely on consent, how it specifically and expressly prohibits processing sensitive data, how it mandates algorithmic transparency and requires human oversight, and how it requires consultation with workers’ representatives. These are some points which India can consider including to strengthen the data protection framework.
The adequacy of a data protection framework is not determined by how sophisticated its consent architecture is, but by how it protects its most vulnerable data subjects. Gig workers in India are one such vulnerable group due to the power asymmetry between them and the platforms they are dependent for livelihood. The DPDP Act currently is not equipped enough to accommodate the fast-growing gig economy in India. The EU has set an example through its evolving platform work directive, which could be a great lesson India could borrow.
1. NITI Aayog (2022) India's Booming Gig and Platform Economy: Perspectives and Recommendations on the Future of Work. New Delhi: Government of India. Available at: https://www.niti.gov.in/sites/default/files/2022-06/25th_June_Final_Report_27062022.pdf [Accessed: 13 April 2026]
2. European Commission (2021) Impact Assessment Report Accompanying the Proposal for a Directive on Improving Working Conditions in Platform Work, SWD(2021) 396 final. European Commission, Brussels, p. 6.
3. Bhattacharya, D. and Srivastava, P. (2024) 'India's Data Protection Law: Undermining Labour Rights in the Digital Economy', Indian Journal of Law and Technology. Internet Freedom Foundation (2021) #PrivacyOfThePeople: Gig and App-Based Workers. IFF, New Delhi.
4. Aloisi, A. and De Stefano, V. (2022) Your Boss is an Algorithm: Artificial Intelligence, Platform Work and Labour. Hart Publishing, Oxford, ch. 3. Bhattacharya, D. and Srivastava, P. (2024) — see footnote 3.
5. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) [2016] OJ L 119/1, Art. 88 and Recital 155. Digital Personal Data Protection Act 2023, s. 2(j).
6. Shaharbanu, A. and Kaushik, N. (2025) ‘Gig Workers’ Personal Data Protection’, Law.Asia, January. Available at: https://law.asia/gig-economy-data-protection-india/ [Accessed: 15 April 2026].
7. Cyril Amarchand Mangaldas, Handle with CARE: Relying on "Purposes of Employment" for Processing Employee Data, India Corp. L. Blog (May 2024), https://corporate.cyrilamarchandblogs.com/2024/05/handle-with-care-relying-on-purposes-of-employment-for-processing-employee-data/ (last visited Apr. 15, 2026).
8. Shaharbanu, A. and Kaushik, N. (2025) — see footnote 6.
9. Aloisi, A. and De Stefano, V. (2022) Your Boss is an Algorithm: Artificial Intelligence, Platform Work and Labour. Oxford: Hart Publishing. Available at: https://www.bloomsbury.com/us/your-boss-is-an-algorithm-9781509944285/ [Accessed: 15 April 2026].
10. Fairwork Project (2023) Fairwork Annual Report 2023: State of the Global Platform Economy. Oxford: University of Oxford. Available at: https://fair.work/en/fw/publications/fairwork-annual-report-2023-state-of-the-global-platform-economy/ [Accessed: 15 April 2026].
11. Regulation (EU) 2016/679 (GDPR), Arts. 4(11) and 7.
12. Regulation (EU) 2016/679 (GDPR), Recital 43. Article 29 Working Party (2017) Opinion 2/2017 on Data Processing at Work, WP249, 8 June, pp. 5–6.
13. European Data Protection Board (2020) Guidelines 05/2020 on Consent under Regulation 2016/679, Version 1.1, 4 May, s. 3.1, para. 21.
14. European Data Protection Board (2020) — see footnote 13
15. Li, W. and Toh, J. (2023) ‘Data Subject Rights as a Tool for Platform Worker Resistance: Lessons from the Uber/Ola Judgments’, SSRN Working Paper 4306868, pp. 12–14. European Data Protection Board (2020) — see footnote 13, para. 21. Aloisi, A. (2025) ‘Fair Work for Platform Workers: Lessons from the EU Directive and Beyond’, Industrial Law Journal, 54(3), p. 431.
16. Regulation (EU) 2016/679 (GDPR), Arts. 22(1)
17. Regulation (EU) 2016/679 (GDPR), Arts. 22(2)
18. Digital Personal Data Protection Act 2023, s. 6(1)
19. Digital Personal Data Protection Act 2023, s. 6(1) (data minimisation); s. 6(4) (right of withdrawal)
20. Digital Personal Data Protection Act 2023, s. 6(4). Future of Privacy Forum (2023) 'The Digital Personal Data Protection Act of India, Explained', 11 August. FPF, Washington DC.
21. Digital Personal Data Protection Act 2023, s. 7(f).
22. Cyril Amarchand Mangaldas (2024) — see footnote 7.
23. Shaharbanu, A. and Kaushik, N. (2025) — see footnote 6. Bhattacharya, D. and Srivastava, P. (2024) — see footnote 3.
24. Shaharbanu, A. and Kaushik, N. (2025) — see footnote 6. Bhattacharya, D. and Srivastava, P. (2024) — see footnote 3.
25. Bhattacharya, D. and Srivastava, P. (2024) — see footnote 3. De Stefano, V. (2016) 'The Rise of the "Just-in-Time Workforce": On-Demand Work, Crowdwork and Labour Protection in the "Gig-Economy"', Comparative Labor Law & Policy Journal, 37(3), p. 480.
26. Bhattacharya, D. and Srivastava, P. (2024) — see footnote 3.
27. Directive (EU) 2024/2831 of the European Parliament and of the Council of 23 October 2024 on improving working conditions in platform work [2024] OJ L (Platform Work Directive), Art. 38 (entry into force); Art. 29(1) (transposition deadline: 2 December 2026).
28. European Trade Union Institute (2024) The EU Platform Work Directive. ETUI Policy Brief, Brussels, pp. 4–6. Aloisi, A. (2025) — see footnote 16, pp. 428–430.
29. Directive (EU) 2024/2831 (PWD), Art. 7(1), Recital 16. Aloisi, A. (2025) — see footnote 16, p. 436. Li, W. and Toh, J. (2023) — see footnote 16, pp. 22–24.
30. Aloisi, A. (2025) 'Fair Work for Platform Workers: Lessons from the EU Directive and Beyond', Industrial Law Journal, 54(3), pp. 428–430; European Trade Union Institute (2024) The EU Platform Work Directive. ETUI Policy Brief. Brussels: ETUI, pp. 4–5.
31. Directive (EU) 2024/2831 of the European Parliament and of the Council of 23 October 2024 on improving working conditions in platform work [2024] OJ L (Platform Work Directive), Art. 7(2)(a)–(e). European Trade Union Institute (2024) — see footnote 28, p. 7.
32. Dubal, V. (2025) 'Data Laws at Work', Yale Law Journal Forum, 134, pp. 405–440; European Trade Union Institute (2024) — see footnote 28, pp. 7–8.
33. Directive (EU) 2024/2831 (Platform Work Directive), Arts. 9 and 10; Aloisi, A. (2025) 'Fair Work for Platform Workers: Lessons from the EU Directive and Beyond', Industrial Law Journal, 54(3), pp. 438–439.
34. Directive (EU) 2024/2831 (Platform Work Directive), Art. 11; European Trade Union Institute (2024) — see footnote 28, p. 9.
35. Dubal, V. (2025) 'Data Laws at Work', Yale Law Journal Forum, 134, pp. 405–440.
36. Bhattacharya, D. and Srivastava, P. (2024) 'India's Data Protection Law: Undermining Labour Rights in the Digital Economy', Indian Journal of Law and Technology; Shaharbanu, A. and Kaushik, N. (2025) 'Gig Workers' Personal Data Protection', Law.Asia, January.
37. Aloisi, A. (2025) 'Fair Work for Platform Workers: Lessons from the EU Directive and Beyond', Industrial Law Journal, 54(3), pp. 428–430; European Trade Union Institute (2024) — see footnote 28, pp. 4–6.
38. Regulation (EU) 2016/679 (GDPR), Art. 88. Digital Personal Data Protection Act 2023 (No. 22 of 2023), s. 7(f). Cyril Amarchand Mangaldas (2024) — see footnote 7
39. Bhattacharya, D. and Srivastava, P. (2024) — see footnote 3. Shaharbanu, A. and Kaushik, N. (2025) — see footnote 6.
40. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L, Annex III, point 4 [employment and worker management as a high-risk AI application]; Dubal, V. (2025) 'Data Laws at Work', Yale Law Journal Forum, 134, pp. 405–440.
41. Dubal, V. (2025) 'Data Laws at Work', Yale Law Journal Forum, 134, pp. 405–440.
42. Bhattacharya, D. and Srivastava, P. (2024) ‘India’s Data Protection Law: Undermining Labour Rights in the Digital Economy’, Indian Journal of Law and Technology. Internet Freedom Foundation (2021) #PrivacyOfThePeople: Gig and App-Based Workers. New Delhi: IFF. Available at: https://internetfreedom.in/privacyofthepeople-gig-and-app-based-workers/ [Accessed: 15 April 2026].
43. Garante per la protezione dei dati personali, Provvedimento contro Foodinho s.r.l., doc web n. 9675440, 10 June 2021. Available at: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9675440 [Accessed: 15 April 2026]. X v Uber BV, ECLI:NL:RBAMS:2021:5029, District Court Amsterdam, 13 October 2021.
44. Digital Personal Data Protection Rules 2025 (Notification S.O. 4772(E)), Ministry of Electronics and Information Technology, Government of India, 13 November 2025. Available at: https://www.meity.gov.in/en/dpdp-rules [Accessed: 15 April 2026]; Bhattacharya, D. and Srivastava, P. (2024) 'India's Data Protection Law: Undermining Labour Rights in the Digital Economy', Indian Journal of Law and Technology.