Data Fiduciary

CRITIQUING THE ‘NOTICE AND CONSENT’ FRAMEWORK WITHIN INDIA’S DPDP ACT, 2023 AND CONSUMER PROTECTION REGIMES Nitin Shukla, PhD Research Scholar, Faculty of Law University of Lucknow, Lucknow (India) Download Manuscript doi.org/10.70183/lijdlr.2026.v04.14 The introduction of the Digital Personal Data Protection Act, 2023 (DPDP Act) is a landmark in the digital jurisprudence in India that transformed the country into a unified statutory framework, moving away from a disjointed regulatory framework of Information Technology Act, 2000, to a centralized one, based on the Notice and Consent approach. This research paper critically, in detail, and exhaustively critiques this framework, enshrined in the DPDP Act, Sections 5 and 6, by contrasting it with the parallel remedial framework of the Consumer Protection Act, 2019, in Section 7, the so-called Legitimate Uses exception. This paper is based on the thesis that the standard of a valid consent stated in the DPDP Act including the necessity of a free, specific, informed, unconditional, and unambiguous consent is quite high, but the realities of consent fatigue and limited rationality combined with the broadly defined statutory exemption would tend to diminish those requirements to a mere legal fiction. Moreover, the paper also points to a very important jurisprudential difference, namely, the centralization of the enforcement in Data Protection Board of India (DPBI) with penalties accruing to the State, but the absence of direct compensation to Data Principals in the form of harm definition is also identified. The legislative option unwittingly increases the CPA as the main source of individual remedial compensation on harms of privacy, namely under the category of “Unfair Trade Practices” and “Unfair Contracts.” By comparing and contrasting with the GDPR and the PDPA of Singapore, and looking at the new Indian case law such as the Ashwani Chawla v. Flipkart Internet Pvt. Ltd. This study explains the confusing dual-compliance environment in which mobile numbers of collection cases are now being determined as cases of consumer protection following recent rulings on this topic by Chandigarh Commission. This paper concludes that the convergence of these two regimes forms a requisite yet discordant system of checks and balances, in which the failures of the DPDP Act consent model should be compensated by the application of the consumer law principles of dark patterns and fiduciary responsibility in good faith.