Voluntary Provision of Data under the DPDP Act

It is an important principle in data protection that the most appropriate basis for processing personal data be applied, in each circumstance. The Digital Personal Data Protection Act, 2023 (the “Act”) emphasises consent as the principal lawful basis for processing personal data. At first look, this appears privacy-enhancing, helping users control their privacy choices in a granular manner.

However, relying only on consent as a lawful basis could be counterintuitively privacy-limiting, by causing significant consent fatigue for data principals. With the draft Digital Personal Data Protection Rules, 2025 again emphasising specific, standalone notices to obtain consent from data principals, we might well find ourselves inundated with privacy notices.

Fortunately, the Act does allow processing of personal data for certain legitimate uses as well. In this article, we review one of the alternative bases for processing personal data under the Act: voluntary provision of data.