DPDP Act 2023 Consent Tensions: Evaluating Operational Risks for CFOs

What Happened

Rajlaxmi Singh published an analysis in the Daily Pioneer titled DPDPA 2023: Is Consent Truly the Cornerstone of India's Privacy Law, critiquing the operational reality of India's privacy framework.

The piece roots the Digital Personal Data Protection Act, 2023 in the 2017 Supreme Court judgment of KS Puttaswamy v. Union of India, which established privacy as an intrinsic dimension of human dignity rather than a State-granted privilege.

Singh argues that while the Act introduces baseline requirements for transparency and purpose limitation, a tension exists between individual autonomy and administrative practicality, risking consent becoming largely ceremonial.

Despite these critiques, the author acknowledges the Act as a significant milestone for a nation that previously lacked comprehensive data protection legislation.

Does The DPDP Act Apply Here

The critique focuses squarely on the foundational mechanisms of the Digital Personal Data Protection Act, 2023, specifically Section 4, which dictates that processing must occur for a lawful purpose.

Section 3 of the Act applies to the processing of digital personal data within India, as well as processing outside India if connected to offering goods or services to Data Principals within the territory of India.

For large enterprises, this means the processing of customer and employee data falls strictly under these rules, unless an exemption like personal or domestic use applies.

Corporate IP and anonymised data are outside the scope of the Act, but any digitised personal data tying back to an individual triggers these compliance obligations.

Legal Implications Under DPDP

Under Section 4 of the Act, consent is the primary basis for processing, except where Section 7 legitimate uses apply, meaning consent must be managed systematically.

The DPDP Rules, 2025 add operational weight to this by requiring itemised notices that clearly explain the purpose of data collection.

If an enterprise treats consent as merely ceremonial, as the Daily Pioneer article warns, it violates the purpose limitation obligations explicitly set out in the legislation.

Furthermore, cross-border transfers are generally permitted unless the Central Government restricts transfers to notified countries on a negative list, which demands strict vendor oversight to avoid contingent liabilities.

Could This Happen To You

Chief Financial Officers evaluating their enterprise risk must recognise that ceremonial consent mechanisms directly inflate their contingent liability.

If a privacy incident occurs or a Data Principal files a complaint, the Data Protection Board of India will scrutinise the underlying consent artifacts and itemised notices mandated by the DPDP Rules, 2025.

In the event of a breach, the Rules mandate intimation to affected Data Principals without delay and a detailed report to the DPBI within 72 hours.

Failing to produce verifiable consent trails during this 72-hour window exposes the company to penalties up to INR 250 crore, creating a direct threat to EBITDA and cyber insurance premiums.

What Companies Should Do In The Next 30 Days

1. Mandate the legal and IT teams to audit all existing consent collection touchpoints to ensure they meet the itemised notice standards of the DPDP Rules, 2025.

2. Consolidate vendors managing consent and breach response workflows to lower the total cost of ownership and ensure a single, auditable trail of data processing activities.

3. Quantify the current compliance gap and adjust the risk provisioning in the upcoming quarterly budget, factoring in potential audit fees and technology remediation costs.

4. Review cyber insurance policies to confirm that failure to meet the 72-hour breach reporting window does not void coverage for regulatory penalties.

What To Watch

Enterprises have exactly 283 days remaining until the DPDP hard compliance deadline of 13 May 2027.

We expect further judicial interpretations and perhaps additional granular guidance under the DPDP Rules, 2025 to clarify the tension between autonomy and business practicality.

CFOs should monitor the Data Protection Board of India early enforcement actions, which will set the baseline for how severely ceremonial consent is penalized.

For decision makers evaluating their enterprise exposure and vendor consolidation strategy, testing readiness through freescan.complydp.com provides a baseline view of current vulnerabilities without immediate capital expenditure.