DPDP Act Compliance for Electricity Utilities: Smart Meter Consent and Data Processing Limits

Legal analysis published in the SCC Times on October 6, 2026, examines the statutory conflict between electricity bill recoveries and data processing rules in India. Under the Digital Personal Data Protection (DPDP) Act, 2023, electricity utilities collecting smart meter data act as data fiduciaries, while consumers hold the status of data principals. Section 3 confirms the law applies to personal data collected in digital form. Smart meters capture this information directly from households. Utilities face a direct statutory conflict between two competing duties. The Electricity Act mandates power supply to consumers under Section 43. At the same time, the DPDP Act and the DPDP Rules, 2025 restrict data collection operations.

Section 4 dictates that fiduciaries process personal data only for lawful purposes based on explicit consent or specific legitimate uses. A lawful purpose is any purpose not expressly forbidden by law. Many electricity providers demand smart meter installation as a rigid condition for power delivery. This approach conflicts with Section 6(1) of the Act and the consent mechanisms specified in the DPDP Rules, 2025. The statute requires voluntary and granular consent. A fiduciary cannot force a data principal to surrender detailed household usage metrics to receive a basic necessity like electricity. Consumers retain the legal right to deny optional tracking functions. Utilities separate data collection from core service provision.

The DPDP Rules, 2025 introduce specific formats for these consumer notices. Section 5 limits how a utility outlines its data practices. Fiduciaries supply an itemised notice detailing the exact personal data they collect and the specific purpose for processing. The accompanying Rules mandate that this notice is accessible and available in multiple languages. Data minimization under Section 6 requires utilities to collect only the information necessary for the stated purpose. Statutory data collection stays limited entirely to billing and grid management. A utility exceeds its authority if it processes metrics beyond what the data principal agreed to during onboarding. Providers cannot assume blanket permission for secondary uses.

Selling or sharing consumer usage data with third parties without explicit consent violates Section 5. Utilities sometimes transfer consumption metrics to appliance makers or external marketing firms. The Data Protection Board investigates these unauthorised transfers. This external sharing exposes electricity boards and private utilities to financial risk. Section 27 grants the Board the power to levy heavy fines for specific compliance failures. Fiduciaries face penalties based on the severity of the unauthorized sharing. Under the DPDP Rules, 2025, compliance officers need a regulator-ready audit trail. They have to prove they do not bundle consent for primary power supply with optional third-party analytics.

1. Map smart meter data flows directly to billing requirements. The compliance control owner documents exactly what data meters transmit and where the utility stores the digital records.

2. Review consent screens and physical forms against Section 5 and the DPDP Rules, 2025 notice requirements. Ensure consumers receive an itemised, multi-lingual notice and can deny non-essential data sharing without losing power supply.

3. Audit third-party vendor agreements to enforce data minimization. Contracts require strict limits so external tech vendors cannot repurpose consumer usage data for their own analytics or marketing campaigns.