The coming implementation of the Digital Personal Data Protection Act, 2023 (DPDPA), has required businesses to begin restructuring their processes and systems to comply with its data protection obligations. Data fiduciaries, entities that determine the means and purposes of processing personal data, will not only have to create frameworks and documentation but will also have to re-examine their websites, mobile applications and other user interfaces to meet transparency and consent obligations.

Data fiduciaries that rely on user consent to process personal data must ensure they comply with the standards prescribed by the new law. Organisations must obtain specific consent from individuals for each processing activity, usually collected and recorded through request forms displayed on their websites or mobile applications. Depending on user access, data fiduciaries may also display additional consent forms when users sign up for or request extra offerings. The risk of consent fatigue may prompt most businesses to avoid making excessive consent requests. However, as a best practice businesses should refresh consent regularly.

Consent requests through such forms must be clear and must offer data principals a true option to grant permission to process their personal data. The withholding of consent must not deny users’ access to the products or services offered by the business. Data principals must also be offered the option to consent to each distinct processing activity. This is usually done through toggles, which ideally should not be pre-checked to agree. However, even a close reading of the new law provides no clarity on this suggestion.