The Supreme Court of India declared that the right to privacy is a fundamental right and that the right to informational privacy is part of this right. Subsequently, the Parliament of India enacted a new law relating to digital personal data protection. The law applies to Indian residents and businesses collecting the data of Indian residents. It also applies to non-citizens living in India whose data processing is ”in connection with any activity related to the offering of goods or services” that happens outside India. The law allows personal data to be processed for any lawful purpose. If the personal data is sensitive, then additional safeguards are to be observed.

The entity processing data can do so either by taking the concerned individual’s consent or for ”legitimate uses”. which include situations where an individual has voluntarily provided personal data for a specified purpose. The law requires that an individual’s consent must be ”free, specific, informed, unconditional and unambiguous with a clear affirmative action” and for a specific purpose. The data collected has to be limited to that necessary for the specified purpose.

A clear notice containing these details has to be provided to consumers, including the rights of the concerned individual and the grievance redressal mechanism. Individuals have the right to withdraw consent if consent is the ground on which data is being processed. The law also creates rights and obligations for individuals. These include the right to get a summary of all the collected data and to know the identities of all other entities/organisations with whom the personal data has been shared, along with a description of the data shared. Individuals also have the right to correction. completion, updating, and erasure of their data. Besides, they have a right to obtain redressal for their grievances and a right to nominate persons who will receive their data. [Excerpts from Anirudh Burman, ”Understanding India’s New Data Protection Law”, CARNEGIE INDIA, October 03, 2023]

A social media platform processes user data based on the consent given during account creation. A user now wishes to withdraw consent to process their data. Under the digital personal data protection law in India, what must the platform do?