The Supreme Court of India declared that the right to privacy is a fundamental right and that the right to informational privacy is part of this right. Subsequently, the Parliament of India enacted a new law relating to digital personal data protection. The law applies to Indian residents and businesses collecting the data of Indian residents. It also applies to non-citizens living in India whose data processing is ”in connection with any activity related to the offering of goods or services” that happens outside India. The law allows personal data to be processed for any lawful purpose. If the personal data is sensitive, then additional safeguards are to be observed.
The entity processing data can do so either by taking the concerned individual’s consent or for ”legitimate uses”. which include situations where an individual has voluntarily provided personal data for a specified purpose. The law requires that an individual’s consent must be ”free, specific, informed, unconditional and unambiguous with a clear affirmative action” and for a specific purpose. The data collected has to be limited to that necessary for the specified purpose.
A clear notice containing these details has to be provided to consumers, including the rights of the concerned individual and the grievance redressal mechanism. Individuals have the right to withdraw consent if consent is the ground on which data is being processed. The law also creates rights and obligations for individuals. These include the right to get a summary of all the collected data and to know the identities of all other entities/organisations with whom the personal data has been shared, along with a description of the data shared. Individuals also have the right to correction. completion, updating, and erasure of their data. Besides, they have a right to obtain redressal for their grievances and a right to nominate persons who will receive their data. [Excerpts from Anirudh Burman, ”Understanding India’s New Data Protection Law”, CARNEGIE INDIA, October 03, 2023]
An Indian company collects personal data from its users to provide personalized services. The company intends to share this data with a third-party vendor for targeted advertisements. Under the digital personal data protection law in India, what must the company do before sharing the data?
Correct Answer :
Obtain explicit consent from the users
Solution :
The correct option is Obtain explicit consent from the users.
Step-by-step Explanation:
1. Analyze the Passage Requirements:
According to the passage, an entity processing data can do so either by taking the concerned individual's consent or for "legitimate uses". The law explicitly requires that an individual's consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" for a specific purpose.
2. Evaluate the Scenario:
An Indian company intends to share personal user data with a third-party vendor specifically for targeted advertisements. Targeted advertising based on user data is a separate purpose beyond providing basic personalized services, and sharing data with third parties requires full transparency and authorization.
3. Apply the Law to the Options:
- Obtain explicit consent from the users: This directly aligns with the requirement that consent must be specific, informed, unambiguous, and obtained via clear affirmative action before processing or sharing data for non-essential third-party activities like advertising.
- Share the data by informing the users, as it is for business purposes: Merely informing without obtaining unambiguous consent does not fulfill the requirement of free, specific, and affirmative consent.
- Encrypt the data and share it with the third-party vendor: Technical measures like encryption do not replace the mandatory legal requirement of obtaining user consent.
- Inform the third-party vendor that the data is sensitive: Informing the recipient vendor does not address the fundamental right of the user to give or withhold consent regarding their personal data.
Thus, the company must obtain explicit consent from the users before sharing their data with a third party for targeted advertisements.
Access expert-curated educational resources and study materials—completely free.
Create, conduct, and manage professional online assessments with Mindyard. Perfect for teachers and institutes.
Copyright © 2026 Mindyard. All Rights Reserved.
