DATA PROTECTION AND CONSUMER RIGHTS IN THE DIGITAL AGE: TOWARDS A CONSUMER-CENTRIC LEGAL FRAMEWORK IN INDIA

Abstract

In India's rapidly evolving digital landscape, personal data has become both a critical economic asset and a source of consumer vulnerability. With nearly a billion internet users and growing dependence on digital platforms, consumers routinely share sensitive information, often without clear consent or a meaningful understanding of how that information will be used. This paper examines the relationship between data protection and consumer rights in India, asking whether current law adequately safeguards individuals in the digital marketplace. The Digital Personal Data Protection Act, 2023, together with the Draft Digital Personal Data Protection Rules, 2025, marks a significant step toward structured data governance, yet substantial challenges remain, including weak enforcement capacity, limited public awareness, and persistent risks of data breach, algorithmic profiling and unfair terms of service. The paper situates India's framework against global benchmarks, the European Union's General Data Protection Regulation, the United Nations Guidelines for Consumer Protection, and the sectoral United States model, and draws on constitutional case law, statutory text and documented breach incidents to assess the adequacy of India's current regime. It concludes that India's data protection architecture, while a genuine advance over its fragmented predecessor, requires stronger institutional independence, clearer procedural rules and sustained public education before it can deliver the consumer-centric protection its text promises.