In a new book, a lawyer argues that there is no consent-based model of data protection in India

A consent-based model makes permission the gateway to handling personal information. The person should know what data is collected, why it is needed, and who may use it. Consent should be voluntary, informed, specific, and capable of being withdrawn. The provided article does not discuss this lawyer’s argument or India’s data-protection framework, so this explanation uses established legal concepts.

In practice, a company might ask permission to collect an identification number for a stated service. It should not quietly reuse that information for an unrelated purpose. The key mechanism is user choice backed by duties of notice, limited purpose, security, and deletion or withdrawal where applicable.

The argument therefore points to uncertainty, not necessarily a complete absence of privacy protection. India has constitutional privacy protection and technology-related rules, but their coverage and operation have developed across different instruments. Businesses and individuals need clearer, unified standards so consent is meaningful rather than a routine click.

A consent-based model requires an organisation to ask before collecting or using personal information. The request should explain what will be collected, why it is needed, how long it may be kept, and who may receive it. Consent protects privacy by giving people control over decisions affecting their personal lives. The provided article does not define this model, so this explanation draws on established data-protection principles.

For example, a service may ask to use a person’s contact details to deliver an order. The person can agree to that purpose without automatically agreeing to unrelated advertising. The main mechanism is purpose limitation: data collected for one reason should not silently become available for another.

Consent is not a complete safeguard by itself. People may face confusing notices, pressure, or take-it-or-leave-it choices. Strong systems therefore combine consent with transparency, security, minimisation, access rights, and limits on secondary use. These controls make personal choice more real.

India’s privacy protection has come from several sources rather than one traditional, comprehensive privacy law. The Constitution’s fundamental-rights framework, interpreted by the Supreme Court, now recognises privacy as a fundamental right. Statutory rules under technology law, sector-specific duties, contracts, and general legal remedies can also protect particular interests. The article focuses on privacy’s history, not this full legal inventory.

The clearest example in the article is Puttaswamy vs Union of India. A nine-judge Supreme Court bench issued a Right to Privacy judgment. Justice DY Chandrachud’s lead opinion connected privacy with the basic need to live with dignity. That decision supplied a constitutional foundation for privacy claims, even though it was not a single data-protection code.

This arrangement can protect people in important cases, but it may leave gaps or uncertainty about collection, sharing, retention, and enforcement. A unified framework can make duties easier to understand. The article’s broader lesson is that privacy principles can influence law well beyond one statute.

The source article does not mention the Information Technology Act or count India’s Privacy Rules. In common descriptions of India’s earlier technology-law framework, two principal sets are usually treated as relevant: the rules governing sensitive personal data and the rules governing intermediaries. This count is a general legal description, not a figure supplied by the article.

They are called disjointed because they were created for different purposes and operate through different obligations. One focuses on how organisations handle specified sensitive information. The other focuses on intermediary responsibilities, online content, and related procedures. Their coverage, terminology, and enforcement pathways do not form one seamless privacy code.

That fragmentation can make compliance difficult. A business may need to identify which rule set applies, whether its data qualifies as sensitive, and what duties attach to its role. People may also find it unclear which remedy or standard protects them. A unified framework would reduce these interpretive gaps.

The Puttaswamy judgment established that privacy is not merely a policy preference or a narrow statutory interest. It is connected to dignity, which the article describes as the basic need of every individual to live with dignity. The nine-judge Supreme Court decision therefore placed privacy within India’s fundamental-rights framework.

The judgment drew on the history and influence of Warren and Brandeis’s 1890 article, “The Right to Privacy.” Four of the five judges who wrote opinions mentioned it. Justice DY Chandrachud, in the lead opinion, acknowledged the article’s influence while also recognising the limits of comparative legal and historical frameworks for establishing Indian law.

This reasoning gave Indian courts a powerful constitutional foundation for addressing privacy questions. It also shows how an old argument about a right to be left alone can acquire broader meaning. The article presents dignity as the bridge between personal privacy and fundamental rights, with consequences for future legal disputes.

When rules are unclear, a business may struggle to determine what information it may collect, why it may use it, how long it may retain it, and with whom it may share it. These questions become more serious when the data is sensitive or identifies many people. The article does not discuss Aadhaar, business use, or these practical problems, so this explanation uses established compliance principles.

For example, a company considering an identity-verification service may need to assess consent, purpose, security, access controls, retention, and transfers. If different rules apply to different organisations or data categories, the company must map each obligation before launching. It may need legal advice, revised contracts, stronger safeguards, or a narrower project.

Uncertainty can lead to delayed services, higher compliance costs, inconsistent decisions, and enforcement exposure. It can also weaken public trust if people cannot understand how their information is used. Clear rules would give businesses predictable duties while giving individuals stronger control and more reliable remedies.

Privacy concerns a person’s ability to live with dignity, control access to personal life, and avoid unwanted intrusion. Data protection is narrower and more operational. It governs how organisations collect, use, store, disclose, secure, and delete information about identifiable people. The provided article concentrates on privacy and does not expressly define data protection, so this distinction uses established legal concepts.

Warren and Brandeis’s 1890 article argued for a right to be left alone and criticised press intrusion. That illustrates privacy’s broader concern with personal space and dignity. A data-protection rule would translate part of that concern into duties, such as giving notice before collecting information or restricting reuse for a new purpose.

The two ideas overlap but are not identical. Privacy can cover bodily, family, home, communications, and decisional interests even when no database is involved. Data protection focuses on information practices by organisations. Strong legal systems use data rules to support privacy, while recognising that privacy requires more than managing records.