Alerts & Updates 13th Aug 2026
Consent-based processing is at the core of India’s new personal data protection framework. That said, the DPDP Act, 2023 and DPDP Rules, 2025 present a significant operational dilemma for indirect data collection, where transacting customers provide details of third parties who are not present to give prior consent.
In this primer, we examine how processing third-party personal data in scenarios like e-commerce gifting, cab bookings for relatives, etc. may pose compliance problems for businesses, and why businesses must evaluate their operational models before full enforcement in May 2027.
As per the rules of the Bar Council of India, lawyers and law firms are not permitted to solicit work or advertise. By clicking on the "I Agree" button, you acknowledge and confirm that you are seeking information relating to Economic Laws Practice (ELP) of your own accord and there has been no advertisement, personal communication, solicitation, invitation or any other inducement of any sort whatsoever by or on behalf of ELP or any of its members to solicit any work through this website.