The Intersection of the Digital Personal Data Protection Act, 2023, and Consumer Rights

The rapid expansion of India’s digital economy has necessitated a robust and comprehensive legal framework to govern the rights of its citizens, particularly in the context of personal data and commercial transactions. The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act), marks a watershed moment, establishing a legal right to data privacy for the first time. This paper analyzes the critical inter section of the DPDP Act with the existing Consumer Protection Act, 2019 (CPA), and its associated regulations, such as the Guidelines for Prevention and Regulation of Dark Patterns. The study argues that this intersection creates a complex, dual-layered regulatory framework that significantly strengthens consumer rights by elevating data privacy violations to the status of unfair trade practices. Key areas of convergence include the principle of informed consent, where deceptive design practices (dark patterns) violate both the DPDP Act’s requirement for “free, specific, informed, and unconditional” consent and the CPA’s prohibition on unfair trade practices. The paper further explores the potential for jurisdictional overlap and conflict between the newly established Data Protection Board (DPB) and the Central Consumer Protection Authority (CCPA), particularly concerning dual grievance redressal mechanisms and the conflict between the right to erasure and mandatory record retention. By examining legal precedents, including the foundational judgment and recent CCPA enforcement actions, the paper concludes that a holistic, integrated compliance approach is essential for businesses, while coordinated regulatory guidance is necessary to ensure effective and consistent protection of the digital consumer.