DPDP Act Principle: Ensuring Explicit Data Collection Consent

The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) sets rules for how organizations handle personal data in India. A key aspect of data protection is ensuring individuals understand and agree to how their data is collected and used.

Understanding Data Collection Principles

The question asks which principle of the DPDP Act, 2023 specifically requires entities to get explicit consent before collecting personal data. Let's examine the options:

• Purpose Limitation: This principle means data should only be collected for specific, clearly stated purposes. While related to consent, it doesn't solely focus on the act of obtaining consent itself.
• Storage Reduction Compliance: This principle requires that data should not be kept for longer than necessary for the stated purpose. It deals with data retention, not initial collection consent.
• Data Localization: This principle relates to where data is stored (e.g., within India). It does not directly address the requirement for obtaining consent during data collection.
• Notice and Choice Framework: This principle is central to data protection. It mandates that organizations must inform individuals about the data they are collecting (Notice) and give them the power to decide whether to allow this collection (Choice). Obtaining explicit consent falls directly under the 'Choice' aspect of this framework, ensuring individuals have control over their personal data right from the point of collection.

Identifying the Correct Principle

The DPDP Act, 2023 emphasizes transparency and user control. The Notice and Choice Framework directly embodies this by requiring data fiduciaries (entities collecting data) to:

• Provide clear and accessible notice about the data being collected, the purpose of collection, and the data fiduciary's contact details.
• Obtain clear and affirmative action from the individual to give consent. This means consent cannot be implied; it must be explicit.

Therefore, the principle that ensures entities must obtain explicit consent from individuals when collecting personal data is the Notice and Choice Framework.