CA Amrita Chattopadhyay
In today's hyper-connected world, the line between what we give and what we expose is increasingly blurred.
Let's break this down from a practical lens under the Digital Personal Data Protection Act, 2023:
1. Data Collection - A Conscious Transaction
When an organization collects personal data, it is a structured, consent-driven activity.
- You fill a form
- You provide KYC details
- You sign up on a website
Here, the Data Fiduciary is directly accountable
Consent, purpose limitation, and compliance become mandatory
This is where DPDP Act applies in full force.
2. Data Sharing - A Voluntary Exposure
Now contrast this with data sharing on social media:
- Posting your birthday celebration
- Sharing anniversary moments
- Uploading your child's milestones
You are not giving data to a specific entity - you are broadcasting it to the world.
The law takes a different stance here: If you have made your data publicly available, DPDP obligations may not apply in the same way
Where the Real Challenge Lies
Here's a real-world situation I recently encountered:
A business argued -
"If users are already sharing everything online, why should we spend effort on consent? Let's just extract it from public sources."
Sounds efficient, right?
But this is where ethics, trust, and regulatory interpretation collide :
- Public availability ≠ Free commercial exploitation
- Consent bypass ≠ Compliance achieved
- Shortcuts today = Reputational risk tomorrow
The Strategic Risk Most Organizations Miss
Organizations focusing only on legal technicalities often overlook:
- Customer trust erosion
- Brand perception damage
- Future regulatory tightening
Because what is permissible today may become non-compliant tomorrow.
CAclubindia
