Consent Under DPDP vs GDPR: Why "Legitimate Interest" Doesn't Travel to India
Ask any GDPR-trained privacy professional what keeps consent pop-ups from appearing on every single data-processing activity, and the answer is almost always the same: legitimate interest. It's the quiet workhorse of European privacy compliance — the lawful basis that lets a company run fraud detection, do routine analytics, and send certain marketing communications without asking for explicit consent each time, as long as a documented balancing test shows the organisation's interest doesn't override the individual's rights. India's DPDP Act doesn't have this option, and understanding exactly why matters more than just noting that it's absent. GDPR's Article 6 sets out six lawful bases for processing, with legitimate interest functioning as an intentionally flexible, judgment-based category — a controller weighs its own interest in processing against the impact on the individual, documents that reasoning, and proceeds without needing a consent mechan...