India is on the cusp of notifying the implementing rules of the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This brief aims to contribute to building discourse on how the DPDP Act can uphold the decisional autonomy of persons with disabilities within the data protection framework.
The brief starts by introducing the challenges faced by persons with disabilities in the digital ecosystem. It traces the issues of digital exclusion and inaccessible consent mechanisms under the extant Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (“SPDI Rules”) and the DPDP Act.
The brief then explores the key problems and gaps between the DPDP Act and the disability rights framework under the Rights of Persons with Disabilities Act, 2016. To uphold informational privacy and autonomy for persons with disabilities, the brief makes recommendations to be enforced through amendments to the DPDP Act and its Rules. It recommends a) separate provision for defining persons with disabilities in the DPDP Act b) safeguards to prevent the abuse of data principal rights by lawful guardians c) certain exceptions for not requiring mandatory verifiable consent from lawful guardians d) reinstating sensitive personal data and associated safeguards and e) strengthening digital accessibility through the DPDP Act.
The policy brief may also be accessed in Word format here
Go to Persons with Disabilities vis-à-vis the Digital Personal Data Protection Act, 2023