Your Contact List Isn't Necessary
Consent is capped at the data necessary for the specified purpose — the Act's own telemedicine illustration
Read the full guide: Section 6(1) — DPDP Act compliance guide
Watch in English
Summary
This app wants your contacts. It cannot have them.
Consent is capped at the data necessary for the specified purpose — the Act's own telemedicine illustration
Full transcript
This app wants your contacts. It cannot have them.
A telemedicine app asks to process your data.
And to read your phone's contact list.
You tap yes to both.
Pause. How much of that consent is real?
Consent is capped at what the purpose needs.
Contacts are not necessary to see a doctor.
So that half never became lawful.
Tapping yes is not the test. Necessity is.
Ask what the purpose actually needs.
s.6(1) — Digital Personal Data Protection Act, 2023 + Rules, 2025
In force from 13 May 2027