India’s Data Privacy Law Must Recognize the Right of Legal Capacity of the Persons with Disabilities

India’s one of the youngest laws Digital Personal Data Protection Act, 2023 (DPDP Act) has locked horns with the fundamental rights debate and positioned right to vote in contrast to the right to consent in case of certain class of specially abled persons. Let’s understand it through an example, a wheelchair bound software engineer who may writes codes, may lead a team, pay taxes, and may even sign contracts. Such specially abled person can vote in elections and execute a lease on apartment. Yet under India’s new Digital Personal Data Protection Act, 2023 (DPDP Act), such a citizen of India cannot decide how her/his or their own personal data will be used without her parents’ or guardian’s consent. This is not merely a simple drafting slip but a mockery of legislative craft leading to Constitutional inequality within two rights. This is a case of Right to Vote versus Right to Consent both guaranteed under the Article 21 to all persons alike including specially abled persons., sans few statutory limitations. The authors here will assess this debate and present a likely case scenarios which may remedy the situation.

The section 9 of the DPDP Act groups children and persons with disabilities together under one category which requires parental or guardian consent before their personal data can be processed. This reflects that the DPDP law assumes disability of all kinds leads to complete legal incapacity of the specially abled persons to offer consent in reference to processing of their personal data under it. This is a classic flawed assumption of law. That assumption is not just outdated—it is unconstitutional, discriminatory, and in direct conflict with the disability rights law. Such that the Section 9 of the DPDP Act states: “The processing of personal data of a child or a person with disability who has a lawful guardian shall be undertaken only with the verifiable consent of the parent or lawful guardian.”

While Section 9 limits this to those ‘with a lawful guardian,’ the is practicality different. To avoid liability, companies will interpret it broadly, demanding guardian consent from any user who discloses a disability. This effectively equates every specially abled person irrespective of the kind and percentage of disability whether I renders legal incapacity or not with permanent status that of a minor in the digital realm. For children (better to be read as minors), such a safeguard seems justifiable. However, the adults with disabilities are not a homogeneous group. For instance, someone who is blind, deaf, or uses a wheelchair may live independently, manage finances, and exercise all Constitutional and civil rights. Treating such specially abled persons at par with minors mandating consent through a lawful guardian in the digital space strips them of autonomy in an arena central to modern life and well within the constitutional contours.

So much so Section 9 of the DPDP Act’s blanket rule cannot withstand constitutional scrutiny. The law discriminates between specially abled persons and other able bodied persons without any rational basis. As discussed above, this would mean a wheelchair bound person who can sign contracts under the Indian Contract Act or cast her vote under the Representation of the People’s Act is suddenly told that she/he cannot consent to a website processing her/his data. That is simply arbitrary classification on its face value as a legal provision and in stark violation of the principle of Article 14 of the Constitution of India. More so, as the Supreme Court affirmed the privacy as a facet of dignity and autonomy to be read instrincically as part of Article 21 of the Constitution of India through the judgment rendered in Justice K.S. Puttaswamy v. Union of India (2017), simply denying the specially abled persons the ability to say “yes” or “no” to the use of their data violates both the Article 14 and 21. The law infantilises millions of specially abled Indian citizens, saying: ‘You are an adult in every sphere, but in the digital world, you remain a child.’ This paternalism is neither protective nor constitutional.

Let us take a closer look at the status guaranteed to the specially abled persons under the Rights of Persons with Disabilities Act, 2016 (hereinafter read as RPwD Act). Section 13 of the law defines ‘Legal Capacity’ of such category of persons. The first limb of the law states that “The appropriate Government shall ensure that the persons with disabilities have right, equally with others, to own or inherit property, movable or immoveable, control their financial affairs and have access to bank loans, mortgages and other forms of financial credits.”[1] The sub section 2 of 13 further clarifies that “The appropriate Government shall ensure that the persons with disabilities enjoy legal capacity on an equal basis with others in all aspects of life and have the right to equal recognition everywhere as any other person before the law”.[2] It is crystal clear from the reading of these provisions that the Rights of Persons with Disabilities Act, 2016 which was also passed by the same Parliament of India has paced the persons with disabilities on equal footing with every other individual and able bodied persons for enjoyment of all rights guaranteed under the Part-III of the Constitution of India. The RPwD Act further creates an embargo on any form of discrimination against the persons with disabilities and places a positive obligation on the Governments to ensure that the persons with disabilities enjoy the right to equality, life with dignity and respect for his or her integrity equally with others.[3] Further, Section 3 promises that that no person with disability shall be discriminated on the ground of disability, unless it is shown that the impugned act or omission is a proportionate means of achieving a legitimate aim.[4] The law therefore, offers no duality or linguistic indeterminacy in terms of its words or expressions which may create doubt on the legislative intent of this law for promising equal treatment of persons with disabilities with everyone else for enjoyment of all kinds of rights, life, enjoyment of property and so much so handling financial matters independently. Hence, Section 9 of the DPDP Act is visibly in stark contradiction to the rights enshrined and promised by the RPwD Act and covered under an overarching umbrella of Article 12, 19 and 21 of the Constitution of India.

By contradicting the RPwD Act, the DPDP Act pushes the persons with disabilities back into the shadows just when the Constitution promises them equality. The harm is not theoretical—it creates roadblocks in daily life. Such that a visually impaired adult may be blocked from enrolling in an e-learning course without “guardian approval.” A deaf professional may face hurdles signing up for workplace collaboration tools. A wheelchair user making digital payments might be told they need parental authorisation. Instead of enabling access to the digital economy, the law risks further excluding people. If we compare the mandate of the DPDP Act vis-à-vis persons with disabilities with the approach adopted in Europe which has influenced much of our DPDP Act, we find that the EU’s General Data Protection Regulation (GDPR) requires parental consent only for children under 16. The adults, including those with disabilities, retain full independent rights unless a court explicitly rules otherwise. Furthermore, the UN Convention on the Rights of Persons with Disabilities (UNCRPD)—ratified by India in 2007—recognises the equal legal capacity of persons with disabilities. It urges states to shift from substituted decision-making (guardians decide) to supported decision-making (individuals decide with assistance, if needed). The India’s DPDP law instead regresses, reducing autonomy and increasing paternalism.

The arguments above clearly spell out that the Section 9 of the DPDP Act is not merely poorly drafted, it is a classic case of loose designing of the law without harmonising it with the other statutes already enacted by the Parliament of India. For the sake of benefit of doubt, let us not attribute a malicious design into the crafting of Section 9, instead, let us see this as a case of callous draftsman ship followed by the poor visibility based discussions in the Parliament which had led to passing of a law that has in one blow stripped the persons with disabilities one their most modern day Constitutional guarantee of the ‘right to privacy.’

While India march’s forward into the era of digital space, we what we need is a capacity-based framework, not a disability-based one. A justifiable model would distinguish clearly between the three categories, such as:

• Children: Parental consent required, as the law already provides.

• Adults with severe cognitive or mental disabilities: Supported or guardian-assisted consent, but only after medical or judicial certification.

• Adults with physical or sensory disabilities: Fully capable of providing independent consent without additional hurdles.

Such a framework would respect constitutional rights, align with the RPwD Act, and honour India’s UN commitments. Most importantly, it would uphold the dignity of millions of Indians who live with disabilities but are not incapacitated. The DPDP Act’s uniform approach treats people with disabilities as perpetual children in the digital realm. It strips them of a fundamental right to control how their personal data is used, a right already protected by our Constitution. India can and must do better. A capacity-based approach would protect children, safeguard the truly vulnerable, and preserve the independence of everyone else. Anything less is not just a legislative oversight—it is an injustice. The DPDP Act therefore requires an amendment to Section 9 and clear the legislative defect to create a level playing field for the persons with disabilities at par with others and segregate such category of persons from the class of minors in line with the harmonious reading of the provisions of the Rights of Persons with Disabilities Act, 2016 and the Constitutional principles.

*Director, World Cyber Security Forum. Email: pakhi.garg@worldcybersecurities.com

**Registrar & Professor of Law, National Law University, Tripura. Email: mittalketa@gmail.com

[1] Section 13 (1) of the Rights of Persons with Disabilities Act, 2016.

[2] Section 13 (2) of the Rights of Persons with Disabilities Act, 2016.

[3] Section 3 (1) of the Rights of Persons with Disabilities Act, 2016.

[4] Section 3 (2) of the Rights of Persons with Disabilities Act, 2016.