Collective Redress in Data Privacy: India's Individual Path vs. GDPR's Representative Approach

As India’s Digital Personal Data Protection Act (DPDPA) 2023, along with the DPDP Rules 2025, continues to shape the data privacy landscape, a critical area for comparative analysis remains the framework for collective redress. While global privacy regimes like the GDPR explicitly empower collective actions, India’s approach, anchored in individual grievance mechanisms, presents a distinct model. This analysis compares these frameworks, highlighting where Indian law is silent or divergent from its foreign counterparts.

GDPR Article 80: Facilitating Collective Redress

The European Union’s General Data Protection Regulation (GDPR) stands out for its proactive stance on collective redress. Article 80 explicitly permits a data subject to mandate a not-for-profit body, organisation, or association, which has been properly constituted in accordance with the law of a Member State, to lodge a complaint on their behalf with a supervisory authority, or to exercise the right to a judicial remedy on their behalf. This provision significantly lowers the barrier for individuals to seek redress, especially in cases of widespread but individually minor harm. It allows a single entity to represent numerous data subjects with similar claims, streamlining the process and potentially increasing the deterrent effect on data controllers. The scope extends to both administrative complaints and court proceedings, creating a robust avenue for collective enforcement of data protection rights.

India’s Framework: An Individual-Centric Approach

In contrast to the GDPR, India’s primary data protection legislation, the DPDPA 2023, does not explicitly provide for collective or representative actions for data privacy violations. The Act establishes a robust framework for individual grievance redressal and penalties but remains silent on collective claims.

DPDPA 2023 and Individual Redress

The DPDPA 2023 empowers individual Data Principals with several avenues for redress. Under Section 13, Data Principals can lodge grievances directly with the Data Fiduciary. If unsatisfied, they can appeal to the Data Protection Board of India (DPBI) as per Section 14. The DPBI, established under Section 20, is the adjudicatory body responsible for inquiring into complaints and imposing penalties. While the DPBI can initiate inquiries suo motu or upon receiving complaints, its primary mandate is to address individual grievances and impose penalties, which can be substantial (e.g., up to INR 250 crore for certain breaches under Section 33). Section 27 also allows for compensation to be ordered by the DPBI, but this is typically in the context of individual claims. The absence of an explicit provision for a group of Data Principals to jointly file a complaint or for a representative body to act on their behalf means that each affected individual must pursue their claim separately.

RBI and IT Rules: Sector-Specific Grievance Mechanisms

Beyond the DPDPA, India has sector-specific regulations that include grievance redressal mechanisms, particularly in financial services and digital intermediaries. The Reserve Bank - Integrated Ombudsman Scheme 2021, for instance, provides a cost-free mechanism for customers to resolve complaints against regulated entities, including those related to data privacy within the financial sector. Similarly, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, mandate grievance officers for intermediaries to address user complaints. While these schemes are effective for individual complaints, they do not facilitate collective actions in the vein of GDPR Article 80. A pattern of individual complaints might signal systemic issues, prompting regulatory intervention, but the redressal remains primarily individual.

Comparative Analysis: Stricter, Looser, or Silent

Comparing these frameworks reveals distinct approaches:

• GDPR (Article 80): This framework is stricter on data controllers/processors by explicitly enabling representative actions. This provision significantly facilitates collective redress for data subjects, making it easier for them to pursue claims and increasing the potential for collective liability for widespread privacy infringements.
• India (DPDPA 2023): The DPDPA is silent on explicit collective or representative actions. This silence makes the framework looser on Data Fiduciaries in terms of exposure to consolidated group claims. However, it implicitly places a stricter burden on individual Data Principals, who must individually initiate and pursue their grievances, even if they share common grounds with many others.
• RBI and IT Rules: These sector-specific frameworks offer individual grievance redressal, which is a form of protection but are also silent on collective actions for privacy breaches, aligning with the DPDPA’s approach in this regard.

Trade-offs in Approach

The divergence between the GDPR and India’s framework reflects different policy trade-offs. The GDPR’s approach, by empowering representative bodies, aims to enhance access to justice, particularly for low-value, high-volume claims, and to serve as a stronger deterrent against systemic data protection failures. However, it also introduces complexities related to litigation funding, standing of representative bodies, and potential for increased litigation burden on businesses.

India’s individual-centric model, while potentially reducing the risk of vexatious collective litigation and focusing on individual accountability, might inadvertently raise the practical barrier for Data Principals to seek redress for widespread but individually minor harms. This could lead to under-enforcement in situations where the cost and effort of individual litigation outweigh the potential compensation, even if the aggregate harm is significant. It places the onus squarely on the individual to pursue their rights, which might be challenging against large, well-resourced Data Fiduciaries.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, the current landscape necessitates a strong focus on robust individual grievance redressal mechanisms. While the threat of a formal “class action” is not explicitly enshrined in Indian privacy law, the DPDPA’s provisions for individual complaints (Section 13) and appeals to the DPBI (Section 14), coupled with significant penalties (Section 33) and potential compensation (Section 27), mean that a multitude of individual claims can still accumulate. A systemic privacy failure could lead to a flood of individual complaints, each requiring separate handling and potentially resulting in significant cumulative penalties and reputational damage. Therefore, proactive compliance, transparent data handling practices, and efficient grievance redressal systems are paramount to mitigate risks, even in the absence of explicit collective action provisions. Monitoring global developments and potential future legislative amendments in India, which might introduce such mechanisms, also remains crucial.