CLAT 2025 Legal Set 6 (5 Questions with Solutions)

The Supreme Court of India declared that the right to privacy is a fundamental…

CLAT 2025 · Legal Reasoning · 5 questions

The Supreme Court of India declared that the right to privacy is a fundamental right and that the right to informational privacy is part of this right. Subsequently, the Parliament of India enacted a new law relating to digital personal data protection. The law applies to Indian residents and businesses collecting the data of Indian residents. It also applies to non-citizens living in India whose data processing is "in connection with any activity related to the offering of goods or services" that happens outside India. The law allows personal data to be processed for any lawful purpose. If the personal data is sensitive, then additional safeguards are to be observed. The entity processing data can do so either by taking the concerned individual's consent or for "legitimate uses "which include situations where an individual has voluntarily provided personal data for a specified purpose. The law requires that an individual's consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and for a specific purpose. The data collected has to be limited to that necessary for the specified purpose. A clear notice containing these details has to be provided to consumers, including the rights of the concerned individual and the grievance redressal mechanism. Individuals have the right to withdraw consent if consent is the ground on which data is being processed. The law also creates rights and obligations for individuals. These include the right to get a summary of all the collected data and to know the identities of all other entities/organisations with whom the personal data has been shared, along with a description of the data shared. Individuals also have the right to correction, completion, updating, and erasure of their data. Besides, they have a right to obtain redressal for their grievances and a right to nominate persons who will receive their data. [Excerpts from Anirudh Burman, "Understanding India's New Data Protection Law", CARNEGIE INDIA, October 03, 2023]

Question 1

An Indian company collects personal data from its users to provide personalized services. The company intends to share this data with a third-party vendor for targeted advertisements. Under the digital personal data protection law in India, what must the company do before sharing the data?

A. Obtain explicit consent from the users
B. Share the data by informing the users, as it is for business purposes
C. Encrypt the data and share it with the third-party vendor
D. Inform the third-party vendor that the data is sensitive

Practise this question and check your answer →

Question 2

A social media platform processes user data based on the consent given during account creation. A user now wishes to withdraw consent to process their data. Under the digital personal data protection law in India, what must the platform do?

A. Refuse to accept the withdrawal request since consent was already given
B. Comply with the legal requirements and stop processing the data
C. Continue processing the data but notify the user
D. Allow withdrawal only after 30 days

Practise this question and check your answer →

Question 3

A financial institution collects biometric data from its clients for verification purposes. If the clients wish to know what data has been collected, under the digital personal data protection law in India, what right allows them to request this information?

A. Right to Data Portability
B. Right to Correction
C. Right to Access
D. Right to Be Forgotten

Practise this question and check your answer →

Question 4

A startup provides a health-tracking app that collects sensitive health data from users. Under the digital personal data protection law in India, what additional precautions must the startup take compared to regular personal data?

A. No additional measures are needed
B. Ensure explicit consent and adopt higher security standards
C. Store the data only with the government agencies
D. Store the data only with the hospitals and other health care institutions

Practise this question and check your answer →

Question 5

As per the passage, what are the rights included under the digital data protection law of India? 1. Right to get the summary of collected data 2. Right to know to whom the data has been shared 3. Right to correct and update the data 4. Right to get the data removed from the database 5. Right to decide on who can receive their data 6. Right to get redressal of grievances

A. 1, 2, 5 and 6
B. 1, 3, 4 and 6
C. 1, 3, 5 and 6
D. 1, 2, 3, 4, 5 and 6

Practise this question and check your answer →