Archive · 22 Aug 2026
Why AI Decisions Need More Than Personal Data Consent
People often agree to let companies use their personal information.
Increasingly, computers use that information to make predictions or recommendations.
Sometimes those predictions help decide whether someone gets a loan or a job.
Agreeing to data use does not explain how the computer will make its decision.
The result could be wrong, unfair, or hard to understand.
India’s data-protection law gives people several rights, but it does not specifically control automated decisions.
Indian policy proposals and draft court rules emphasise human supervision and explanations.
This means organisations may need to take responsibility for AI decisions, not just obtain consent to use data.
The DPDP Act, 2023, relies largely on consent and transparency for lawful personal-data processing.
Consent to use data does not necessarily cover how AI systems interpret it or influence consequential decisions.
AI-generated decisions may be inaccurate, biased, or difficult to explain even when data use is lawful.
Indian policy frameworks have highlighted explainability, accountability, audits, data minimisation, and human oversight as AI safeguards.
The DPDP Act does not explicitly provide rights to explanation or human review of AI-generated decisions.
- Who
- Organisations using personal data and AI systems, as well as people affected by automated decisions.
- What
- The article argues that consent under India’s data-protection framework is insufficient by itself to govern AI-generated decisions.
- When
- The Digital Personal Data Protection Act was enacted in 2023; the Supreme Court’s draft court-AI regulations are identified as 2026.
- Where
- India, with comparisons to the European Union, the GDPR, France, and global regulatory discussions.
- Why
- AI can interpret data, draw inferences, and produce inaccurate, biased, or unexplained outcomes even when the underlying data processing is lawful.
- Primary law
- Digital Personal Data Protection Act, 2023
- Consent limitation
- Consent covers collection and processing but may not address AI interpretation, inferences, or resulting decisions.
- Affected sectors
- Examples include lending, recruitment, fraud detection, and credit assessment.
- Policy safeguards
- Explainability, accountability, audit mechanisms, human oversight, and data minimisation.
- Court AI rules
- The draft regulations identified in the article require AI systems used in courts to remain assistive and prohibit judicial outcomes based solely on algorithmic decision-making.
- Legal gap
- The DPDP Act does not explicitly regulate automated decision-making or establish a right to explanation or human review.