#A Privacy Notice Your Screen Reader Can't Read Still Counts as Consent Under the DPDP Act

Serve a blind user a consent notice that their screen reader cannot parse, collect their tap, and under the DPDP Act you have obtained valid consent. Nothing in the Act or the DPDP Rules 2025 says otherwise — and that is the gap a report launched in New Delhi on 23 September has now put on the record, eleven months before the same government's other arm makes that identical notice a punishable accessibility failure.

The report is Incidental Accessibility: How Mainstream Technology Is Expanding Accessibility in India, published by policy firm The Quantum Hub. Its privacy findings matter more than its title suggests, because they identify something India's data protection debate has almost entirely missed: the DPDP Act regulates what a notice must say and is silent on whether the person can perceive it. Clarity and accessibility are not the same requirement, and India has legislated only the first.

#What the report actually did

Rather than survey the law in the abstract, The Quantum Hub followed five people who use ordinary consumer hardware as assistive technology. Rahul Gambhir, who is blind, uses AI-enabled smart glasses. Shishir Bhatnagar, a wheelchair user, runs his home through smart speakers. Amrit Hallan, whose locomotor disability limits the use of his fingers, dictates instead of typing. Kushagra Sahu, who is hearing impaired, relies on a smartwatch's haptic alerts. Sakshi, who has ADHD, uses noise-cancelling headphones.

None of these are "assistive devices" in the government's classificatory sense. They are mass-market electronics doing assistive work — and that mismatch is precisely what breaks both the tax treatment and the consent model built around them.

#Rule 11 already fixed the loudest problem

Credit where it is due: the most-criticised provision in this area has already been repaired, and the repair is a real one.

Section 9(1) of the DPDP Act, 2023 requires a data fiduciary to obtain verifiable consent from a lawful guardian before processing the personal data of a person with a disability who has one. As drafted, it turned on two facts only — that a person has a disability, and that a guardian exists. It drew no line between disabilities that affect legal decision-making capacity and those that do not. A person with a purely physical impairment and a court-appointed guardian could, on a literal reading, lose the ability to consent to anything on his own behalf.

That sat badly against the Rights of Persons with Disabilities Act, 2016, which works on limited guardianship: a court or designated authority specifies which decisions a guardian may take, rather than transferring all of them wholesale. Writing in ThePrint in April 2025, Nipun Malhotra of the Nipman Foundation and Senu Nizar argued that including physical impairment in the guardian-required category was "poorly thought out and flawed as physical disability does not automatically imply a lack of mental capability," and questioned how a limited guardian could make data decisions "continuously over an indefinite period."

Rule 11 of the DPDP Rules, 2025 narrowed the test. Guardian consent now turns on whether a person, despite being given adequate and appropriate support, is unable to take legally binding decisions. The rule also requires a data fiduciary to do actual due diligence on the claimed guardian — verifying appointment by a court, by a designated authority under Section 15 of the RPwD Act, or by a local level committee under Section 13 of the National Trust Act, 1999.

That is a genuine alignment with India's limited-guardianship model, and it is worth saying plainly because the four problems that remain are not failures of drafting intent. They are structural.

#The four gaps the DPDP Act leaves open

Notices with no accessibility floor. The Rules require a privacy notice to be clear and understandable. They set no accessibility standard for it whatsoever. A blind user can be served a notice a screen reader cannot parse, and the consent obtained on it still counts as valid. This is the load-bearing gap: every other consent protection in the statute runs through a notice the data principal is assumed to have perceived.

Consent as a physical act. The DPDP model leans on repeated, granular permissioning — each purpose, each withdrawal, each re-confirmation. For a user with limited hand mobility, a consent architecture that multiplies interactions is not a neutral design choice; it converts a legal right into a physical obstacle. The right to withdraw consent is worth what it costs to exercise.

Incidental capture. Smart speakers, always-on cameras and AI glasses record people who never became data principals of anything. The report's framing is sharp: a hearing person does not seek permission to hear and interpret what is said to them, yet the same function performed by a device triggers an entire consent regime — while the bystanders it captures get nothing. Shri Vikash Chourasia, a Scientist at MeitY, acknowledged at the launch that the framework "does not resolve" the conflict between users who need capture and citizens avoiding it.

Anonymisation that doesn't hold. Speech recognition trained on atypical speech needs data from a small population of atypical speakers. That is close to a definition of re-identifiable data. Standard anonymisation assurances are weaker here than the compliance paperwork will claim.

#The accessibility rules set to collide with the DPDP Act

Here is the part that should change how compliance teams sequence their work, because it is a collision between two regulatory regimes that are not talking to each other.

On 16 July 2026, the Department of Empowerment of Persons with Disabilities, under the Ministry of Social Justice & Empowerment, published the draft Rights of Persons with Disabilities (Amendment) Rules, 2026. They propose a binding conformance regime for ICT products, services and digital content — websites, mobile applications, software, electronic documents, consumer ICT hardware.

The scope is broad: establishments that manufacture, design, develop, exercise decisive technical control over, or make available covered ICT products and services to persons in India. The timelines are turnover-graded. Establishments at ₹500 crore or more get one year to meet specified non-negotiable requirements; those below get 18 months; all establishments must meet the referenced accessibility standards in full within two years, for the purposes of Section 46 of the RPwD Act.

This did not come from nowhere. In Rajive Raturi v. Union of India (November 2024), the Supreme Court directed the government to carve a binding, uniform accessibility floor out of guidelines that had until then sat inside Rule 15 of the RPwD Rules without much bite. The draft rules are the answer to that direction, and they are expected to be finalised around January 2027.

Now line the two calendars up. India's ICT accessibility floor lands roughly a year from now. The DPDP Act's substantive obligations — including Section 9 and Rule 11 — commence in May 2027, with the Consent Manager framework under Rule 4 arriving ahead of them in November 2026. A consent notice that a screen reader cannot parse will be simultaneously valid under the data protection statute and non-conforming under the accessibility statute, enforced by different ministries, on different clocks, with no cross-reference between them.

Compliance teams building consent flows for May 2027 against DPDP requirements alone are building to the wrong specification.

#What the EU did differently

The contrast with Europe is instructive, and it is not the usual GDPR-versus-DPDP comparison about legitimate interests or data localisation.

Under the GDPR, consent must be freely given, specific, informed and unambiguous. European regulators and practitioners have drawn the obvious inference: an inaccessible consent banner means users with disabilities cannot meaningfully give or withhold consent, and therefore you do not have valid consent for that processing. Accessibility failure is a data protection failure, inside a single instrument, without needing a second statute.

The European Accessibility Act then adds a separate conformance duty on top, and it is already being enforced — France, Norway, Sweden, the Netherlands and Italy have taken action, with penalty frameworks ready in Germany, Spain and Ireland.

India is getting the second half of that structure through the RPwD amendment rules while leaving the first half unbuilt. "Informed" in Indian data protection law is not yet doing the work that "informed" does in European law. Closing that gap does not require new primary legislation — it requires the Data Protection Board, once it exists, to read the notice requirement as including perceivability, or MeitY to say so in guidance.

#The tax problem sitting next to it

The report's second policy finding is adjacent but worth flagging for anyone building in this space. Devices on the government's official assistive list attract a concessional 5% GST against 18% on ordinary electronics, and qualify for purchase support under the ADIP scheme. A smartwatch that alerts a deaf user to an incoming call attracts the full 18%, because it was not built to be assistive technology.

Smt. Manmeet Nanda, Additional Secretary at DePwD, proposed at the launch that recognition shift from device classification to assistive use — precisely so that mainstream manufacturers are not saddled with certification burdens that would raise costs and suppress adoption. The unresolved question, which neither Nanda nor the report answers, is who adjudicates whether a given purchase qualifies. That lands with the Finance Ministry.

#What data fiduciaries should do before May 2027

The practical takeaway is narrow and actionable:

• Test consent flows with a screen reader, not a checklist. If your notice fails NVDA or TalkBack, you have a defect that is currently legal under DPDP and will shortly be illegal under RPwD. Fix it once.
• Count the interactions required to withdraw consent. If withdrawal takes materially more physical effort than granting, that asymmetry is a live risk under both regimes and a bad look in front of a new regulator looking for early cases.
• Do not build Section 9 guardian verification on disability status. Rule 11's test is inability to take legally binding decisions despite adequate support, plus verified appointment through one of three named channels. Treating every disclosed disability as a guardian trigger is now the wrong reading, and an insulting one.
• Map incidental capture honestly. If your product records non-users, say so in your DPIA rather than waiting for the Board to ask.
• Sequence against both calendars. Accessibility conformance may bind you before DPDP's substantive obligations do, depending on your turnover.

Teams working through consent architecture and withdrawal mechanics will find our consent manager breakdown useful for the Rule 4 framework landing in November 2026, and our resources section tracks the commencement dates across both regimes.

#The bottom line

India spent two years arguing about whether Section 9 infantilised persons with disabilities, and Rule 11 largely settled it. The unglamorous gap — that the DPDP Act never required a notice to be perceivable by the person consenting — survived the entire debate because it was nobody's headline issue.

It is now on a collision course with a binding accessibility regime from a different ministry, and the window to fix it cheaply, before both sets of obligations bite, is roughly eleven months wide. Data fiduciaries that treat accessibility as a UX nicety rather than a consent-validity question are underwriting a risk on both statutes at once — with a Data Protection Board that can levy up to ₹250 crore per contravention still waiting to be staffed, and looking for a first case that makes a point.

Building DPDP-compliant consent infrastructure? Explore our consent manager tooling or browse the full DPDP resource library.