The rapid growth in technology and digitisation has not only increased our dependence on data but also increased considerably the ability to produce data. Debates around data protection and privacy have grown in both volume and complexity following the right to privacy judgment and the various responses of stakeholders. With the legal framework on data protection being imminent in the form of the privacy judgment, ICRIER organised a roundtable discussion on ‘Data Protection and Privacy in India’ that was attended by participants from industry and academia. The notable issues discussed included the crucial concept of consent, its relation to digital literacy and the effectiveness of consent in providing control to the user. Participants highlighted the point that while consent is foundational, it may result in ‘consent fatigue’. It was observed that the concept needs to be re-examined in the context of the proliferation of data collection through innumerable avenues and the lack of digital literacy. The suggested solutions included providing greater control of data to the individual, and turning to some of the measures in the EU’s General Data Protection Regulation (GDPR) that are ethical and sustainable. The discussion further delved into the control of data, and looked closely at the different types of data, and the rules that govern the flows of data. Participants also discussed the nature of regulation and regulatory capacity and additionally, identified some areas for further research.