Published Paper Details:

The concept of "legitimate interest" has emerged as one of the most contested and operationally fragile legal bases in modern data protection law. Across jurisdictions, it was intended to provide flexibility for data controllers while safeguarding individual rights through proportionality and balancing. This paper demonstrates, through a comparative analysis of the European Union, Singapore, United States, and Brazil, that legitimate interest has instead become a persistent source of legal ambiguity, enforcement volatility, and architectural cost. In rights-centric regimes such as the EU and Brazil, ambiguity has been resolved through litigation and regulatory narrowing, generating high documentation and compliance burdens. In Singapore, administrative guidance and accountability frameworks have contained, but not eliminated, uncertainty. In United States, the absence of lawful bases has displaced ambiguity into definitional disputes and technical opt-out enforcement. Against this backdrop, India's Digital Personal Data Protection Act, 2023 represents a deliberate regulatory rupture. By rejecting a general legitimate interest clause and introducing a closed list of "certain legitimate uses," the DPDP Act trades contextual flexibility for legal certainty and administrative predictability. The paper argues that this shift does not eliminate ambiguity but relocates it from legal interpretation to system architecture. Building on this insight, the paper develops concrete technology and governance strategies like consent-centric design, purpose-bound data pipelines, compliance-by-design, and auditability-first architectures, necessary to operationalize the DPDP regime. The analysis concludes that sustainable privacy governance depends less on doctrinal elegance than on the capacity of legal systems to align regulatory design with technical implementation realities.