Additional exemptions apply to most publicly available personal data, data processing for research and statistical purposes, and the processing of foreigners' personal data by Indian companies under contracts with foreign firms (such as outsourcing companies). Instead, to achieve data regulation that would empower consumers, one would need to design consent into the technological architecture of data collection and data exchange systems.