Consumers increasingly encounter decisions shaped by profiles created from their personal information. A person may provide information to one business without knowing that an analytics supplier will use it to produce a score or prediction that affects access to a loan, job-related service or other commercial opportunity. The problem becomes harder to address when the business making the decision relies on a third-party system and the supplier treats its methods as confidential. This conceptual legal article examines how Indian data protection law can support meaningful consumer understanding and challenge without requiring the disclosure of an entire proprietary model. It uses doctrinal analysis of the Digital Personal Data Protection Act, 2023 and the notified Rules of 2025, alongside selected European legislation, judicial decisions and scholarship. The article connects three consumer-facing concerns: transparency about the profile used, a fair opportunity to question its relevance or accuracy, and correction that reaches the businesses still relying on it. It proposes a proportionate framework based on a decision record, a specific justification for secrecy, independent review where legally authorised, and documented follow-through after a successful challenge. The article does not report survey, interview or audit findings, and its proposals are normative rather than empirical. Its central argument is that consumer protection should focus not only on access to personal data, but also on whether a person can understand and meaningfully challenge the commercial use of an AI-generated profile.