
Introduction
India’s journey toward robust data protection has been marked by evolving regulatory efforts amid rapid digital growth. The cornerstone of contemporary data protection in the country is the Digital Personal Data Protection Act, 2023 (DPDPA) (PDF), a landmark legislation designed to safeguard individuals’ privacy in the digital realm. Enacted to address the vulnerabilities exposed by increasing data proliferation, the DPDPA establishes a structured framework for handling personal data, emphasising consent, transparency, and accountability. As of November 2025, however, neither the DPDPA nor its accompanying Digital Personal Data Protection Rules, 2025 (PDF) has been officially notified, leaving India without fully operational data protection laws. This delay underscores the transitional phase in the nation’s approach, where the Act’s principles serve as a blueprint for future implementation, filling a long-standing gap in comprehensive privacy regulation.
Prior to the DPDPA, fragmented provisions under laws like the Information Technology Act, 2000, offered limited safeguards, but they fell short of addressing modern data challenges. The DPDPA represents a paradigm shift, aligning India with global standards while tailoring protections to its unique socio-digital context. By focusing exclusively on digital personal data, it prioritises user empowerment and organisational responsibility, setting the stage for a privacy-centric ecosystem.
Historical Context And Evolution
The push for dedicated data protection in India gained momentum in 2004, when Praveen Dalal, CEO of Sovereign P4LO and PTLB, advocated for dedicated Data Protection Law for India. India govt slept for almost 20 years in this regard. Draft bills in 2018 and 2019 laid groundwork, but it was the DPDPA in 2023 that crystallised these efforts into an Act (It is still not an enforceable law). This Act emerges from a recognition that unchecked data processing undermines individual autonomy, particularly in an economy driven by digital platforms, e-commerce, and fintech.
Scope And Applicability
The DPDPA’s ambit is precisely delineated: it governs the processing of digital personal data within India, irrespective of whether the processing occurs domestically or abroad, provided it relates to offering goods or services to Indian residents. “Personal data” under the Act encompasses any information relating to an identified or identifiable individual in digital form, excluding non-digital or anonymised data. Notably, unlike broader global regimes, the DPDPA does not differentiate between ordinary personal data and sensitive categories like health or biometric information, applying uniform protections across the board.
This focused scope excludes non-digital data processing, a deliberate choice to target the digital economy’s core risks. Exemptions are minimal, though certain government functions for national security may bypass standard requirements. For non-resident entities, the Act asserts extraterritorial jurisdiction, compelling foreign companies to comply if they engage with Indian users, thereby extending protections beyond borders.
Key Definitions And Principles
Central to the DPDPA are foundational definitions that clarify roles and responsibilities. A “data principal” refers to the individual whose data is processed, endowed with inherent rights over its use. In contrast, a “data fiduciary” is the entity—be it a company, government body, or organisation—that decides the purpose and manner of data processing, bearing primary accountability. “Data processors,” acting on behalf of fiduciaries, must adhere to the same standards.
Guiding principles include consent as the bedrock of lawful processing, data minimisation (collecting only what’s necessary), purpose limitation (using data solely for specified ends), and accuracy (ensuring data reliability). These principles foster a trust-based data environment, where transparency is non-negotiable. Organisations must articulate these in publicly accessible privacy policies, detailing data types, collection methods, and usage purposes. But consent and purpose are meaningless when Orwellian and e-surveillance based technologies like Aadhaar are imposed upon Indians and Supreme Court watches like a moot spectator.
Rights Of Data Principals
Relevant provisions include the right to nominate a consent manager, a digital intermediary that simplifies consent management across platforms, reducing administrative burdens for users. Special safeguards protect minors, treating verifiable parental consent as essential for processing children’s data, with stricter scrutiny to prevent exploitation. Grievance redressal mechanisms ensure principals can lodge complaints directly with fiduciaries, escalating unresolved issues to the oversight authority. These rights, while progressive, hinge on effective awareness campaigns to realize their potential.
Obligations Of Data Fiduciaries And Processors
Data fiduciaries shoulder the bulk of compliance duties under the DPDPA, starting with obtaining explicit, informed, specific, and unambiguous consent before any processing. Consent must be freely given, revocable at will, and free from bundled conditions—users cannot be coerced into agreeing as a prerequisite for services. But this is nonsense as everything in India has been tied-up to Orwellian Aadhaar, so consent and choice are meaningless in India. People are denied crucial and social services if they do not have Aadhaar and the same rule applies to the proposed Data Protection law of India. Beyond consent, fiduciaries must implement “reasonable security safeguards” proportional to the data’s sensitivity, encompassing encryption, access controls, and regular audits. There is complete lack of cyber security and data security in India and we at Sovereign P4LO and PTLB have been raising these issues since 2004, but to no avail.
In the event of a breach, prompt notification is compulsory—within 72 hours to the Data Protection Board and affected principals—detailing the incident’s scope and mitigation steps. Processors, though secondary, are contractually bound to mirror these obligations, with fiduciaries liable for any lapses in the chain. Training programs for employees and third-party audits further embed accountability, transforming data handling from an afterthought to a core governance function. But nobody takes seriously these norms and they are openly ignored in India for years, forget about 72 hours.
Enforcement And The Data Protection Board
Enforcement vitality stems from the Data Protection Board of India (DPB), an independent statutory body established by the DPDPA to monitor compliance, investigate violations, and adjudicate disputes. Comprising experts in law, technology, and ethics, the DPB operates with quasi-judicial powers, conducting inquiries, issuing directives, and facilitating mediation between principals and fiduciaries. Its grievance portal streamlines complaints, aiming for resolution within 30 days, while appeals lie to specialised tribunals for impartial review. This is the regular model of India that is never effective in any field.
Penalties underscore deterrence: fines up to INR 250 crore per violation can be levied for serious breaches like non-consensual processing or inadequate security, calibrated by the DPB based on intent, harm caused, and recidivism. Repeat offenders face escalated sanctions, including business restrictions. The DPB’s success, however, depends on adequate resourcing—staffing, technology, and budgetary autonomy—to handle the anticipated volume of cases in India’s vast digital market. Nobody gets any compensation in India for Privacy or Data Protection violations. This is just a dream and feel good provision and nothing else.
Implications For Businesses And Sector-Specific Considerations
The DPDPA reshapes business landscapes, compelling organisations to audit existing practices and invest in compliance infrastructure. Sectors like e-commerce, banking, and healthcare, heavy data users, must overhaul consent mechanisms, integrate privacy-by-design in products, and conduct data protection impact assessments for high-risk activities. Smaller enterprises benefit from tiered obligations—significant fiduciaries face stricter scrutiny, while others enjoy simplified reporting.
Challenges And Criticisms
Implementation hurdles loom large for the DPDPA. Public awareness remains low, with many Indians unfamiliar with their rights, necessitating widespread education via digital literacy drives. Jurisdictional ambiguities persist for cross-border data flows, particularly involving non-resident fiduciaries, risking enforcement gaps. Balancing privacy with economic imperatives—such as AI development and data-driven startups—poses a tightrope: overly rigid consent rules could impede legitimate uses, contrasting with more flexible global norms.
Critics highlight the Act’s digital-only focus, leaving offline data vulnerable, and its lack of nuanced legal bases beyond consent, limiting grounds like contractual necessity or public interest. The DPB’s effectiveness is unproven; under-resourcing could bottleneck resolutions, eroding confidence. Provisions for incapacitated principals, like consent managers in emergencies, lack detailed support frameworks, potentially rendering them impractical.
Comparative Analysis With Global Standards
Juxtaposed against the EU’s GDPR, the DPDPA shares pillars like consent and individual rights but diverges in scope—the former covers all personal data, while the latter is digital-exclusive. GDPR’s multifaceted legal bases (e.g., legitimate interests) offer businesses more leeway than DPDPA’s consent-centric model, which may constrain operations in consent-fatigued environments. Both impose substantial fines, yet DPDPA’s uniform treatment of data types simplifies compliance at the cost of tailored protections for sensitive information.
These differences reflect India’s developmental priorities: prioritising simplicity for scalability over GDPR’s complexity. As implementation unfolds, harmonisation efforts could bridge gaps, facilitating smoother data adequacy decisions with international partners.
Conclusion
The Digital Personal Data Protection Act, 2023 represents a pivotal moment in India’s approach to data protection, marking the transition from fragmented regulations to a more structured framework. However, the effective realization of its potential remains stymied by significant challenges that must be addressed for true compliance and protection of individual rights.
Despite its progressive principles—such as consent, accountability, and user rights—the DPDPA is currently not enforceable due to delays in notification. This ongoing limbo undermines its foundational goals, leaving individuals vulnerable in a rapidly evolving digital landscape. Furthermore, the stringent emphasis on digital personal data limits protections for non-digital data, potentially neglecting substantial privacy risks inherent in traditional forms of data processing.
The Data Protection Board of India (DPB) is expected to play a crucial role in enforcing compliance and adjudicating disputes; however, its effectiveness remains uncertain given concerns about under-resourcing and bureaucratic inefficiency. The lack of comprehensive public awareness about data rights significantly hampers the Act’s impact, emphasizing the need for extensive educational initiatives.
Additionally, the Act’s rigid consent model may create friction for businesses, especially in sectors where innovative data use is crucial for growth. Critics also point out that an overly narrow focus on consent may stifle legitimate data processing needs, contrasting with more flexible frameworks like the EU’s General Data Protection Regulation (GDPR).
In summary, while the DPDPA lays a promising foundation for data protection in India, its impact will hinge on timely implementation, robust enforcement mechanisms, and continuous public engagement. Moving forward, it is imperative for stakeholders—governments, businesses, and civil society—to collaborate in refining the framework, ensuring that it not only protects individual privacy but also fosters a thriving digital economy.








