INDIA has always had a flair for grand gestures—the Great Indian Wedding, the Great Indian Family, the Great Indian Dream. Now, we are witnessing another uniquely Indian phenomenon: ‘the Great Indian Privacy Push.’ In a country where millions are navigating an increasingly digital world, the debate has shifted beyond mere data ‘collection’ to focus on who ‘controls’ it and how it is safeguarded. With the introduction of a structured privacy framework, India is setting the stage for a digital transformation that prioritizes data ‘protection.’
This push comes at a defining moment—a time when privacy is no longer a luxury but a necessity. Every time we tap ‘I Accept’ without a second thought, or trade our privacy for convenience, we leave behind digital breadcrumbs across the internet, often without realizing who is collecting them or for what purpose. With millions of Indians going about their digital lives this way, trust in those managing our data is no longer optional—it is essential. And now, for the first time, India is responding with a legal framework designed not just to regulate, but to redefine the rules of the game. This is not just a privacy framework; it is a privacy revolution at a scale that only India can attempt.
The Times, They Are A-Changin’: Meaning of ‘personal data’ at the heart of India’s Shift from the IT Act to the DPDP Act
With the introduction of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the unveiling of the draft Digital Personal Data Protection Rules, 2025 (“Draft Rules”) for public comment, India has transitioned from a fragmented, sectoral approach to a comprehensive, structured data privacy regime. As G.K. Chesterton wisely put it, “Before you remove a fence, pause long enough to ponder why it was there in the first place.” Before fully embracing this shift, it is essential to examine where we were and what has changed.
