India’s data protection law: India’s digital revolution is a reality in everyday life—humming in real time, powering everything from bustling e-commerce bazaars to AI-enabled public services. Yet beneath the triumphant headlines lies a quieter contest for power: whoever owns the data owns the future.
Picture a bazaar where a handful of merchants know every preference and vulnerability you possess, while you know almost nothing about them. That, in essence, is today’s internet. For Big Tech, personal data has become the raw material for targeted advertising, lock-in business models and, ultimately, market dominance. The more data a platform amasses, the better it can predict behaviour, marginalise rivals and tighten its grip. Innovation alone cannot dislodge such incumbents.
READ | India, UK sprint for FTA before Trump’s tariff tide rolls in
Data protection law seeks Big Tech compliance
That imbalance prompted Parliament to pass the Digital Personal Data Protection Act (DPDPA), 2023. By demanding explicit consent, data minimisation and portability, the law is meant to put citizens back in charge of their digital selves. In doing so it also chips away at Big Tech’s favourite moat: limitless troves of personal information. Limiting hoarding, in theory, gives insurgent start-ups a fighting chance.
In practice, the picture is murkier. Compliance is expensive. A well-capitalised multinational can absorb the cost of new consent dashboards and cyber-security audits far more easily than a cash-burning start-up. Unless the implementation is calibrated, the DPDPA could entrench exactly the giants it hopes to tame.
Multiple regulators create confusion
India’s competition watchdog has reached a similar conclusion. When Meta attempted to bundle WhatsApp data with its wider Facebook ecosystem, the Competition Commission of India (CCI) labelled it not only a privacy breach but an abuse of dominance—proof that data governance and market fairness now live in the same house.
The problem is that the doorkeepers will be different. A new Data Protection Board will enforce the DPDPA, while the CCI polices competition. Without cooperation, companies could face contradictory rulings and interminable litigation, while consumers wait for relief that never arrives.
Avoiding regulatory chaos
How can India avoid that chaos? Three complementary reforms point the way.
First, the two regulators must share intelligence and run joint investigations whenever privacy and competition concerns overlap. A common fact-finding process—pooling forensic audits, witness testimony and technical expertise—would prevent duplicated effort and ensure that a single set of evidence underpins both privacy and antitrust rulings. For business, that means faster clarity; for consumers, swifter redress.
Second, the government should publish clear jurisdictional rules that decide—case by case—which agency leads and which supports. If a matter centres on excessive data collection, the Board could take charge with the CCI in an advisory role; if the core issue is abuse of market dominance, the order would reverse. Pre-agreed triggers would end turf wars before they begin and spare companies the purgatory of parallel proceedings.
Third, both agencies must commit to agile rule-making. Technology races ahead in six-month cycles; regulation cannot wait for quinquennial reviews. Regular consultations with industry, academia and civil society should refresh thresholds for “significant data holders,” update definitions of sensitive data and adapt enforcement tools to AI models, blockchain-based services and tomorrow’s yet-unimaginable platforms. A living rulebook, not a static one, is the only way to stay relevant.
Crucially, regulation must remain proportionate. A risk-based regime—tougher scrutiny for data-rich behemoths, lighter touch for fledgling ventures—would protect consumers without choking the start-up ecosystem that has become India’s pride.
The stakes stretch well beyond market share. In a data-driven economy, who controls information will shape opportunity, competition and the distribution of wealth itself. Done right, India can build a digital society that is both innovative and fair. Botch the balance, and the revolution unfolding before our eyes may end up repeating the inequalities of the offline world it once promised to transcend.
Gazal Arora is a research associate with CUTS Institute for Regulation & Competition.