India's Data Protection Act Spurs Industry Pushback, Privacy Concerns

New Delhi, March 14, 2024 — India's ambitious Digital Personal Data Protection Act (DPDP Act), enacted with the promise of safeguarding citizen data and fostering a secure digital economy, is encountering significant headwinds even before its full implementation. A chorus of industry voices, from multinational tech giants to agile Indian startups, is expressing deep-seated concerns over the law's stringent compliance mandates, potential operational challenges, and ambiguities in its expansive framework. Simultaneously, privacy advocates and civil society groups warn of possible state overreach, broad exemptions, and a perceived dilution of individual data rights, setting the stage for a critical phase of regulatory refinement and stakeholder engagement.

Key points

* Industry stakeholders, particularly startups and SMEs, are grappling with the complexity and financial burden of new compliance requirements under the DPDP Act, seeking urgent clarity on critical definitions and operational guidelines. * Privacy advocates are raising alarms over the Act's broad exemptions for government agencies and the perceived dilution of the right to information, advocating for stronger individual consent mechanisms and accountability. * The government asserts that the DPDP Act strikes a crucial balance between fostering digital innovation and protecting individual privacy, promising continued dialogue with stakeholders during the rule-making process. * Legal experts anticipate a surge in demand for compliance specialists and foresee potential litigation as businesses navigate the new regulatory landscape, stressing the need for robust interpretive guidance. * The implementation timeline remains a key concern, with industry urging a phased approach and adequate preparation time to avoid widespread operational disruptions across various sectors.

Passed by Parliament in August 2023, the DPDP Act marks a pivotal shift in India's digital governance, aiming to regulate the processing of digital personal data. It introduces sweeping changes, defining 'data fiduciaries' (entities determining the purpose and means of data processing) and 'data processors' (entities processing data on behalf of fiduciaries). Entities failing to comply face hefty penalties, with fines potentially soaring up to ₹250 crore for major breaches.

“While we wholeheartedly support the intent behind the DPDP Act – to protect user data in an increasingly digital world – the devil is truly in the details of its implementation,” stated Ms. Anjali Singh, Vice President of Policy at NASSCOM, India's apex IT industry body. “Our members, from large enterprises to emerging startups, are struggling with the sheer breadth of new obligations, particularly regarding cross-border data transfers, the precise definition of 'significant data fiduciaries,' and the mechanics of verifiable parental consent for minors. We urgently need sector-specific guidelines that are practical and proportionate, rather than a one-size-fits-all approach that could stifle innovation.”

Startup founders echo these sentiments, highlighting the disproportionate burden on smaller entities. Mr. Rohan Mehra, CEO of Fin-Tech Innovations, a Bengaluru-based startup, expressed his apprehension. “For a growing startup like ours, understanding and implementing these complex compliance frameworks is a massive undertaking. Hiring dedicated legal and privacy teams, overhauling our data infrastructure, and ensuring granular consent management for every user interaction could divert critical resources away from product development and market expansion. We fear this could create an uneven playing field, favouring larger, well-funded players.”

Civil society organisations, however, view the Act through a different lens, primarily focusing on individual rights and state accountability. Ms. Priya Sharma, Director of the Digital Liberties Foundation, a prominent privacy advocacy group, voiced strong reservations. “While the Act empowers individuals with rights such as access, correction, and erasure, the broad exemptions granted to government agencies for purposes of national security, public order, and even for 'legitimate uses' that are not clearly defined, are deeply concerning. This creates a significant loophole for potential state surveillance and could undermine the very privacy it claims to protect. Furthermore, the absence of a provision for the Right to Information Act to override DPDP Act provisions in public interest cases is a step backwards for transparency.”

Government officials, speaking on condition of anonymity due to ongoing internal consultations on rules, maintained that the Act is a necessity for India's digital future. “The DPDP Act is a forward-looking legislation designed to build trust in India's burgeoning digital economy. We are fully aware of the industry's concerns and are actively engaged in drafting the accompanying rules and regulations with extensive stakeholder input. The goal is to create a framework that protects citizens without impeding innovation,” a senior official from the Ministry of Electronics and Information Technology (MeitY) stated.

India currently boasts over 800 million internet users, making it one of the largest digital markets globally. The government projects the digital economy to reach US$1 trillion by 2025-26. The DPDP Act's impact on this massive ecosystem is therefore profound. Under the Act, individuals will have the right to nominate someone to exercise their rights in case of death or incapacity, a unique feature. It also mandates clear and unambiguous consent, which can be withdrawn at any time. However, the exact mechanisms for managing these rights and the operational challenges for companies handling vast amounts of data remain subjects of intense debate.

Background

The journey towards a comprehensive data protection law in India began in the wake of the Supreme Court's landmark 2017 Puttaswamy judgment, which declared privacy a fundamental right. This ruling spurred the government to form a committee headed by Justice B.N. Srikrishna, which submitted a draft bill in 2018. Over the years, several iterations of data protection bills were introduced, debated, and withdrawn, reflecting the complex interplay of technological advancements, economic imperatives, and diverse stakeholder interests. The current DPDP Act, while drawing from previous drafts, has notably shifted certain positions, particularly regarding data localisation requirements (which it largely dilutes) and the scope of government exemptions. Its passage marks the culmination of nearly a decade of legislative effort, placing India among nations like the EU (with GDPR) and California (with CCPA) that have robust data protection frameworks, albeit with distinct characteristics tailored to India's unique context.

What it means

The DPDP Act fundamentally reshapes how personal data is collected, processed, and stored in India. For businesses, it necessitates a complete overhaul of data governance policies, requiring transparent consent mechanisms, robust data breach reporting protocols, and the appointment of a Data Protection Officer (DPO) for significant data fiduciaries. It means increased compliance costs, particularly for sectors like financial services, healthcare, and e-commerce, which handle sensitive personal data. For citizens, it theoretically empowers them with greater control over their personal information, granting rights to access, correction, erasure, and data portability. However, the broad governmental exemptions mean that the state's access to personal data will largely remain outside the purview of the Act for specific reasons, potentially creating a dichotomy in protection levels. The law also lays the groundwork for a Data Protection Board of India, an independent body tasked with enforcement, a crucial aspect whose composition and powers are still eagerly awaited.

Reactions

**Big Tech and Multinationals:** Large technology companies, while welcoming a unified national law, are seeking more nuanced guidance on global data transfer mechanisms and harmonisation with international standards. Many have already invested heavily in GDPR compliance and are evaluating the extent of further modifications needed for the Indian context. They advocate for a predictable regulatory environment that supports cross-border data flows essential for global operations.

**Indian Startups and SMEs:** This segment expresses the most vocal concerns regarding the Act's practicality and economic impact. Beyond the initial setup costs for compliance, ongoing operational expenditures for maintaining consent records, conducting Data Protection Impact Assessments (DPIAs), and managing data breach notifications are viewed as substantial. They call for simpler, proportionate compliance frameworks or extended transition periods tailored to their scale and resources.

**Civil Society and Privacy Advocates:** Organisations like the Internet Freedom Foundation and the Digital Liberties Foundation continue to advocate for a stronger rights-based approach. Their primary criticisms revolve around the broad exemptions for government processing, the lack of an independent regulator (expressing concern over potential government influence on the Data Protection Board), and the 'deemed consent' provisions in certain scenarios, which they argue dilute explicit consent requirements.

**Opposition Political Parties:** Various opposition parties have criticised the Act, with some calling it a 'diluted' version that prioritises corporate interests or state power over individual privacy. They have particularly questioned the government's ability to exempt itself from critical provisions and the perceived lack of a truly independent regulatory body, suggesting that the Act could be weaponised for surveillance rather than protection.

**Legal Experts:** The legal fraternity anticipates a busy period, with increased demand for specialists in data protection law. They highlight the Act's reliance on 'rules' to operationalise many key provisions, meaning the actual impact will only become fully clear once these rules are finalised. There is a general consensus on the need for comprehensive stakeholder consultations to ensure the rules are robust, enforceable, and address the myriad practical challenges.

What happens next

The immediate focus shifts to the Ministry of Electronics and Information Technology (MeitY) as it works to formulate and notify the detailed rules and regulations under the DPDP Act. These rules are crucial as they will flesh out the practical aspects of compliance, including the specific criteria for 'significant data fiduciaries,' procedures for data breach notifications, the structure and powers of the Data Protection Board, and precise mechanisms for consent management. Industry dialogues and public consultations on these draft rules are expected to be intense and pivotal in shaping the law's final operational contours. Legal challenges to specific provisions of the Act are also a distinct possibility, particularly from civil society groups concerned about fundamental rights implications. The effective establishment and staffing of the Data Protection Board will be another critical determinant of the Act's success, as it will be responsible for enforcing the law and adjudicating disputes. Businesses, meanwhile, are advised to begin internal assessments of their data processing activities and prepare for significant investments in technology and training to align with the new regime, anticipating a phased implementation that could extend well into 2025.