Nine Years from Privacy as a Fundamental Right: Why the DPDPA Deserves Every Organisation's Attention

On 24 August 2017, a nine-judge bench of the Supreme Court of India delivered one of the most consequential verdicts on Privacy. In Justice K.S. Puttaswamy (Retd.) v. Union of India, ("Puttaswamy judgement") the Court held unanimously, that privacy is a Fundamental Right under Article 21; cutting through the casual and inconsiderate intrusions common in both real and virtual worlds. This historic declaration from the Apex court concretized the thin landscape of Privacy Laws in India that stemmed from the IT Act 2000 and the SPD Rules 2011. Nine years to the day, we are on the verge of implementing the Data Privacy law in India, with the final step of enforcement coming in May 2027. A legislation as extensive as the human digital footprint has been changing the entire communication dashboard. The new regime has everyone rehaul their data practices, their storage and processing workouts and even how they interact with their customers.

The message has matured into an operational law: the Digital Personal Data Protection Act, 2023 ("DPDPA") moving through a phased rollout under the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). This anniversary feels like the right moment to set out, plainly, why the DPDPA matters and why it deserves board-level attention, not just a line item in the legal department's to-do list.

Data governance in India has been built in layers, each responding to the technology and disputes of its time: The Information Technology Act, 2000 (as amended in 2008) gave us the first statutory hooks — Section 43A imposed civil liability on bodies corporate for failing to protect sensitive personal data, and Section 72A criminalised wrongful disclosure of information obtained under a lawful contract. The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPD Rules 2011") operationalised Section 43A but only for a narrow, defined category of "sensitive personal data": financial information, health records, biometrics, passwords, and similar. The Puttaswamy judgment (2017) located privacy within Article 21 and the Hon'ble Supreme Court effectively pushed the state toward building a real data protection framework. Ordinary personal information now carried constitutional weight, not just contractual protection. The Srikrishna Committee report and the Personal Data Protection Bill, 2019 followed, going through years of parliamentary committee review before being withdrawn in 2022 and replaced with a fresh draft. The DPDP Act, 2023 received presidential assent in August 2023 as India's first standalone, comprehensive data protection statute; and the DPDP Rules, 2025, notified on 13 November 2025, finally began operationalising the Act.

We're currently in the middle of a staggered rollout: the Data Protection Board of India is functional; the Consent Manager framework goes live in November 2026; and full substantive compliance — notice and consent mechanics, breach reporting, cross-border transfer conditions — become enforceable by May 2027. The portions of the criteria for designating Significant Data Fiduciaries and the approved list of countries for cross-border transfer are still awaited. That two-decade arc from a subsection buried in a general IT statute to a dedicated Act with its own regulator is exactly why data governance has become a specialisation, and why organisations increasingly need advisors who track this framework as it's actively being built, not just as it reads on paper.

1. Ambit is far wider than before: SPD Rules, 2011 attached only to a narrow category of "sensitive personal data." DPDPA drops that distinction — it applies to all digital personal data, from a name to an email address to a device ID, the moment it can identify a natural person.

2. Consent is no longer a formality — it's the foundation: Broad, bundled "I agree to the Terms and Conditions" consent no longer holds up; it has to be clear, specific and must be sought afresh for each purpose. Withdrawal being required to be equally easy as furnishing it is a real shift in business interactions.

3. Accountability now sits with the organisation, not policies: DPDPA builds a graduated responsibility model — Data Fiduciary carries baseline duties of notice, consent, and reasonable security, while Significant Data Fiduciaries — a category the Central Government can designate based on the volume and sensitivity of data processed and the risk involved — face heavier obligations.

4. Foundation of trust in a digital-first economy: With millions of Indians transacting through UPI, e-commerce, fintech, and health tech platforms, a credible data protection regime lets people trust these services enough to keep using them — which in turn accelerates India's growing digital economy.

5. Control back to the individual: Individuals are now Data Principals having complete rights of access, correction, and erasure of their data, for their grievances to be addressed, and can nominate someone to exercise these rights on their behalf. Non-compliance isn't a theoretical risk: huge penalties up to ₹250 crore.

6. Defined rulebook for every stage of data lifecycle: Notice at the point of collection, conditions for processing, timelines for breach reporting, rules for cross-border transfer, and a formal inquiry-and-adjudication process before the Data Protection Board replace the old patchwork of contractual clauses and voluntary best practices with clear, sequential obligations.

7. Brings Indian data governance in line with global standards: The DPDPA applies not only within India but also to processing outside India that's connected with offering goods or services to people here; an extraterritorial reach similar to the GDPR's. Combined with its consent-first architecture, India is signalling to global businesses, trade partners, and regulators alike that it now has a data protection regime built for a world where data moves faster than borders do.

8. Data deletion carries the spirit of a "right to be forgotten": Data Fiduciaries must erase personal data once consent is withdrawn or the purpose for which it was collected is served — a meaningful behavioural shift for any organisation used to holding on to data by default.

9. Children's data gets ring-fenced protection: Processing a child's personal data requires verifiable parental or guardian consent, and Data Fiduciaries are barred outright from behavioural monitoring, tracking, or targeted advertising directed at children. This puts real compliance weight behind child safety online.

10. Scale of the penalties is itself a message: These aren't nominal fines as a cost of doing business. Penalties reaching ₹200 and even ₹250 crore, adjudicated by a dedicated Data Protection Board, are a clear signal from the legislature that Data Protection now sits alongside financial and tax compliance as a core governance risk, not a peripheral legal formality.

The Takeaway: What started as a constitutional question in 2017 is now a live, evolving compliance regime being built in real time with a rulebook, a regulator, and a deadline. That's precisely why this area warrants specialist attention: the law on paper and the law in practice are moving targets right now, and getting it wrong carries real financial and reputational cost. But compliance shouldn't be read only as a defensive exercise. At its core, DPDPA compliance builds transparency with the people whose data an organisation holds, earns the trust that keeps them coming back, and lays the groundwork for the kind of long-term sustainability that outlasts any one product cycle or funding round. Businesses that treat DPDPA as a governance priority now — and not a deadline to scramble toward in 2027 — are the ones building enterprises meant to last.