Your data, your rules: Understanding India’s DPDP Act, 2025

Think of every time you typed your phone number on a website, allowed an app to track your location or clicked “I Agree” without reading anything. Now imagine all that information travelling across servers, companies, governments and algorithms, often without you knowing how it’s being used.India finally decided to put brakes on this free-flowing, unregulated exchange of personal data. That is where the Digital Personal Data Protection (DPDP) Act, 2025 steps in, a law designed for a country where digital life is now everyday life.This is not just a law for techies, bureaucrats or UPSC aspirants. It affects everyone who uses a smartphone, which means almost every Indian.Why India needed this law Too many data leaks, too little accountabilityOver the years, countless leaks exposed personal details — phone numbers, Aadhaar data, financial information — floating across the internet. People lost money to scams; others had their identities misused. But companies rarely faced serious consequences. Apps were taking ‘permission’ without askingYou downloaded a photo-editing app and suddenly it had access to your contacts, microphone and location. The old system allowed companies to hide behind long, unreadable consent forms. Government programmes became data-heavySchemes like direct benefit transfer, digital land records and public health databases collect massive sensitive data. Without a proper law, there were no clear rules on how this would be stored, shared or protected. India needed a global-standard privacy lawCountries around the world, especially those in Europe, already have strong data protection systems. A strong Indian framework boosts global trust in Indian companies and digital governance.Salient features: What the DPDP Act actually does“Say yes only if you really want to” — Stronger consentEvery app, website or organisation must clearly tell you:what data they wantwhy they want ithow long they will store ithow you can withdraw consentNo vague language, no sneaky permissionsExample: If a delivery app wants access to your gallery, you can simply refuse and it cannot deny service for that. You own your data — not the appThe law grants strong user rights:Right to access your dataRight to correct wrong informationRight to get your data deletedRight to stop data processingRight to nominate someone to exercise these rights if you cannotExample: If a fintech app still holds your old address or Aadhaar number, you can demand correction or complete deletion. Special care for children’s dataFor anyone under 18:Parental consent is mandatoryApps cannot target ads at themApps cannot track or profile themExample: A gaming app cannot silently track a 12-year-old’s location or behaviour. Data fiduciaries must act responsiblyAny organisation collecting your data must follow strict rules:robust security systemsminimal data collectiondeletion once purpose is overbreach notification within strict timelinesBig platforms handling millions of users become Significant Data Fiduciaries, facing even higher scrutiny. Massive penalties for violationsFines can go up to hundreds of crores if a platform misuses or leaks data. No gentle warnings — real money on the line.Example: If a popular social media platform leaks user data due to lazy security, they face steep monetary penalties. A new enforcer: The data protection boardThis independent body handles:user complaintsbreach investigationspenalties and complianceThink of it as the traffic police of the digital world. Timeline: How we got here2017: Supreme Court declares privacy a fundamental right.2018–2022: Multiple draft bills prepared and withdrawn.2023: DPDP Act is finally passed by Parliament.2025: Rules framed and operationalised, making the law implementable.By 2027: Full-scale enforcement expected across sectors.This journey took years of debate, court cases, and stakeholder consultations — reflecting how complex digital privacy is.DPDP vs RTI Act: A battle between privacy and transparency The conflict explained simplyRTI enables citizens to seek information from the government to ensure transparency.DPDP protects personal information from unnecessary exposure.The clash arises because:RTI gave access to personal information if public interest demanded it.DPDP tightens what counts as “personal information”The earlier public-interest test is now weaker What this means in real lifeA citizen earlier could ask:How many government employees were penalised in a corruption case?What were the assets declared by a public servant?Now, authorities may deny this citing “personal data”. The worryTransparency activists fear officials might hide information under the label of “privacy”, reducing public accountability. The government’s standThey argue that privacy is a fundamental right and misuse of personal information must stop — even when requested under RTI.The truth lies somewhere in between: India must protect privacy without shutting the doors of transparency.Why this law matters to every IndianYou get more control over what apps know about youYou can demand deletion of data that companies keep foreverChildren get a safer digital environmentCompanies finally face real consequences for negligenceBut at the same time, citizens must stay alert so transparency under RTI doesn’t slowly erodeWhether you’re a student, worker, parent or business owner — this law touches your digital life daily.Privacy wins, but democracy must not loseThe DPDP Act is a landmark shift in India’s digital journey. It gives ordinary citizens power over their personal data, something long overdue in a country where digital activity grows every day.But it also raises a difficult question: Can we protect individual privacy without dimming the light that RTI shines on public accountability?This balance will define the future of India’s digital democracy. The DPDP Act is a strong start, but how wisely we implement it will decide whether India becomes both a private and transparent nation in the years ahead.

Your data, your rules: Understanding India’s DPDP Act, 2025

Why India’s new privacy law matters and how it reshapes transparency, governance and everyday digital life

Ivninder Pal Singh

Tribune News Service

Your data, your rules: Understanding India’s DPDP Act, 2025

Why India’s new privacy law matters and how it reshapes transparency, governance and everyday digital life

Ivninder Pal Singh

Tribune News Service

Unlock Premium Insights in This Article