Author: Ms. Chaitali Jani , Advocate based out of Mumbai, Maharastra
Introduction: The Constitutional Crossroads and the Digital Gold Rush
As I sit in Bar Room in the bustling Fort area of Mumbai, the sounds of the city a ceaseless symphony of commerce, construction, and conversation serve as a constant reminder of the transactional lifeblood of India. In the past decade, I have witnessed a fundamental shift in the nature of these transactions. The currency is no longer just the rupee; it is data. Every digital footfall, from a UPI payment for vada pav at a street stall to a multi-crore acquisition deal finalized over a cloud-based data room, generates a trail of personal information. This data is the new gold, and for the longest time, the vault doors were unregulated and wide open.
My practice, which spans commercial litigation, corporate advisory, and technology law, places me at the very intersection of this digital gold rush. I have drafted privacy policies for fintech startups that were more aspirational than compliant, and I have litigated on behalf of individuals whose most intimate data was weaponized against them. For years, our legal arguments were an exercise in intellectual acrobatics, trying to cobble together a coherent privacy jurisprudence from the medley of the Information Technology Act, 2000, and the sporadic, though profound, pronouncements of the Supreme Court. We were lawyers navigating a dense, uncharted forest with only a compass, waiting for the cartographers to draw a definitive map.
That map has finally been drafted. The journey from the right to privacy being a penumbral, unenumerated right to its crystallization as a fundamental right under Article 21, and its subsequent statutory embodiment in the Digital Personal Data Protection Act, 2023 (DPDP Act), is a constitutional and legislative saga of our times. This article is not merely an academic commentary on the Act. It is a practitioner’s analysis of a law that is poised to recalibrate the relationship between the citizen, the state, and the market. It is an exploration of the contemporary legal issues that will define the next decade of my practice and the digital lives of over a billion Indians. The central contemporary issue is no longer whether we need a data protection law, but whether the one we have created, with its unique compromises and constructs, can withstand the tectonic pressures of innovation, state power, and the timeless, universal human need for dignity and autonomy.
Part I: Fundamental Right to Privacy Justice Puttaswamy Judgement.
To understand the DPDP Act, one must first appreciate the jurisprudential battle that made it an imperative. Our starting point is not a legislative debate but a constitutional bench of the Supreme Court.
The infamous K.S. Puttaswamy v. Union of India (2017) judgment was not just a legal verdict; it was a societal compact recast. By unanimously holding that the right to privacy is a fundamental right intrinsic to life and personal liberty under Article 21, the nine-judge bench did more than just overrule the anachronistic M.P. Sharma and Kharak Singh decisions. It created a normative bedrock. Justice D.Y. Chandrachud’s (as he then was) concurring opinion is a masterclass in constitutional interpretation, weaving together the threads of dignity, autonomy, and informational self-determination. The core holding that privacy is not a singular, amorphous concept but a tripartite right encompassing bodily, spatial, and, crucially for our purposes, informational privacy became the North Star for all future legislation.
This judicial mandate placed the government under a constitutional duty to create a regime for data protection. The subsequent journey of the draft bills from the 2018 Personal Data Protection Bill based on the Justice B.N. Srikrishna Committee report, to the 2019 version, and its eventual withdrawal in 2022, culminating in the DPDP Act, 2023 reflects a profound shift in philosophy. The Srikrishna Committee’s report was a comprehensive, rights-forward document that drew heavily from the European Union’s General Data Protection Regulation (GDPR). It proposed a framework of data fiduciaries, data principals, and a strong, independent Data Protection Authority. It recognized a spectrum of personal and sensitive personal data, and crucially, it granted a wide array of rights to the individual.
The 2023 Act, however, is a different beast. It is leaner, more state-centric, and designed with a palpable emphasis on the “ease of doing business.” This shift from a rights-based GDPR model to a more compliance-focused, trust-based model is the defining characteristic of our new law. As a practitioner, this is not a matter of philosophical critique; it is the reality within which I must now operate, advise, and litigate. The contemporary legal challenge is translating the grand, sweeping declaration of the Puttaswamy judgment into the granular, pragmatic, and often-constrained language of the DPDP Act.
Part II: The Core Anatomy of the DPDP Act – A Practitioner’s Dissection
The DPDP Act is a deceptively simple piece of legislation. It is built around a few key legal constructs that will form the basis of all future advisory and litigation work.
The Data Fiduciary and the Principle of Consent: The Solemn Promise.
The Act places the entire edifice of lawful processing on the concept of consent. A Data Fiduciaryany person who determines the purpose and means of processing—is bound by the principle of “free, specific, informed, unconditional, and unambiguous” consent via a clear affirmative action. The Notice of Consent must be an artefact of absolute transparency, a standalone document in plain language, detailing the specific personal data to be collected and the specific purpose for which it will be processed.
The contemporary legal issue here is profound: consent fatigue and its meaninglessness in the digital age. In my practice, I see thousands of pages of privacy policies and terms of service drafted in legalese that no reasonable person reads or understands. The Act’s principle of “informed” consent is in direct tension with the commercial reality of manipulative design patterns, or “dark patterns,” that nudge, coax, and trick users into giving broad, all-encompassing consent. The Central Government is empowered to define these dark patterns, but the enforcement challenge is immense. A subsequent clause in the Act places a duty on the Data Principal to not file a false or frivolous complaint and to not suppress material information. This introduces a seemingly moralistic and adversarial element into the fiduciary-principal relationship, a departure from the protective ethos of the Srikrishna model. We are moving into an era where the validity of consent will be the prime battleground. Every check box, every pre-ticked form, every convoluted cookie banner will be a potential litigation point, and we, as lawyers, will have to deconstruct the moment of consent to ascertain if a “meeting of minds” truly occurred.
The Data Protection Board of India:
The New Regulator on the Block The Act establishes the Data Protection Board of India (DPB), a body corporate with the primary function of adjudicating non-compliance. Its powers are significant: it can direct urgent remedial measures, inquire into breaches, impose financial penalties, and even direct the blocking of a fiduciary’s platform by the
The contemporary legal issue here is the architecture of the regulator and the nature of its independence. Unlike the GDPR’s supervisory authorities, the DPB’s members will be appointed by the Central Government, with the chairperson’s qualifications not mandatorily being from the judiciary but rather someone of “ability, integrity and standing” with special knowledge of data governance, law, or technology. This has led to a robust debate on whether the DPB is a truly independent regulator or an extension of the executive. The Act provides for an appeal from the DPB to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), and from there to the Supreme Court. This circuitous appeal process could lead to delays and forum-shopping. My strategic advice to clients now includes a “litigation pathway analysis,” preparing for the eventuality of a matter starting at the DPB and traversing through TDSAT to the apex court, a journey that could span years.
Part III: The Core Contemporary Tensions – Where the Law Meets Reality
Beyond the statutory architecture, the DPDP Act’s interaction with existing legal and commercial realities creates the most fertile ground for legal challenges.
I. The Clash of DPDP Act and the Right to Information
This is a fascinating intersection that I have already begun to encounter. The Right to Information Act, 2005, is a powerful tool for transparency. Section 8(1)(j) of the RTI Act already exempts personal information that has no relationship to any public activity or interest, or which would cause an unwarranted invasion of the privacy of the individual. However, it allows disclosure if the Central/State Public Information Officer or the Appellate Authority is satisfied that the larger public interest justifies it.
The DPDP Act now creates a stricter, statutory regime of consent for the processing of personal data. A Public Information Officer (PIO) is now a Data Fiduciary. If a RTI application seeks third-party personal data, the PIO cannot simply make a subjective public-interest determination; they must now reconcile that with the provisions of the DPDP Act. Can a PIO disclose information about a government official’s disciplinary record? Under RTI, it might be in the public interest. Under the DPDP Act, it is the personal data of that official, and processing requires consent or a legitimate use. The “information” regime of the RTI Act is now colliding with the “data” regime of the DPDP Act. This is a legislative conflict that is ripe for judicial interpretation. My advice to corporate clients in their dealing with government bodies has already incorporated this ambiguity: we are entering an era where RTI responses will be re-litigated on the new anvil of data protection principles, specifically the concept of purpose limitation.
II. The Business Perspective: From Compliance Checklist to Cultural Shift
In the commercial hub of Mumbai, the conversation has rapidly shifted from “what is the DPDP Act?” to “how do we become compliant?” The challenge for my clients, from the legacy banking giants, Series-C funded startups, is monumental.
The Consent Architect’s Nightmare: Retrofitting consent mechanisms on legacy systems is a multi-crore technological It is not just a legal document change; it is a product architecture overhaul. I am advising clients to move beyond consent as a tick-box and towards embedding “privacy by design,” a principle that, while not explicitly named as such in the Act, is implicit in the detailed obligations of purpose limitation and data security.
The Cross-Border Data Conundrum: The Act adopts a blacklisting approach, allowing data transfer to any country except those specifically restricted by the Central Government. While this is a boon for business compared to the previous bill’s strict data localization mandate, it creates strategic A client’s entire multi-cloud infrastructure, hosted across servers in Singapore, Amsterdam, and Virginia, is currently compliant, but what happens if the geopolitical winds shift and a key jurisdiction is blacklisted? We are now drafting contracts with comprehensive “geo-portability” clauses, a contractual right to mandate a service provider to shift data storage locations in response to a change in Indian law.
Data Breach Litigation: A data breach is now a guaranteed litigation event. The Act mandates reporting to the Board and each affected Data Principal. This notification is not a shield but a trigger. I have already developed a “breach response playbook” for clients that integrates legal privilege into the forensic investigation process and prepares for the inevitable class-action suit or consumer complaint that will follow any notification. The penalty structure, which can run to hundreds of crores of rupees, is not just a regulatory cost; it is an existential business
Part IV: Conclusion –
As I conclude that the contemporary legal issues I have outlined the hollowing out of consent, the proportionality of state exemptions, the independence of the regulator, the clash with the RTI, and the practicalities of corporate compliance are not bugs in the system; they are the very features that will define my practice for decades. We, as a legal community, must resist the urge to treat the DPDP Act as a mere compliance checklist. It is a constitutional document in a practical garb.
We must litigate with the Constitution in one hand and the statute in the other. The digital future of a billion people is being written not in code alone, but in the arguments, we make in the tribunals and courtrooms of India. The vault door is finally being closed, and it is our collective responsibility to ensure it locks in a way that protects, rather than imprisons, the individual within. The age of data privacy in India has dawned not with the clarity of a command, but with the complexity of a question. It is our duty, and our privilege, to provide the answers.
