Safer Internet Day: India’s Data Protection Law Journey (2000–2027)

The most common mistake in coverage of the DPDP Act is to treat the date it was passed, or the date its Rules were published, as the date it started protecting people. In fact the commencement notification of 13 November 2025 split the Act into three groups. The first group, in force now, mostly builds the machinery: definitions, the Data Protection Board, the penalty schedule and the government’s rule-making powers. It also brought one controversial change into force at once: the amendment to the Right to Information Act that widens the exemption for personal information.

The provisions that change what an app or a bank must do with your data, and what you can demand of it, are in the third group. Until 13 May 2027, the older IT Act regime continues to apply.

The cyber-law era (2000–2011). The Information Technology Act of 2000 was written for e-commerce and cybercrime. Personal data entered the law only with the 2008 amendments, which took effect in October 2009: Section 43A made companies pay compensation if they negligently failed to protect “sensitive personal data”, and Section 72A punished disclosure of personal information in breach of a contract. The 2011 SPDI Rules defined that sensitive data and required privacy policies and consent. The regime was narrow: it covered only body corporates, only sensitive data, and offered compensation through a slow adjudication process.

The rights era (2012–2018). The push for a real law came from Aadhaar. In 2012 retired judge K.S. Puttaswamy challenged the biometric ID scheme, the same year the A.P. Shah expert group proposed national privacy principles. When the government argued that Indians had no fundamental right to privacy, the question went to a nine-judge bench. On 24 August 2017 it ruled unanimously that they do, and that informational privacy is part of that right. Weeks earlier, on 31 July 2017, the government had set up the Srikrishna Committee, whose 2018 report and draft bill shaped everything that followed.

The legislative era (2019–2027). The 2019 bill gave the government wide exemptions, which Justice Srikrishna himself criticised, and was withdrawn in 2022 after a two-year committee process. Its 2023 successor passed within a week. It is simpler and more business-friendly, with no sensitive-data category and no default localisation, but it keeps broad state exemptions and creates a Board rather than an independent regulator.

India’s data protection story runs from a cyber law written before smartphones, through a constitutional judgment and two abandoned bills, to a law that is still switching on. Safer Internet Day is a reminder that legal duties and personal habits are different tools: the law tells organisations what they owe you, and awareness helps you notice when they fall short.

The real measure of the DPDP Act will not be the number of pages in it, but whether, after May 2027, an ordinary user can find out what an app knows about them, get it deleted, and have a complaint heard by a Board that actually sits.