Let me ask you something. When was the last time you actually read the privacy policy of an app before clicking “I agree”? Never, right? You are not alone. And that, honestly, is one of the biggest reasons data privacy in India still feels like a joke to most people — even though we now have a proper law for it.
India finally passed a dedicated data protection law in 2023. But having a law and actually living in a privacy-protected world are two very different things. Let me break this down for you in plain simple language.
Does India Have a Data Privacy Law?
Yes, it does. India’s main data privacy law is the Digital Personal Data Protection (DPDP) Act, 2023. It was passed in August 2023 and is India’s first comprehensive law focused specifically on protecting personal data in digital form.
Before this, India was running on the Information Technology Act, 2000 and the IT Rules, 2011. Those were old rules that mentioned “reasonable security practices” but were never a full-blown modern privacy law. Think of it like trying to use a Nokia 3310 in the era of smartphones.
What Exactly is the DPDP Act?
The DPDP Act sets rules for how companies can collect, use, store, and delete your personal data. The entire framework is built around four pillars: consent, lawful use, accountability, and user rights.
Here is what the law actually says you are entitled to:
- Companies must collect your data only for a specific lawful purpose and with your consent
- Your data cannot be used for purposes other than what was stated
- You have the right to access, correct, and erase your personal data
- You can withdraw your consent at any time
- A Data Protection Board of India will handle grievances and complaints
- Companies can face heavy penalties for violations
On paper, this is a solid law. EY India described it well: “India’s DPDP Act and Rules mark a shift from compliance to individual rights, making data privacy a strategic driver for digital trust.”
Why Data Privacy in India Cannot Work Without Cybersecurity
Here is something most people miss. Data privacy and cybersecurity are not separate things. They are two sides of the same coin.
If a company says your data is private but their systems get hacked because they never patched a vulnerability, your privacy is gone. Simple as that. The DPDP Act has actually pushed companies to think more seriously about breach notification, access controls, secure storage, and incident response.
Privacy compliance today demands real technical controls, not just a PDF privacy policy on the website. If you want to understand how cyber incidents are handled, check out our guide on how to respond to a cybersecurity incident.
Are Indian Companies Actually Following Data Privacy Law?
This is where it gets uncomfortable. The honest answer is: not really, not yet.
An EY analysis found that nearly 81% of organizations had not updated or drafted DPDP-aligned privacy policies, and more than 83% had not even begun comprehensive implementation of the Act’s requirements.
Let that sink in. Over 80% of companies are not compliant with a law that was passed in 2023. The law is ahead of reality.
Why is Corporate Compliance So Weak?
There are a few real reasons for this gap in data privacy in India:
- Many companies run on legacy IT systems that were never designed with privacy in mind
- True compliance needs coordination across legal, IT, cybersecurity, HR, and product teams all at once
- Smaller companies and less regulated sectors have barely even started thinking about this
Which Companies Are Better Prepared?
There is no official government list of “DPDP compliant companies” yet. But based on how things look, some sectors are clearly more serious about it than others:
- Large IT firms like TCS, Infosys, and Wipro – because they already meet global privacy standards for their international clients
- Banks, fintechs, and NBFCs – because RBI and other regulators already demand strong data governance from them
- Big e-commerce and telecom companies – because they handle massive customer data volumes and face public scrutiny
Everyone else? Still figuring it out.
Do Indian Consumers Even Know Their Data Privacy Rights?
This is probably the most shocking part of the data privacy in India story. A PwC India survey found that only 16% of Indian consumers actually understand the DPDP Act.
16 percent. In a country of 1.4 billion people.
Sivarama Krishnan, Leader of Cybersecurity and Privacy at PwC India, put it plainly: there is a significant gap in the understanding of basic privacy rights among both consumers and businesses, and there is a strong trust deficit in how organizations handle data.
The survey also found that many users are not even sure what they would do after a data breach. Most people care about privacy in theory but do not actually act on it. This is not just a legal problem or a corporate problem. It is a public awareness problem.
Real Example: What Happens When Data Privacy in India Fails
Let me give you a real-world scenario to make this concrete.
Imagine you download a food delivery app. You enter your name, phone number, home address, and payment details. The app collects all this data. Under the DPDP Act, you have the right to know exactly what data is stored, ask for corrections, or request deletion.
But here is the reality for most people:
- You have no idea a data privacy law even exists
- The company’s privacy policy is 4,000 words of legal text you will never read
- There is no simple button to delete your account and data
- If there is a breach, the company may not notify you immediately
- You would not know where to complain even if you wanted to
This is why data privacy in India feels like a joke in everyday life, even when the law says otherwise. To understand what scammers can do with your leaked data, read our blog on digital arrest scams in India, it is a perfect example of how stolen personal data becomes a weapon.
How Can a Normal Indian Citizen Actually Use the DPDP Act?
Good news: you do not need to be a lawyer or a tech expert to exercise your rights. Here is what you can actually do right now.
Your Rights Under the DPDP Act
- Ask any company: “What personal data do you hold about me and why?”
- Request correction of any wrong information they have stored
- Ask for deletion of data that is no longer needed
- Withdraw your consent from marketing messages or any data processing you did not explicitly agree to
- Use the company’s grievance officer contact to raise a formal complaint
Simple Steps to Protect Yourself Today
- Read the privacy policy – even skimming the key sections helps you understand what you are agreeing to
- Check for consent and privacy settings – most apps now have a privacy dashboard somewhere in settings
- Email the grievance contact – every company is required to have one; ask them what data they hold about you
- Screenshot everything – if you make a data request, keep a record of when you sent it and what response you got
- Escalate if ignored – the Data Protection Board of India is where you can file a formal complaint when companies do not respond
Also, protecting yourself from cyber attacks goes hand in hand with protecting your privacy. Our guide on how to protect yourself from cyber attacks in 10 easy steps is a great starting point.
The Bigger Picture: Data Privacy in India is Not a Joke on Paper
Let me be fair here. The law is real. The DPDP Act is a proper, modern privacy framework. The Supreme Court of India itself said in the Pegasus Order: “Members of a civilized democratic society have a reasonable expectation of privacy. Every citizen of India ought to be protected against violations of privacy.”
The Government of India has also officially stated that data privacy is a foundational pillar of responsible digital governance that builds public trust in digital services.
So the law is there. The intent is there. What is missing is the execution on three fronts: companies need to actually comply, regulators need to actually enforce, and citizens need to actually know their rights.
The PwC India 2024 survey conclusion said it best: “The journey towards becoming a privacy-conscious society is still in its early stages and requires accelerated efforts.”
Final Thoughts
Data privacy in India is not a joke in law anymore. But for millions of people, it still feels like one in practice. A law that nobody knows about, that most companies are not following, and that has no strong enforcement yet, is basically a law that does not exist for ordinary people.
The good news is things are slowly moving in the right direction. The bad news is “slowly” is not fast enough in a world where data breaches happen every day and scammers are already using your leaked personal information against you.
Know your rights. Ask questions. Do not just click “I agree” on everything. Your data is yours. It is time to act like it.
Also read: What is the Digital Personal Data Protection Act 2023 — Don’t Miss This | Understanding Data Protection Laws in India
