Your WhatsApp chats, Instagram photos, payment history, even that embarrassing thing you searched at 2am? The government just decided who gets to control all of it. Spoiler: it's you.
India finally notified the rules for its Digital Personal Data Protection law on [date]. The law itself passed back in August 2023, but now we know how it'll actually work. And honestly? Some of it is pretty wild.
The big stuff that changes
Facebook, Instagram, and every other social media platform now need verifiable parental consent before letting anyone under 18 sign up. Not just a checkbox saying "yes I'm definitely over 18 trust me." Actual verification.
Companies have to prove the person giving consent is genuinely the parent and not some kid who borrowed their mom's phone. How exactly they'll do this without making the process nightmarish remains unclear, but that's their problem to solve.
Any company holding your data can now be fined up to Rs 250 crore for serious failures. That's not pocket change, even for Big Tech.
Here's where it gets interesting. You now have the right to access, correct, update, or completely erase your personal data. Companies have 90 days maximum to respond when you ask. You can even nominate someone else to exercise these rights on your behalf. Useful if you're incapacitated, or just deeply lazy about managing your digital footprint.
The catch everyone's worried about
The government can restrict transfer of certain data outside India. No specifics yet on which data or why, just that a committee will decide.
For tech giants like Meta, Google, and Amazon who shuttle data between countries constantly? This could get messy. The rules mention something called "Significant Data Fiduciaries" (companies with tons of users) needing to ensure specified personal data and its "traffic data" stays within India. What counts as specified data? Which companies qualify as significant? Nobody knows yet. That ambiguity is either sensible flexibility or concerning vagueness, depending on who you ask.
How breaches work now
If a company suffers a data breach, they must inform you and the new Data Protection Board promptly. The notification needs to be in "plain language" explaining what happened, what it means for you, what they're doing about it, and who to contact for help.
No more corporate jargon hiding the fact that your email and password just leaked to half the internet. Companies get 18 months to comply. The government recognizes this requires massive backend changes, so there's transition time built in.
During this period, expect a lot of frantic updating of terms and conditions, new verification systems, and probably some companies deciding the Indian market isn't worth the compliance headache.
The Data Protection Board
A new Data Protection Board will launch as a fully digital institution. You'll be able to file and track complaints online through a dedicated platform and mobile app. Whether this board will have teeth or become another bureaucratic entity drowning in backlogs is the big unknown. But at least filing complaints won't require physical paperwork, which is something.
The clock starts now. Companies have 18 months. Users have new rights. The government has new powers. Whether this actually protects your data or just creates compliance theatre remains to be seen.
