DPDP Act will be outdated before it's passed

The Act targets entities which are complex adaptive platforms that have embedded AI in their processes. To expect them to adhere to static regulations is a mistake

- K YATISH RAJAWAT

THE DRAFT DIGITAL Personal Data Protection (DPDP) Rules of 2025 mark a milestone in India's journey towards establishing a robust data privacy and protection framework. However, the draft fails to understand the environment or stakeholders that it is targeting. Hence, it would fail in its fundamental objective of protecting citizens and digital entities or their privacy. The entities that the DPDP Act targets are complex adaptive platforms that have embedded artificial intelligence (AI) in almost all their processes. To expect these entities to adhere to static regulations or bureaucratic standards of regulatory bodies is a mistake.

This is not the first time policymakers have made this mistake; a similar snafu occurred in the case of guidelines for dark patterns. The Centre for Innovation in Public Policy (CIPP) had warned that the guidelines would fail the day they are announced as they do not account for the ability of digital platforms to bypass them. The same regulatory approach has been followed in the DPDP Act, which presumes that the policy will be monitored by a structure of regulators, fines, and penalties when we have seen that this system does not work. The violations are rapid and adaptable, and difficult to detect and report except for breaches, as the onus of reporting primarily lies with the platform itself.