Bill to take charge of India's digital destiny

India's draft DPDP rules are a declaration of intent—that power must rest with its people, not corporations. Some practical and structural challenges need to be ironed out, though

- Charles Assisi

Imagine this. You wake up, pour yourself a coffee, and scroll through your phone. All seems well. But what if every app and website you've ever used—Instagram, Amazon, or even that odd e-store—was quietly rifling through your personal data without asking you? India's proposed Digital Personal Data Protection (DPDP) Rules, 2025 aim to ensure this nightmare doesn't become your daily reality.

Under these rules, companies (referred to as data fiduciaries) must explain, in plain language, how they're using your data. They must also make it just as easy for you to withdraw consent as it was to give it. Add to that mandatory encryption, breach notifications, and even a Consent Manager platform where you can control all your permissions in one place. These rules, drafted under the 2023 Data Protection Act, are an attempt to return power to the individual—data principals, as the law calls us.

But conversations with people involved in drafting these rules reveal some thorny issues. While the intent is noble, some practical and structural challenges need ironing out.

Flexibility for fiduciaries: The draft rules treat all companies—startups, multinationals, and Big Tech—as though they're equally capable of complying. They're not.

To place that in perspective, small companies, for instance, can easily assign data responsibility to someone like a chief security officer (CSO). Their chains of command are short and direct. But for larger entities and Big Tech such as Google, Apple, Meta and X? At these sprawling behemoths, a CSO might report to a chief technology officer (CTO), who then reports to a vice president, who may answer to someone even higher.