The Hindu: Editorial: Monday, 17 November 2025.
Over eight years have
passed since the Supreme Court of India held privacy to be a fundamental right.
In the interceding years, three separate drafts for a data protection law have
been floated, with little visibility into how the final contours of the Act
took shape. The 2023 law achieved simplification of the 2018 draft, with some
important protections for user data baked into law. But this was at the cost of
giving a wide berth for government organisations to handle the data of Indians,
putting in place an anaemic Data Protection Board of India (DPBI), and cruelly
amending the Right to Information (RTI) Act, 2005, setting back major advances
in transparency achieved over the last two decades. The Digital Personal Data
Protection Rules, 2025, notified on November 14, 2025, do little to repair the
glaring gaps and damage from the parent Act. In fact, they delay the
implementation of practically all key protections to 2027, while implementing
the dilution of the RTI Act immediately; public information officers are now
authorised to decline any personal information except what is already required
to be published by other laws an all-too-thin slice of the pie for citizens
seeking accountability. This is after the government dragged out a three-month
consultation period for draft rules which were already delayed, and launched
the final form in the heat of the day the Bihar Assembly election results were
announced.
The delays to reach this point were unfortunate, in January, when the draft Rules were put out, and are inexcusable now. Little has been changed in the Rules’ final form, and the 12-18 months of a compliance timeline, even for giants of the technology industry that have known about this framework well in advance, does not stand the test of good faith. The lack of independence of the institutional framework underpinning these equivocations is particularly worrying: as an example of why, the DPBI will operate under the Ministry of Electronics and Information Technology. A result of this is that the same government organisation courting big-ticket investments into India from the world’s main data guzzlers, firms such as Google, Amazon and Meta, will supervise the body investigating their future mishandling of the data of Indians. Firms handling the data of Indians have few reasons to be upset with Friday’s Rules, as they will have over a year to fully implement the document’s limited aspirations. But for the citizen seeking the aim in the Act and Rules’ title privacy and accountability from public and private actors with whom sharing data has become an implicit and unavoidable condition of modern digital existence they will now find that their status quo largely continues: of being open books to the state and Big Tech, on the reflective side of a mirror that hides what is behind it.
The delays to reach this point were unfortunate, in January, when the draft Rules were put out, and are inexcusable now. Little has been changed in the Rules’ final form, and the 12-18 months of a compliance timeline, even for giants of the technology industry that have known about this framework well in advance, does not stand the test of good faith. The lack of independence of the institutional framework underpinning these equivocations is particularly worrying: as an example of why, the DPBI will operate under the Ministry of Electronics and Information Technology. A result of this is that the same government organisation courting big-ticket investments into India from the world’s main data guzzlers, firms such as Google, Amazon and Meta, will supervise the body investigating their future mishandling of the data of Indians. Firms handling the data of Indians have few reasons to be upset with Friday’s Rules, as they will have over a year to fully implement the document’s limited aspirations. But for the citizen seeking the aim in the Act and Rules’ title privacy and accountability from public and private actors with whom sharing data has become an implicit and unavoidable condition of modern digital existence they will now find that their status quo largely continues: of being open books to the state and Big Tech, on the reflective side of a mirror that hides what is behind it.
.JPG)
.JPG)
