Code of Conduct: Can India Encrypt Growth Without Compromising Privacy?

India's Digital Personal Data Protection Act 2023 and draft Rules 2025 have set the nation's debate going on how to safeguard personal data without hampering innovation and economic growth. While the nation is racing towards a trillion-dollar digital economy, stakeholders are seeking clarity, flexibility, and fairness in the emerging framework.

Key Highlights:

- DPDP Act focuses on consent-based processing but does not provide for legitimate interest, making AI training and innovation burdensome.

- Rule 12(4) localisation requirements are perceived as wasteful and expensive, particularly for Global Capability Centres (GCCs) and start-ups, with fears of India losing its investment appeal to foreign investors.
- Startups and MSMEs argue that the rules favor big data fiduciaries, imposing compliance burdens on them that could lead to user churn and reduced competitiveness.

Sectoral Issues:

- Children's data protection law provides few exemptions except for digital media that aids cognitive development, although it is educationally beneficial.

- Contextual advertising is still a grey area on which there is no guidance on its legalization under the new system.

Forward Outlook:

- Industry players advocate for broader exemptions, sharper definitions, and the acceptance of anonymization standards to enable responsible innovation.

- The government will make the rules more precise through consultations with stakeholders in a bid to balance user rights, business viability, and national security.

India's data protection journey stands at a fork in the road—whether it will become a model for digital democracy or a labyrinth of regulatory obstacles will hinge on how transparently and inclusively the next phase is executed.

 Sources: Deccan Chronicle, The Dialogue, Economic Times, Lawful Legal, CDPP India, Manupatra Academy