Special series
Six months into the Digital Personal Data Protection Act, India's first comprehensive data protection regime is being tested by regulators, businesses, and the courts. Our coverage follows the cases, the consent architecture, and the compliance debates that will define the framework.
4 reports in the series
Indian apps and websites are rewriting onboarding to fit DPDP's notice-and-consent architecture. The result is a fresh round of UX experiments — and a quieter debate about whether the user is actually reading.
By Editorial Desk2 min read
The Board is finding its voice slowly. Three preliminary rulings, a flurry of complaints, and a quiet conversation about what 'significant data fiduciary' will actually mean in practice.
By Editorial Desk2 min read
The Act swapped the white-list model for a negative list — countries are presumptively permissible unless the Central Government says otherwise. Here is what the framework actually requires.
By Editorial Desk2 min read
The Act treats anyone under eighteen as a child, prohibits behavioural tracking outright, and requires verifiable parental consent for processing. How any of this will actually work in practice remains an open question.
By Editorial Desk2 min read