Neelam was standing at a bus stop at dusk, with a tired seven-year-old pulling at her sleeve and a taxi app refusing to load. The child wanted a game.
The taxi wanted her location. A box popped up on the screen, long and grey, full of tiny words, with a bright green button at the bottom that said “I agree”. She did what you would have done. She pressed the button. The taxi came. The game started. And a small piece of Neelam’s life, her number, her whereabouts, a list of her contacts, went somewhere she could not have named.
Nobody reads these pages, and almost everybody agrees to them. It is the oldest joke of the digital age, and like many jokes it hides a fact: consent given in a hurry is a strange kind of consent. For a long time Indian law had very little to say about it. That has begun to change. In 2017 the Supreme Court declared privacy a fundamental right. In August 2023 Parliament passed the Digital Personal Data Protection Act, and in November 2025 the rules that make it work were notified.
Read more: Do you know where all your Aadhaar photocopies are lying today?
What the new data law gives Neelam
Suppose Neelam had known what the new law says. A company must ask her permission before using her data, and the asking must be clear.
Boxes already ticked, or permissions bundled together so that she cannot say yes to one thing without saying yes to all, are not what the law intends. She may withdraw her permission whenever she likes.
She may ask what the company holds about her and why, ask for a copy, ask for mistakes to be fixed and ask for her details to be erased, and the company is expected to reply within ninety days.
If her data leaks, she must be told.
Her daughter gets even stricter care: a company needs the verifiable consent of a parent or guardian before using a child’s data, and under this law a child is anyone below eighteen.
Read more: How UPI changed the ledger that used to live in a shopkeeper’s head
Penalties large enough to reach the boardroom
The penalties are large enough to catch a boardroom’s attention: up to Rs 250 crore for failing to keep data safe, and up to Rs 200 crore for failing to report a leak or for breaking the rules on children’s data.
A new body, the Data Protection Board of India, hears complaints, and its decisions may be appealed to a tribunal.
Read more: Two girls, same marks, different maps: Why college access changes by state
Two words that change how the law sees your data
The most interesting thing in the law may be two small words.
It calls the person a “Data Principal”, the one to whom the data belongs. It calls the company a “Data Fiduciary”, an old word for someone who keeps something in trust for another.
A trustee does not own what he holds. He answers for it.
In choosing these words the law has chosen a way of seeing in which our information is not a prize a company wins when we tap “Allow”, but something it looks after for us and must give back.
Read more: Five years of NEP 2020: What has actually changed inside schools?
The questions that remain
Two questions remain, and thoughtful people stand on both sides.
One concerns the government itself. The law lets the government exempt its own agencies from some of its rules, for reasons such as national security and public order. Supporters say a state needs that room to protect its people. Critics say wide exemptions leave the biggest collector of data with the least accountability.
The other question concerns Neelam’s cousin in a village, who may never learn that she can ask a company to delete her details, and who would struggle with a notice written in heavy English.
The law expects plain language and, in many cases, an Indian language. Whether that happens will be seen only in practice, in thousands of ordinary notices that no newspaper will report.
Read more: PM POSHAN explained: How midday meals help keep children in school
How much of your life already sits in someone else’s database?
Think, for a moment, of how much of a life already sits in other people’s databases. A mobile number with a shop, medicines with a pharmacy, a loan with a lender, a face with a building’s security desk.
Most of it was given in a moment of need and then forgotten.
And much of it contains other people too, because a shared photograph or a contact list uploaded to a game carries the names of friends who never agreed to anything.
Our data is rarely only ours.
Read more: India’s 6% education spending target is 60 years old. Why is it still unmet?
The longest document nobody reads
On the bus that evening, Neelam’s daughter asked what the long page had said.
Neelam realised that she did not know, and that she had signed it anyway, for a game.
When did you last stop, even for a minute, before pressing “I agree”, and who exactly were you trusting?
Sources: Digital Personal Data Protection Act, 2023; Digital Personal Data Protection Rules, 2025 (notified 14 November 2025), Government of India; Justice K.S. Puttaswamy v. Union of India (2017), Supreme Court of India. Neelam is imagined; the facts are not.
—
Your India | Know it. Question it. Improve it.
By Santosh Nair
