From spam calls to smart devices, how new data law will protect your privacy

New Delhi,UPDATED: Oct 31, 2025 11:42 IST

Practically, every time you buy something at a store, you are asked to give your phone number. Cookies track your data on every webpage you visit. And any service you use, you have to give your details. This allows the store to send you updates about new products. Websites also tailor ads and content to your preferences.

Often, the data is sold off to various companies for profiling or consumer research. And no matter how many spam blockers you have on your phone, you keep getting sales and ad calls. However, India's new data protection law is expected to stop all this once it comes into force.

The Digital Personal Data Protection Act, 2023, is yet to be implemented. Draft rules for its implementation have been in the public domain since January this year. In fact, IT Minister Ashwini Vaishnaw even announced that the rules would be notified by the end of September. It is yet to happen.

WHAT ARE THESE LAWS?

In 2011, India passed the Sensitive Personal Data or Information (SDPI) Rules under the Information Technology Act. These rules covered sensitive data such as passwords, financial information (bank accounts, credit/debit card details), medical records, biometric data, and sexual orientation, among other categories.

Basically, these rules meant that any company, corporation or society could not obtain any sensitive data of any person without their specific consent. They had to inform the consumer why the information was needed and how it would be used. Even then, they could also use it only for a specified timeline.

For example, an e-commerce company should not retain payment details after a transaction is complete.

However, it was found that because these rules did not have effective implementation, and consumers were not given any information about data leaks, the data was being illegally exploited.

It means that the spam calls you get after you purchase something are a violation of your privacy and data protection rights.

BETTER MONITORING AND MORE TEETH

The new data protection law is expected to have better monitoring and more teeth over all forms of access to data — your contact details, your privacy settings for access to any online content, online browsing history, purchase history and any other data that you may share online or at a physical store.

Google and Alexa devices are always listening in smart homes — and the data they capture also falls under the scope of the law.

The new rules make it mandatory for companies to report any data breach. Consumers can also file complaints for data breaches, which come with costly penalties for the company/store or government agency from which the data has been leaked.

It identifies data fiduciaries — all companies, websites, and entities, both private and government — that collect or have access to your data.

They will now have to get your specific consent to use that data, whether you consent to be contacted for future sales, or for use of your data to curate online ads or use it for consumer studies or even any type of research.

Now, "consent managers" have to be created — where you, as the consumer, can see just what your data can be used for — and you can choose if you want to share it.

Safeguards are also expected to protect children from exposure to unsuitable material online, which has also raised questions of just how the rules will track who is using a phone or laptop.

For example, if you sign in as an adult and give access permissions to Google for various websites, then how would anyone track it if your minor child is using your device to access "adult content" or making purchases behind your back?

The rules are yet to be finalised, but a lot of questions and concerns have been raised. The public consultations done since the draft rules came out in January have addressed several aspects from the point of view of consumers, industry, news media and government.

In a world where people are constantly online, data privacy is something that affects us all, and everyone is watching to see what shape the final rules will take.

- Ends