Tech Original explainer
Every tap you make is collected, sorted and sold. India's new privacy law finally gives you rights over it.
Your phone knows where you slept, what you searched for at 2 a.m., and which shops you walked past. Your apps know it too — and so do the companies behind them. Every tap, every location ping, every voice search becomes a small piece of data, and those pieces are collected, sorted, and sold. We tapped Accept to get past a screen. That bargain — your data in exchange for free services — is what data privacy is about. And in India, the rules of that bargain have just been rewritten.
Data privacy is the idea that information about you belongs to you, and that nobody should collect it, use it, or sell it without your clear permission. Your name, phone number, face, location, health records and browsing history are all personal data. On their own, each piece looks harmless. Put together, they can reveal your religion, your income, your illnesses, and your daily routine. That is why data is valuable: advertisers will pay to reach exactly the right person, and scammers will pay for lists of people to target.
For years, India had no single law covering personal data. That changed with the Digital Personal Data Protection Act, 2023 — the DPDP Act. Parliament passed it in August 2023: the Lok Sabha on 7 August, the Rajya Sabha on 9 August, and the President gave assent on 11 August. It is India's first comprehensive data protection law. Under it, you are called a data principal — the person the data is about. Any company or organisation that handles your data is called a data fiduciary, and it has duties: to ask for your consent, to tell you what it is collecting and why, to keep the data safe, and to delete it when it is no longer needed.
The law also gives you rights. You can ask a company what data it holds about you, correct mistakes, and withdraw your consent. If a company breaks the rules, a new regulator — the Data Protection Board of India — can fine it up to 250 crore rupees. The detailed rules for how all this works were notified in November 2025, and most of the duties on companies begin to apply from May 2027, giving businesses time to rebuild their systems. Until then, the law is on the books, but its teeth are still coming in.
The business model is simple. A free app is rarely free. If you are not paying, the money comes from advertising, and advertising pays more when it can target precisely. A company that knows you are a 28-year-old in Pune who searched for running shoes can charge a shoe brand far more than a company that only knows someone, somewhere, is online. Location data is especially valuable: it can show where you live, where you work, and which shops you visit. Health and financial data are worth even more, which is why breaches involving hospitals and banks are so serious.
There is also a darker market. Leaked databases of phone numbers and passwords are traded in bulk and used for fraud. A scammer who knows your name, your bank, and your recent purchase can sound convincing on a call. That is why a data breach is not just an embarrassment for a company. It can become a phishing call to your parents, a loan taken in your name, or money drained from your account. Privacy and security are the same problem, seen from two sides.
The DPDP Act rests on a simple principle: your data is yours. The law draws on the Supreme Court's 2017 Puttaswamy judgment, which recognised privacy as a fundamental right under the Constitution. In practice, this means companies must ask for your consent before processing your data, and the consent must be free, specific and informed — not buried in a fifty-page document nobody reads. You can also nominate someone to exercise your rights if you cannot. And children get extra protection: companies need a parent's consent to process a child's data, and they cannot track children or show them targeted ads.
There are limits. The law does not cover data you make public yourself, and the government has wide exemptions for national security and public order. Critics have pointed out that the law gives the government broad powers while placing the burden of complaining on individuals. Those debates are still playing out in the courts and in Parliament. But the direction is clear: the era of collecting first and asking later is ending.
Laws are slow. Your habits are immediate. Here are five that make a real difference. First, check app permissions: a torch app does not need your contacts, and a photo editor does not need your location. Second, turn off location access for apps that do not need it, and set the rest to allow only while using the app. Third, use a different password for every important account, and switch on two-factor authentication wherever it is offered. Fourth, say no to unnecessary data sharing — if a website asks to track you across other sites, refuse. Fifth, check what you have already given away: your phone settings show which apps can see your location, microphone and contacts, and you can take the permissions back in a few minutes.
None of this makes you invisible. Total privacy online is not realistic, and anyone promising it is selling something. But the goal is not invisibility. It is control: knowing what you are giving away, to whom, and being able to say no. India now has a law that backs that idea. Using it — reading the permission screens, withdrawing consent, complaining when a company oversteps — is how a right written on paper becomes a right in real life.
This explainer was written by The Daily Short's desk from the sources listed above. It is general information, not professional advice. Spot an error? See our Corrections Policy or tell us via the Contact page and we will correct it. Follow our official Instagram @thedaily.short.