India’s GDPR-Like Data Protection Bill and Its Loopholes

India’s Digital Personal Data Protection Bill, 2023, was introduced in Parliament as a framework for protecting personal data, but it is not simply an Indian version of the European Union’s GDPR. Critics have identified significant qualifications and government powers that could weaken protections; the bill became the Digital Personal Data Protection Act, 2023, after Parliament passed it and the President assented, so it is no longer merely a draft.

From draft bill to enacted law

The bill followed years of debate over privacy, state access to information and the responsibilities of online services. A Supreme Court judgment in 2017 recognised privacy as a fundamental right, prompting sustained calls for a comprehensive data-protection law. Earlier legislative proposals and a government expert committee helped shape the discussion, but the 2023 bill took a different, shorter approach from earlier drafts.

Parliament passed the Digital Personal Data Protection Bill in August 2023, and it received presidential assent on 11 August 2023. The resulting Act establishes a legal framework for digital personal data in India and certain processing outside India connected with offering goods or services to people in India. It is important to distinguish enactment from implementation: provisions and obligations may depend on commencement notifications and rules. Readers checking present-day compliance should consult current government notifications and rules rather than assume every provision took effect at once.

The Act is not a direct copy of the GDPR. The GDPR is an extensive EU regulation with its own institutional structure, rights, lawful bases and territorial rules. India’s law uses different definitions and mechanisms, including a Data Protection Board of India, and leaves important operational details to government rules and notifications.

How the Indian framework works

The Act concerns digital personal data: information about an identifiable individual that is processed digitally, including data collected digitally or converted into digital form. It applies to processing in India and, in specified circumstances, processing outside India connected with offering goods or services to individuals in India. It does not generally regulate personal data processed wholly offline unless it is later digitised, and it excludes certain personal or domestic uses.

It calls the individual the “Data Principal” and the organisation deciding why and how data is processed the “Data Fiduciary.” A Data Fiduciary may use a Data Processor, but remains responsible under the Act for processing carried out on its behalf. The Act places duties on fiduciaries, including requirements concerning notice, consent where applicable, security safeguards, breach notification and handling requests from individuals.

Consent is central, but it is not the only permitted basis. The Act also allows processing for specified “certain legitimate uses,” such as some purposes connected with the individual’s voluntary provision of data or compliance with legal obligations. The exact basis matters: a company cannot treat all collection as consent-based merely because a person uses its service.

Individuals receive rights that include asking for information about processing, seeking correction or erasure in specified circumstances, using a grievance process and nominating another person to exercise rights in case of death or incapacity. These rights are not unlimited. For instance, erasure is subject to legal retention requirements, and a request must be handled through the Act’s procedures.

Why critics call parts of it loopholes

“Loophole” is a political and analytical label, not a legal finding. The main criticism is that the Act’s broad exemptions and delegated powers may leave important safeguards dependent on government decisions, while limiting how effectively individuals can challenge certain processing.

• Government exemptions: The Act permits the central government to exempt government instrumentalities from some or all provisions for specified purposes, including national security, public order and prevention of offences, subject to the statutory wording. Critics argue the breadth of these grounds and the scope of exemptions could reduce accountability for state data use.
• Rights and remedies: The framework gives people rights, but critics say it offers a narrower set of protections and remedies than the GDPR. It does not reproduce every GDPR right, and the practical value of rights depends on accessible grievance handling, enforcement and rules.
• Board structure: The Data Protection Board is the main enforcement body. The Act gives the central government a role in appointments and allows it to prescribe terms and conditions. Critics question whether this design provides sufficient institutional independence when the government itself may be a major data processor.
• Rules left to government: Several operational details are to be specified through rules or notifications. That flexibility can help implementation, but it also means the statute alone does not answer every question about procedures, timelines or safeguards.
• Cross-border data: The Act allows transfers of personal data outside India except to countries or territories restricted by the central government. Critics contrast this approach with systems that impose broader transfer conditions or require more detailed assessments.

These criticisms do not mean the Act contains no protections. It creates duties for data fiduciaries, provides for penalties for certain contraventions and establishes a statutory route for complaints. The debate concerns the strength, independence and reach of those protections, especially where government processing or exemptions are involved.

Comparison with the GDPR

Both laws seek to regulate personal-data processing and assign responsibilities to organisations. Both include transparency obligations, individual rights and enforcement mechanisms. The differences are consequential, however, and “GDPR-like” should not be read as “equivalent to the GDPR.”

The GDPR sets out a broader catalogue of rights and lawful bases, applies across the European Economic Area under its own territorial rules, and is enforced through independent supervisory authorities in EU member states. India’s Act has its own defined scope and exceptions, and relies on a central Data Protection Board. The laws also differ in their treatment of transfers, children’s data, penalties and institutional arrangements. A business operating in both places may need to comply with both regimes; satisfying one does not automatically satisfy the other.

What the law means for individuals and organisations

For individuals, the practical question is often how a particular service explains its data use and handles requests—not simply whether it displays a privacy notice. A customer who wants an account corrected, for example, should use the service’s stated grievance or rights-request channel and keep a record of the request. If the response is unsatisfactory, the Act provides for grievance escalation and a complaint process, subject to applicable rules.

For organisations, the law calls for more than adding a consent checkbox. Depending on the organisation and the provisions in force, useful preparation includes:

• Mapping what personal data is collected, why it is used, where it is stored and which processors receive it.
• Reviewing notices so they clearly explain the data and purposes involved, in accordance with applicable requirements.
• Setting up processes for consent where required, rights requests, complaints, retention and deletion.
• Using reasonable security safeguards and preparing procedures for reporting personal-data breaches as required.
• Checking whether a government notification, rule or designation creates additional obligations or exemptions for the organisation.

These are general governance steps, not a substitute for legal advice. Requirements can differ by role, processing purpose and the provisions currently in force.

Frequently Asked Questions

Is India’s data protection law still a draft bill?
No. Parliament passed the Digital Personal Data Protection Bill in 2023, and it received presidential assent on 11 August 2023, becoming the Digital Personal Data Protection Act, 2023. The commencement of particular provisions and related rules should be checked against current official notifications.

Does India’s Act give the government access to everyone’s data?
It does not create a blanket rule giving the government unrestricted access to all personal data. However, it permits specified exemptions for government instrumentalities and allows processing for defined purposes. The scope and oversight of these powers are among the law’s most debated features.

Is the Indian Act the same as the GDPR?
No. They share broad aims, but differ in scope, rights, lawful bases, regulators, exemptions and transfer rules. Organisations with relevant operations may need to assess both laws independently.

Can a person ask a company to delete personal data?
The Act provides a right to seek erasure in specified circumstances, but it is not absolute. A fiduciary may have to retain data where another law requires it, and the request must follow the applicable process.

Does the Act cover data stored outside India?
It can apply to processing outside India when connected with offering goods or services to individuals in India. The Act also sets a framework for overseas transfers, subject to restrictions the central government may specify.

What to watch next

The most useful way to assess the law is to separate the statute’s text from its implementation. Government rules, commencement notifications, appointments to the Data Protection Board and the handling of actual complaints will determine how several provisions work in practice. Those developments may clarify procedures, but they will not remove the underlying debate over exemptions, oversight and the balance between state interests and individual privacy.

For now, the accurate summary is that India has enacted a digital personal-data protection law with GDPR-like aims, but it is materially different from the GDPR and contains provisions critics consider broad or insufficiently independent. Whether those features become practical loopholes depends partly on how the law is brought into force, interpreted and enforced.

Related

• Best Facial Recognition Search Engines: What to Choose
• Dynamic Pricing in Fast Food: What Customers Should Know
• MongoDB for AI Agent Retrieval and Memory