Data protection and a regulatory crossroads

It is not clear whether the proposed Data Protection Board is a repudiation of India's recent regulatory experience or an improvement on the present arrangement

The Digital Personal Data Protection (DPDP) Act, 2023, came into effect two weeks ago. This is an Act “to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes”. This latest development in the Indian regulatory apparatus needs to be located in the Indian experience and regulatory theory.

In the field of data protection, there are two sources of threat to the individual: The state and the corporations. In India, there are no protections vis-a-vis the state,