What Exactly Did You Agree To?

Imagine you download a new app on a slow Tuesday evening. It wants your contacts, your location, your photos, maybe your microphone. There is a wall of text you will never read, a small box that says I agree to the Terms, and a part of you that just wants the thing to work. You tick it. You move on.

We have all done this ten thousand times. And for most of those times, in India, that tick meant almost nothing. There was no real law standing behind it. If your number leaked, if your data was quietly sold, if a stranger called you by your full name and knew your last three purchases, you shrugged. What were you going to do about it.

That is the part that has changed. And the change is more specific than most people realise.

The law that finally showed up

India passed the Digital Personal Data Protection Act in 2023. For two years it sat there, printed and waiting, because a law without its rules is like a car without keys. In November 2025 the government turned the key. The DPDP Rules, 2025 were notified, and the whole thing came alive.

The vocabulary is worth thirty seconds of your time. You are the data principal. The company holding your data is the data fiduciary. That second word is borrowed from the world of money, where a fiduciary is someone who manages what belongs to you, for your benefit, and answers for it. The law is saying that your data is not the company's property. It is yours, held in trust, on loan.

The clock is running

The rules did not switch everything on at once. The Data Protection Board of India, the body that will hear complaints and hand out penalties, came into being the day the rules were notified. A new kind of licensed company called a Consent Manager is meant to start operating roughly a year later. And the heavier duties on businesses come into full force about eighteen months in, which puts the real deadline in the first half of 2027.

So this is not a someday law. If you run a business that touches customer data, the window to get your house in order is open right now and closing steadily.

What a business actually has to get right

This is the part I find most people, including some very senior people, are vague about. Let me make it concrete. If your company collects personal data, here is what you are now expected to be mindful of.

• Consent has to be real. Free, specific, informed, and given by a clear action. A pre-ticked box does not count. Bundling consent for a loan with consent for marketing does not count. And it must be as easy to withdraw as it was to give.

• The notice has to be readable. Before or while you collect data, you must tell the person what you are collecting, why, how they can withdraw, how they can complain to you, and how they can reach the Board. In plain language. Page nine of a privacy policy is not a notice.

• Use it only for what you said. Data collected to deliver a parcel cannot quietly become a marketing list. When the purpose is over, or consent is withdrawn, the data should go, unless another law requires you to keep it.

• Children are a hard line. For anyone under eighteen you need verifiable parental consent, and you cannot track them, profile them, or aim advertising at them. Many apps built for a general audience have never thought about this.

• A breach is not a secret. If data leaks, you must tell the affected people without delay and file a detailed report with the Board, with the serious cases going up within 72 hours. Sitting on bad news is now itself a violation.

• Someone must own it. Every business needs a named contact for data questions and a working grievance process. Larger players, the ones the government designates as Significant Data Fiduciaries, must appoint a Data Protection Officer based in India, run impact assessments, and get audited every year.

• The penalties are serious. Up to ₹250 crore for a single serious failure. That is a number large enough to make a boardroom go quiet.

None of this is uniquely Indian. Europe did a version of it in 2018 with the GDPR, and the fines there have run into the billions of euros. India watched that film first, then wrote its own script, lighter in some places and sharper in others.

And what you, the ordinary user, can now do

The law hands you a small toolkit. You can ask a company what data it holds about you and what it has done with it. You can ask for it to be corrected or erased. You can withdraw consent. You can complain to the company first and, if that goes nowhere, to the Board, which is designed to work online so you do not need a lawyer to file. You can even nominate someone to exercise these rights for you if you are unable to.

The Consent Manager idea is the one I would watch. Think of a single dashboard where you can see everyone holding your data and switch any of them off, the way you manage app permissions on your phone, except across your whole digital life.

One caution, because the law is even-handed about it. You also have duties. You cannot file false or frivolous complaints, and you are expected to give accurate information when it matters. The Board can fine an individual for misusing the process. This is a shield, not a weapon.

Now add the machine

Here is where it gets properly hard, and where most of my curiosity sits.

Your data is no longer just sitting in a database. It is feeding models. It helps decide whether your loan is approved, whether your resume is read, whether your insurance premium goes up. More and more, the answer to an important question in your life comes from software, not a person.

So the obvious question was whether India needs a separate law for artificial intelligence. Europe wrote one, the EU AI Act. India, so far, has said no. In late 2025 the technology ministry released a set of AI Governance Guidelines built on seven plain principles, which it calls sutras: put people first, be fair, be accountable, be understandable, be safe, and do not smother new ideas while you are at it. Instead of one giant AI law, the plan is to stretch the laws we already have, the DPDP Act, the older IT Act, consumer protection rules, and the sector regulators like the RBI and SEBI, to cover what AI does.

What does that mean in practice if you are building or buying AI? Three things I would be mindful of.

First, personal data used to train or run a model is still personal data. The consent and purpose rules do not switch off because the data went into a model. Second, if a system makes a decision that affects someone, be ready to explain it in words a human can follow, and keep a human who can step in and overrule it. Third, if you are a large player, your impact assessment is expected to look squarely at algorithmic bias and automated decision-making, not just at where the servers are.

A note to the legal fraternity

For my friends in practice, the interesting work here is not the drafting of yet another privacy policy. It is the evidence. Consent will need to be provable: when it was given, for what, in what words, and whether it was withdrawn. Notices will need to be shown, not just claimed. Breach timelines will need records. Contracts with vendors and processors will need to say who does what when something goes wrong. A lot of early disputes will be won or lost on whether anyone kept a clean trail.

I think about this constantly while building LawVyn.ai, because the moment a law firm moves its client files, case notes and personal details into any software, data protection stops being a compliance chore and becomes the entire basis of trust.

The habit behind the law

A law can force a company to send you a notice. It cannot force it to respect you. The 72 hour rule, the consent manager, the seven sutras, these are scaffolding. What has to grow inside the scaffolding is a habit, the habit of treating a stranger's data the way you would want yours treated.

I have seen versions of this pattern with every new regulation. There is a loud season of confusion, a rush of consultants, a lot of theatre. Then, slowly, the careful companies get quietly better, and the careless ones get caught.

The fine print finally has teeth. Whether they bite depends on all of us, the people building the software and the people ticking I agree without reading.

I am building LawVyn.ai, practice management software for Indian advocates and law firms. More of my writing lives at ravidaparthi.com, and I am on LinkedIn if you want to collaborate or discuss on anything. Follow our LinkedIn page for interesting insights like these.