With the notification of the Digital Personal Data Protection (DPDP) Act, 2023, and its subsequent Rules in late 2025, India has finally entered its era of statutory data regulation. However, as the dust settles on the legislative process, a concerning trend has emerged in the public discourse. Most analyses you will find today are written through the narrow lens of corporate compliance answering questions on implementation costs and penalties for breaches. While these are valid questions for the private sector, they often ignore the more profound, structural shifts this law imposes on our democracy. It is in this context that the Internet Freedom Foundation has shared this brief. Its lengthy- but its useful to understand the issues at stake.
