Between Text And Technology: Unpacking The Hidden Barriers To DPDP Compliance
Gurveer Singh Dhindsa, LL.B. (Hons.), O.P. Jindal Global University, Jindal Global Law School (2023-2026)
ABSTRACT
The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) together form India’s first comprehensive, cross-sectoral data protection framework, enacted in fulfilment of the constitutional guarantee of privacy recognised in Justice K.S. Puttaswamy (Retd.) v Union of India. While the framework promises clarity and informational self-determination, a close reading of its text reveals structural ambiguities that threaten its fidelity in practice. This paper examines five interlocking gaps: first, the confinement of “Data Principal” status to natural persons, leaving corporate and institutional personal data inadequately addressed; second, the disproportionate compliance burden that “verifiable parental consent” under Section 9 imposes on start-ups, absent graded obligations or regulatory sandboxes; third, the breadth of the State-exemption power under Section 17, tested against the necessity-and-proportionality standard in Puttaswamy; fourth, the risk that “certain legitimate uses” under Section 7 dilute the Act’s affirmative-consent architecture into one of implied consent; and fifth, the contraction of Data Principal rights - notably data portability and the right to be forgotten - relative to the recommendations of the Justice B.N. Srikrishna Committee (2018) and the Joint Parliamentary Committee (2021). The paper further considers the absence of a “sensitive personal data” category and the resulting friction with sectoral regulators such as the Reserve Bank of India, SEBI, and IRDAI, with reference to health and financial data. Drawing on the statutory text, pending litigation, parliamentary history, and scholarly commentary, the paper concludes that the DPDP regime requires interpretive discipline, judicial clarification, and targeted reform to fulfil the rights-protective promise of the Constitution and the Act’s preamble.
