DPDP Act 2027: Data Protection Law, Privacy Rights, Consent and Breach Penalties

You buy a shirt at Pantaloons and the cashier asks for your phone number "to link with the bill." You give it without thinking twice. 

And just like that, your number now sits in the store's point-of-sale system, which likely feeds a CRM, connects to a big loyalty database, and feeds an even bigger marketing platform. Now multiply this with every pharmacy, food delivery app, Wi-Fi login etc. That is millions of collection points, every day. 

And for 25 years, no law has required companies to ask for this data clearly, or tell you how and where it will eventually be used. We recently covered how the spam pipeline works once your number is in the system. This is about what happens before that.

In 2025, Zomato became one of the first companies to reveal this ‘data sharing chain’ to customers. They started asking customers whether to share their number with restaurants for promotional updates or not; also clearly mentioning that "once shared, this info cannot be withdrawn."

So how did we get here? And how did an entire country's worth of phone numbers end up circulating with no one watching?

Until recently, the only law securing your data was Section 43A of the IT Act, 2000, along with a set of 2011 rules. Which only covered a narrow list of "sensitive" data, like passwords and health records. A bare phone number arguably fell outside its purview. 

There was no dedicated regulator, standard breach-notification duty, or a penalty large enough to change anyone's behaviour. So the companies have collected phone numbers freely with almost nothing stopping them.

The breach record shows this gap cost clearly. In 2024, researchers found a threat actor selling several terabytes of Star Health Insurance data on Telegram covering over 3 crore customers. The insurance regulator eventually fined the company ₹3.39 crore, which has been one of the only penalties any Indian company has faced for a breach at this scale. And this isn’t an isolated incident. BigBasket lost data on 20 million users in 2020. Domino's India had 18 crore order records exposed in 2021, phone numbers and GPS locations included. Boat Lifestyle had 7.5 million customer records leaked in 2024. BSNL had SIM and network data exposed the same year.

A PIL filed in 2021 to force an investigation into these breaches led to a court notice to CERT-In but no public penalty followed.

Indian authorities have tried to legislate this once before. A data protection bill was introduced in 2019, and withdrawn in 2022 after a Joint Parliamentary Committee spent two years on it.

What replaced it is the Digital Personal Data Protection (DPDP) Act, which received Presidential assent in August 2023. The detailed rules were notified only on 13 November 2025, more than two years later. The substantive obligations, the ones that change how companies behave, don't kick in until 13 May 2027. That's nearly four years between a law being passed and a company being penalised for breaking it.

Now let’s talk about What happens when the DPDP Act comes into full force

Under the Act, any company or app collecting your data becomes a Data Fiduciary. And you're the Data Principal. A Fiduciary now requires your free, specific, informed consent, tied to one stated purpose, before it can process your data. 

So, billing at the counter is one purpose. Marketing is another, different purpose. Going forward, a company cannot collect your phone number for one purpose and quietly use it for another. 

The Act also creates four rights that didn't meaningfully exist before.