India proposes new data protection bill requiring companies to garner consent from citizens before collecting and processing users' personal data
Context & Ripple Effects
This December 2019 proposal was the opening move in what became a six-year legislative saga for India. The draft required companies to obtain citizens' consent before collecting or processing personal data, but it drew fire from both privacy advocates and tech giants, and the government ultimately withdrew the Personal Data Protection Bill in August 2022 to start over on a new framework.
The replacement moved faster: parliament passed the Digital Personal Data Protection Bill in 2023 with fines up to $30M and child wellbeing rules, and by November 2025 India had officially notified its first data protection law, including verifiable consent — the core idea this 2019 draft introduced.
First-order effects
- Companies operating in India — from global platforms to local startups — would need to build consent flows before collecting or processing any citizen's personal data, making consent capture a gating step for their Indian products rather than an afterthought.
Second-order effects
- The backlash from privacy advocates and tech giants against this draft forced a rewrite: the withdrawn bill was succeeded by a 2022 draft that relaxed cross-border data transfer restrictions for certain countries, trading the original's tighter localization posture for one easier on multinational data operations.
Third-order effects
- If the arc holds, India converges on the same structure other major markets have adopted — a national consent-based processing regime with meaningful penalties — meaning any company handling Indian users' data must treat consent architecture as baseline infrastructure, not a jurisdiction-specific patch.
The trend: India spent six years iterating from this 2019 consent-first draft through withdrawal and redrafting to its first notified data protection law, folding the world's largest untapped user base into the global consent-regulation bloc.