The Digital Personal Data Protection (DPDP) Act needs to be broadened to address the challenges of a data-driven economy and the growing influence of artificial intelligence (AI), industry leaders and legal experts said at the Financial Express Digital Bharat Economy Conclave on Thursday.
Supreme Court advocate Pavan Duggal observed that eight years after the landmark Puttaswamy judgment recognising privacy as a fundamental right, a comprehensive framework for data protection was not completely in place. “Under the DPDP Act, violations carry a minimum fine of ₹50 crore and a maximum of ₹250 crore. The complexity lies in enforcement. When the adjudicating board declares a violation, the minimum fine is usually levied. The fine goes directly to the Consolidated Fund of India, and the government even has the right to sell assets to recover it.”
Call for stronger regulatory framework on AI
Duggal also said a major gap exists in that the Act does not address the legal status of AI. “Should we work around a strong regulatory framework around AI? Other countries, like Japan and El Salvador, are already working on regulations,” he said.
The DPDP rules are expected to be notified by September 28. These regulations aim to provide clarity on consent, data storage, and user rights, completing the operational framework of the DPDP Act that was approved earlier.
“LLM models don’t ask for data to be shared with them, they say we are only using what is already there, what we have published online, but that’s how we are cutting our own hands”, Duggal said. The advocate highlighted how users add their own data to the platforms often not realising the repercussions.
Several panelists underscored the rising economic value of data. Rajneesh Garg, CIO & SVP at AllCargo ECU Worldwide, said data is akin to currency because of its insights and monetisation potential. “Earlier oil powered industries; today it’s data. The challenge is how to use it to generate value while ensuring privacy and trust,” he said.
Experts flag risk from data explosion
The convergence of a data explosion and AI development creates new risks. Archie Jackson, VP-Global Head IT & CISO at Incedo, warned that AI systems trained on open data can create bias, and stressed that individuals often lack mechanisms to revoke personal data once shared. Rajiv Nandwani, Global Information Security Director at BCG, added “If everything is free, you are the product. Your data is being used in AI modelling.”
Anand Aggarwal, Group CTO of The Times Group, said that while data has made life more convenient—citing initiatives like DigiYatra—citizens must become aware of privacy risks. “Privacy by design is critical. Why do I need this data and for what purpose?” he asked.
On the policy front, Arvind Gupta, Head and Co-founder of the Digital India Foundation, said India’s regulatory delays often reflect global considerations. “Even the U.S.–China trade deal was influenced by TikTok. Policy is a negotiation tool with global ramifications,” he said. Meanwhile, Srinath Chakravarthy, Senior VP at the National Institute for Smart Government, highlighted usability gaps in government digital services.
“Privacy design is an important tenet for all systems. The thrust of this is data nomalisation and data minimalisation. Too often, government agencies collect more information than needed,” he noted.
Consensus around DPDP Act as a positive first step was built driving trust in a data-driven economy which will require stronger enforcement, clearer AI regulations, and greater citizen awareness.
