Overview
- Telecom operators via COAI formally flagged practical hurdles, citing verifiable parental consent for under‑18s, multilingual consent logistics, duplicative breach‑reporting, and the need to align DPDP with sector laws.
- The notified regime sets staged obligations, including consent tooling and governance within 12–18 months and 72‑hour breach notifications, prompting companies to prioritize data mapping and consent engineering.
- Critics say the government retains broad data‑access powers under a small, government‑appointed board, and warn RTI safeguards are weakened by changes that could curb public‑interest disclosures.
- Media bodies caution that classifying newsrooms as significant data fiduciaries, coupled with heavy fines, risks turning routine reporting into consent‑dependent processing and chilling investigative journalism.
- Legal experts note the law was not designed to protect personality rights or tackle deepfakes directly, so victims will largely rely on constitutional, tort, and IP remedies rather than DPDP provisions.