Kriti Trehan is the founder of Data & Co, a boutique tech law and public policy consultancy. In this interview, she discusses the rapidly changing regulatory environment in India's digital sector, the implementation of the Digital Personal Data Protection Act and the challenges facing the booming online gaming industry.
ALB: With the Digital Personal Data Protection Act now in place, what key regulations should businesses anticipate in the coming year as India's privacy landscape evolves? How can companies best prepare for these changes?
Trehan: The journey towards a dedicated privacy law in India has been long but promising. Over the six years from 2017 to 2023, we witnessed pivotal moments such as the landmark Puttaswamy judgment, Justice Srikrishna’s whitepaper and draft bill, parliamentary debates, and discussions by the Joint Parliamentary Committee, all of which led to the much-anticipated Digital Personal Data Protection Act, 2023.
The Act lays down key principles for privacy and data protection, focusing on the obligations of data fiduciaries (akin to controllers in other jurisdictions), accountability mechanisms, cross-border data transfers, data subject rights, and potential overlaps with sector-specific regulations. However, the ecosystem now awaits detailed guidelines on compliance, procedural requirements, and enforcement mechanisms.
The forthcoming rules under the 2023 Act will establish the operational framework needed to implement its core principles. These rules will provide the much-needed clarity and predictability for building compliant privacy programs. Eagerly anticipated by businesses, civil society, and consumer groups alike, they will be the most critical regulations in India’s privacy landscape in the near term.
Now is an ideal time for businesses to reassess their privacy programs through the law’s principle-centric lens. With the Ministry of Electronics and Information Technology expected to roll out a consultation process on the rules, businesses should actively participate, voice their questions, and be ready to thereafter shift their focus to concrete compliance measures once the final regulations are in place.
ALB: We've seen increased regulatory action in India, particularly in sectors like online gaming. How are market players adapting to this regulatory environment?
Trehan: Recent industry estimates indicate that India’s gaming sector is valued at over $3 billion. India is the world’s second-largest gaming market, with nearly 450 million gamers. While this immense market potential has fueled rapid growth, it has also raised concerns about consumer protection, financial risks, and the online safety of minors, placing gaming high on the regulatory agenda.
To support this growth, the Ministry of Information and Broadcasting recently introduced the AVGC-XR policy (2024-29), aimed at enhancing competitiveness, fostering innovation, and creating a supportive policy ecosystem. Additionally, online gaming was brought under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in 2023. This self-regulatory approach has empowered the industry to establish responsible practices through industry associations.
“The overlap of central and state laws, and the conflation of gaming with gambling, has led to inconsistent regulatory approaches across the country. Despite judicial precedent on the distinction between games of skill and games of chance, there is no statutory definition that formalises this distinction in law.”
However, the sector still faces significant challenges due to regulatory ambiguities.
The overlap of central and state laws, and the conflation of gaming with gambling, has led to inconsistent regulatory approaches across the country. Despite judicial precedent on the distinction between games of skill and games of chance, there is no statutory definition that formalises this distinction in law. Ensuring a safe gaming environment for minors is still a work in progress and remains a priority for both businesses and regulators.
For the gaming industry to thrive, it is crucial that all stakeholders—industry players and regulators—continue to collaborate, ensuring that innovation, entertainment, and responsible practices go hand in hand as the sector evolves.
ALB: As technology regulations continue to evolve in India, what do you see as the most pressing needs for the tech industry? Are there specific areas where you believe policy frameworks need to be developed or refined?
Trehan: India's digital economy is projected to reach $5 trillion by the end of this decade. With over 940 million internet subscribers, India accounts for roughly 10 percent of the world's internet users. The country consumes a staggering 8 to 10 petabytes (8,000 to 10,000 terabytes) of data daily. These impressive statistics underscore India's growing digital presence.
To realise India's vision of becoming a global tech hub, it is crucial to balance three key interests: innovation, consumer welfare, and national growth. This involves creating policies that foster cutting-edge technological development, ensuring that consumers have access to safe and seamless tech solutions, and promoting consumer education and effective dispute-resolution mechanisms. Additionally, it emphasises the need to drive economic growth while building India's soft power as a leading tech creator and exporter.
By adopting light-touch, principle-based, and collaborative approaches that promote innovation while protecting consumer interests, India can create a dynamic and positive policy environment that supports its ambitions as a global technology leader.
