India has enacted its long-awaited Digital Personal Data Protection Act, a sweeping law that establishes rights for individuals and obligations for companies handling personal data. Key provisions include explicit consent requirements, the right to withdraw consent, and penalties for data breaches.

The legislation is considered a milestone in India’s efforts to modernize its digital economy and align with global standards. It also introduces the Data Protection Board, tasked with enforcing compliance and investigating violations.

However, critics argue that certain exemptions for government agencies could weaken the law’s effectiveness. The balance between enabling innovation and ensuring privacy will be closely monitored as the act is implemented.