From Luxembourg to New Delhi

India has no express right to be forgotten — only the erasure right in Section 12 and the retention-and-deletion regime in Rule 8. The Delhi and Bombay High Courts have meanwhile been improvising an ad hoc RTBF jurisprudence (see Jorawer Singh Mundy and Zulfiqar Ahman Khan), tethered loosely to Puttaswamy. The lesson of Costeja is that erasure is where the abstract right to privacy meets the concrete architecture of the internet — and that the balance against the freedom of expression under Article 19(1)(a) of the Constitution cannot be struck by formula. The Board will be asked to draw this line long before Parliament clarifies it. It should build a principled, published test now, rather than deciding each plea on its facts and calling it a day.

India’s Section 16 inverts Europe’s logic — transfers are free unless the Central Government blacklists a country. That places the transfer question largely outside the Board’s hands. But the real Schrems lesson is not about transfers at all; it is about institutional spine. A data protection authority earns its legitimacy on the day it rules against the very executive that appoints and funds it. The composition, tenure protection, and removal safeguards around the Board (Sections 18–20 read with the Rules) will be tested not by the easy cases against private fiduciaries, but by the hard one against the State. Independence is not a founding document; it is a habit proven under pressure.

The single most consequential ruling the Board will ever make is also its most abstract: what is “personal data” under Section 2(t), and who is a “Data Principal” under Section 2(j)? Adopt too broad a test and every hashed identifier, every device token, every anonymised research set is dragged into the regime. Adopt too narrow a test and re-identification attacks gut the law from beneath. The scholarship here is decades deep — from Schwartz and Solove’s work on the instability of “personally identifiable information” to the CJEU’s own relative approach. The Board should reach for the relative, risk-based standard of Breyer and SRB rather than a brittle binary. Get this wrong and every later order rests on sand.

Section 6 sets India’s consent bar high on paper — free, specific, informed, unconditional, unambiguous, with a clear affirmative action, and as easy to withdraw as to give — and Rule 3 layers on itemised notice. The Board will very soon face India’s own Planet49: dark patterns, consent-walls, and the peculiarly Indian problem of genuine, informed consent across languages, literacies, and interfaces. Planet49 and its successors (through Meta v Bundeskartellamt) teach that the medium of consent is where rights are won or lost. The Consent Manager ecosystem (Rule 4) is India’s bold structural bet on solving consent fatigue; the Board must ensure it becomes an instrument of choice, not a new and more elaborate box already ticked.

The DPDPA’s architecture rests on a single load-bearing figure — the Data Fiduciary (Section 2(i)) — and a supporting Data Processor. But the real digital economy is a lattice of SDKs, analytics pixels, ad-tech intermediaries, and platform plug-ins in which everyone points at everyone else. Fashion ID is the Board’s field guide to that lattice: liability tracks control, not the fine print of a data-processing agreement, and two or more parties can be fiduciaries together. When the first “it was the vendor’s fault” defence lands on the Board’s desk, this is the case that answers it.

India has no sensitive-data category and no legitimate-interest clause, so parts of this judgment do not map. But its deepest lesson is institutional and it maps perfectly: data protection does not live on an island. The same conduct can simultaneously engage the CCI (competition), the RBI, SEBI and IRDAI (financial data), TRAI (telecom), and MeitY (intermediary rules). The Board must decide early how it will coordinate — comity, deference, joint action — rather than colliding with sister regulators in a turf war that only the regulated will enjoy. And on the substance of Section 7’s “legitimate uses,” Meta’s strict reading of “necessity” is a useful discipline against elastic self-service justifications.

Here the comparison turns sharp and uncomfortable. The DPDPA gives the injured individual no right to compensation at all. The Board imposes penalties (up to ₹250 crore under Section 33 and its Schedule) that flow to the Consolidated Fund — not a rupee to the data principal whose dignity was breached. This is a design choice of real philosophical weight: India has built a regime of deterrence without restoration. The Board cannot rewrite the statute, but it should be clear-eyed that European data subjects can be made whole while Indian ones, for now, can only be avenged. Where the maxim runs ubi jus, ibi remedium — where there is a right, there must be a remedy — the Board’s penalty orders are, for the citizen, the only remedy on offer. It should wield that power as though it were.

This is where India’s design diverges most starkly — and where the Board’s hands are most tied. Section 17(2) hands the Central Government sweeping power to exempt State instrumentalities from the Act, and the Board has no jurisdiction to test those exemptions. The CJEU polices the State; the DPBI, by statutory design, largely cannot. But the reasoning of La Quadrature already lives in Indian law — it is the proportionality standard of Puttaswamy itself. The Board cannot strike down a State exemption, but in every matter that does fall within its remit it can insist that necessity and proportionality are demonstrated, not asserted — and it can, in its reports and advice to Government, be the institutional conscience that names the gap the courts may one day have to fill.

Section 3(b) gives the DPDPA long arms: it reaches processing outside India that is connected with offering goods or services to data principals within India. That is the ambition. Google v CNIL is the reality check: a regulator’s reach and its grasp are different things, and enforcement against a foreign fiduciary with no Indian assets is a problem of comity, cooperation, and practical leverage, not merely of drafting. The Board should invest early in mutual-assistance relationships and in remedies (against Indian-facing app stores, payment rails, and intermediaries) that actually bite — rather than issuing brave orders into the void.

And here is the gap that should keep the incoming Members awake. The DPDPA, drafted in the age of generative AI, contains no equivalent of Article 22 — no right against solely-automated decisions, no right to an explanation, no meaningful check on algorithmic profiling. In a country racing to deploy AI in credit, welfare, hiring, and policing, that is a chasm, and the Board cannot legislate one shut. What it can do is read the transparency and fairness obligations it does possess as generously as the text permits, and use its statutory advisory voice to press for reform. As I have argued at book length elsewhere, the laws we write for machines are, in the end, laws we write for ourselves; a data protection regime silent on the algorithm is a regime already a generation behind its subject.