India: Privacy Protection

The Digital Personal Data Protection Act, 2023 (hereinafter referred to as ‘the DPDP Act’ or ‘the Act’) represents a landmark legislative development in India’s data governance landscape, being the country’s first comprehensive statute dedicated exclusively to the protection of digital personal data. Passed by Parliament in August 2023 and notified in November 2024, the Act is accompanied by the Digital Personal Data Protection Rules, 2025 (‘the DPDP Rules’), which prescribe a phased 18-month compliance timeline for data fiduciaries.

WhatsApp’s anticipated transition from phone-number-based identification to usernames and unique IDs marks one of the most significant structural changes in the platform’s history. While the move is being celebrated as a privacy win for users, it raises a host of complex legal questions spanning data protection, identity verification, cybercrime, and consumer rights.

NCLAT recently delivered its judgment in WhatsApp v. Competition Commission of India, in an appeal that arose from the CCI's order, holding that WhatsApp's 2021 Privacy Policy Update, amounted to an abuse of dominant position under Section 4 of the Competition Act, 2002.