New Delhi, Sept. 23 -- As regular readers of Ex Machina know, I have been waiting more than a decade for India to pass a comprehensive data protection law. Despite recent statements by the government suggesting that rules under the 2023 Digital Personal Data Protection law are imminent, I have heard these promises so many times over the years that I have resigned myself to only believing it when I see it.

Meanwhile, technology has evolved at a blistering pace. When I first started working on a data protection law, I thought a notice and consent regime would be enough. I was convinced that so long as we offered individuals a meaningful way to exercise control over what was done with their data, they would have all the protection they need...