India’s digital economy has made personal data unavoidable. The harder task is ensuring that citizens retain meaningful control over the trails they leave behind. In August this year, the Unified Payments Interface processed about 24.5 billion transactions worth nearly Rs. 29.8 lakh crore, according to data from the National Payments Corporation of India. Aadhaar’s authentication system recorded more than 17,759 crore transactions in FY2025-26, according to UIDAI’s dashboard. Behind these numbers sits a question Indian policy has yet to answer clearly: what happens to the data these systems generate, and who controls it? The most pressing privacy question in India today is not what people choose to post online. It is what they are required to leave behind to take part in everyday life. A UPI payment leaves a transaction trail. A loan application generates financial records. A food-delivery order records your address and buying habits. A cab ride shows where you work and when you travel. A social-media post adds something more personal: what you think, like, fear or believe. Individually, these fragments look harmless. Together, they can describe a remarkably detailed version of a person’s life. Orwellian Society This is not digital technology invading a society that was once offline. It is a society in which digital systems have become part of ordinary economic life. For a software professional, deleting social media may be an inconvenience. For a domestic worker paid through a bank account, a student applying for a scholarship or a pensioner completing an identity check, opting out is not a workable choice. Consider an ordinary Saturday. You check the weather, search for a medicine, order groceries, pay through UPI, book a cab and make an online purchase. No single action tells a complete story. Together, they reveal your location, spending patterns, household composition, health concerns and daily routine. Artificial intelligence changes what this data means, because machine systems are increasingly good at connecting fragments that once sat in separate databases. The concern is not that an AI system knows what you searched for once. It is that automated systems can identify patterns across millions of ordinary interactions that, taken individually, meant little. The problem is also one of asymmetry. The individual usually sees only the service being offered; the organisation sees the accumulated information behind it. A single transaction may be trivial, but millions of such transactions can become commercially or administratively valuable when linked and analysed. That makes data different from many other commodities. Once information has been copied, combined or used to build a profile, the original individual may have little visibility into its subsequent journey. The question is therefore not simply who collected the data, but who can combine it, infer from it and act upon those inferences. The public debate on AI scraping is often too simple. Not every online interaction is pulled into an AI model, and not every company holds every piece of a person’s digital life. Collection depends on the platform, its policies, its technical architecture and the applicable law. But the gap is real: the capacity to analyse vast volumes of information is growing faster than most people’s understanding of where their information goes. A PwC India survey found that 56 percent of consumers did not know their rights over personal data, while 70 percent said privacy policies were difficult to understand. When a person does not understand what they are agreeing to, consent risks becoming a formality rather than a genuine choice. There is also a distinction between privacy and secrecy. A person may have nothing embarrassing to hide and still reasonably object to a detailed record of their movements, purchases and associations being assembled without meaningful control. Privacy is less about having something to conceal than about retaining a degree of agency over one’s own life. A Right on Paper The Digital Personal Data Protection Act, 2023 gives individuals rights to correct and erase personal data, subject to the conditions and exceptions set out in the law. The government notified the Digital Personal Data Protection Rules in November 2025, with provisions coming into force in phases. On paper, this changes the relationship between citizens and the organisations that hold their data. In practice, most people do not think in terms of “Data Principal” or “Data Fiduciary” when an app asks for access to their information. They think about whether the app will still work if they say no. That is the test that decides whether a data-protection law functions on the ground. A small retailer selling online may not fully understand the compliance requirements. An elderly customer faces a long privacy notice before completing a routine transaction. A young user accepts an app’s terms because refusing means losing access to a service that friends or employers already use. A right that exists on paper does not guarantee a person’s ability to exercise it. The ability to protect personal data is not distributed evenly. A high-income professional can pay for privacy-focused software, encrypted communication and legal advice. Someone on a smaller income uses whichever free application is available. The same divide applies to time. A person who understands technology can adjust permissions and request deletion. A person working two jobs may accept an app’s terms because reading a 30-page privacy notice at 11 p.m. is hardly realistic. This produces an uneven outcome. The people with the strongest ability to protect their data are often the same people with the clearest sense of what is being collected. Those with fewer resources tend to generate more data while having less power to question how it is used. This is why treating “going offline” as the solution has limited use in India. Cash does not cover every digital transaction. A basic phone does not replace every digital service. Deleting a social-media account does not erase bank or government records. Refusing every digital platform carries its own economic cost, particularly for people who depend on digital payments for income. The realistic goal is not disappearance. It is control. India’s digital economy should not be measured only by payment volumes or platform reach. It should also be measured by whether people understand the exchange taking place underneath that convenience. Regulators should track whether a person can find out what a service holds about them, correct inaccurate information, delete data that is no longer necessary and withdraw consent without clicking through several layers of settings. The sharper test is what happens when data collected for one purpose becomes useful for another. Rising Stakes The stakes will rise as India’s digital infrastructure becomes more deeply embedded in public services, finance and commerce. The country has built impressive systems for moving money and verifying identity; the next challenge is to build equally credible systems for limiting what can be inferred from the information those systems generate. The next phase of India’s privacy debate should move past the idea of digital disappearance, because most people have no practical way to leave the systems through which they earn, pay, borrow, travel, study and access public services. The more useful task is making those systems answerable to the people whose lives they record. The measure of digital freedom is not whether a citizen leaves no trace. It is whether they have a say over where that trace leads. (The writer is an independent public policy researcher. Views personal.)
Comments