Kokila Kumar & Anindita Deb
“DPDP Act vs. Competition Act: What’s the Real Buzz?”
In the digital economy, personal data is not just a privacy concern; it has become a source of market power for digital companies. Access to data can drive innovation, monetisation, and strengthen market dominance by enabling entities to adopt algorithmic pricing and engage in targeted advertising based on individual data. As some digital platforms expand into the market, data aggregation provides a significant advantage in gaining a competitive edge. However, India’s regulatory framework for managing the dynamic interplay between privacy and competition remains fragmented. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) introduces a consent-based framework for personal data processing, aimed at protecting individual autonomy over personal data. Conversely, the Competition Act, 2002 (“Competition Act”) seeks to prevent practices that harm competition, promote and sustain competitive markets, protect consumer interests, and ensure the freedom of trade for all market participants. This leaves these two statutes operating concurrently without procedural or institutional coordination, which will likely lead the judiciary to interpret them harmoniously to uphold the legislative intent of both laws.
Data as a Source of Market Power
The DPDP Act introduced a consent-based privacy framework that requires personal data to be processed only for a specified lawful purpose. Furthermore, consent given by the Data Principal (individual to whom the personal data relates) must be free, informed, specific, and limited to the purpose stated on the consent notice.
This privacy-first consent framework has implications for market competition. Under the Competition Act, data as a source of market power can be a relevant factor in determining dominance under Section 4 read with Section 19(4). The statutory framework allows the Competition Commission of India (“CCI”) to consider factors like market share, size, resources, as well as dependence of consumers and entry barriers, which may be shaped by exclusive access to personal and behavioural data. Further, in cases involving refusal to deal under Section 3(4)(d), a data-rich platform can leverage its dominance and access to personal data to deny market access to other players, thereby imposing exclusivity in the market.
The CCI has already examined data practices under the lens of market power in its Suo Motu cognisance of WhatsApp’s 2021 privacy policy [In Re: Updated Terms of Service and Privacy Policy for WhatsApp users, Suo Motu Case No. 01 of 2021] (“WhatsApp case”). This 2021 privacy policy mandated users to accept terms and conditions (on a “take it or leave it” basis), which included the sharing of personalised user data with Facebook (now Meta), marking a shift from WhatsApp’s earlier privacy policies, which provided users with the choice to opt out of personal data sharing. The absence of an opt-out mechanism and the unilateral imposition of terms and conditions that mandated data sharing were held to be abusive, and WhatsApp was penalised to the tune of INR 213.14 crore while also facing cease-and-desist directions. Notably, the order recognised privacy as a non-price competition parameter and held that excessive data collection could constitute anti-competitive conduct.
What’s Worrying the Industry and Stakeholders?
The regulation of digital markets currently falls within the scope of both the DPDP Act as well as the Competition Act, along with a few ancillary rules and regulations under the Information Technology Act, 2000 (as amended). The absence of a unified framework for regulating digital markets in India will potentially lead to fragmented regulatory oversight, which may give rise to the following overlapping concerns:
Jurisdictional turf war (Data Protection Board vs. CCI): The WhatsApp case is the first of many digital marketplace disputes that may arise from using data as a source of market power. While the CCI’s order in the WhatsApp case demonstrates that a privacy issue under the DPDP Act is also a precondition for the CCI to investigate fair market conditions, the absence of a harmonised adjudication framework raises concerns about duplicative enforcement, inconsistent findings, and regulatory unpredictability.
Notably, the Supreme Court has clarified that in cases of dispute between authorities, the sectoral regulator has initial authority related to sector-specific issues, and the CCI retains jurisdiction to investigate anti-competitive practices that go beyond the scope of the sectoral regulator [Competition Commission of India v. Bharti Airtel Ltd. AIR 2019 SC 113].
The Digital Competition Bill and subsequent withdrawal: The Digital Competition Bill (“DCB”) was introduced in 2024 with the aim of establishing an ex-ante regulatory framework for ‘Systematically Significant Digital Enterprises’ (“SSDEs”) offering ‘Core Digital Services’. The SSDEs could be determined based on a twin test, including both qualitative and quantitative factors such as financial and user thresholds. While the DCB was well-crafted in intent, it has since been withdrawn due to industry concerns over compliance complexity, disruption in business models and disincentivising innovation. It was also highlighted that the DCB’s lack of governance mechanisms would create a possible overlap with the mechanisms under the DPDP Act and lead to compliance uncertainty for businesses.
Regulation of AI-driven markets: Following the withdrawal of the DCB, the regulation of competition in AI-driven markets in India rests governed by the Competition Act and the DPDP Act, neither of which is specifically designed to address the risks posed by AI systems in today’s day and age. The DPDP Act governs how AI developers may collect and process personal data, which puts constraints on data inputs required to train and deploy AI models in business enterprises. On the other hand, the Competition Act examines how control over such data translates into market power through algorithmic bias and self-preferencing. Together, these statutes would govern AI-driven markets through separate privacy and antitrust lens.
Institutional capacity and technical expertise: The Ministry of Corporate Affairs (“MCA”), in the 25th Report of the Standing Committee on Finance (“Report”), has acknowledged that the CCI’s Digital Markets Division needs to be strengthened with specialised manpower to handle the complexity of cases in the digital landscape. The Data Protection Board, which is yet to be formed, is likely to face similar challenges in assessing market-wide data flows in the face of constant innovation in digital markets.
DPDP compliance burden as an entry barrier: The DPDP Act’s granular consent requirements and restrictions on cross-sharing of personal data introduce significant compliance costs for digital enterprises. Startups and MSMEs, in particular, may face operational and financial strain in implementing itemised consent notices, onboarding consent managers, and maintaining audit trails for lawful processing. While these obligations enhance personal privacy, they can also function as entry barriers in digital markets.
Our View
India’s digital regulatory framework must move beyond parallel structures towards a coordinated regulatory approach. Regulatory approaches under the DPDP Act and the Competition Act must be converged for their application to AI and data-driven markets. Even though regulatory hurdles may arise in the short term, the long-term convergence of the DPDP Act and the Competition Act holds the potential to build a digital ecosystem that is sustainable, innovation-friendly, and compliant with both privacy and fairness standards in digital markets. A key consideration moving forward is the potential reintroduction of a revised draft of the DCB and its implications on the digital market, which may help operationalise enforcement at the intersection of the Competition Act and the DPDP Act. A balanced approach combined with capacity building in both regulatory bodies will ensure a forward-looking framework that integrates privacy safeguards with competition oversight, ensuring that innovation in digital markets remains accountable to user autonomy and market fairness.