As of November 2025, there have been no official amendments to the DPDP Act; the law remains unchanged since its passage in 2023. However, public discourse and expert commentary continue to debate certain provisions. One topic is the scope of government exemptions: civil society groups and even the original architect of India’s earlier data protection draft (Justice B.N. Srikrishna) have criticized the Act for granting the government broad powers to exempt itself and for lacking an independent data protection authority. Another debated issue is the age of consent set at 18 for all, which some argue is impractical in the modern internet context (global norms often allow 13+ with conditions). There have been calls to amend this in the future to a risk-based approach for minors’ consent.

Legal challenges: To date, no major constitutional challenge to the DPDP Act has been reported in court. One reason could be that the Act hasn’t begun operation yet – any challenge might be premature. Nonetheless, the Delhi High Court did prod the government in 2025 regarding the delay in enforcement, emphasizing the need to implement the data protection regime promptly to protect citizens’ rights. This demonstrates the judiciary’s interest in ensuring the law is enforced and not merely remains on paper. We might see PILs or cases in the future if, for instance, the exemptions or executive powers under the Act are perceived to violate the fundamental right to privacy. For now, organizations should focus on compliance with the law as enacted, while remaining aware that aspects such as government access to data and surveillance-related provisions may evolve under judicial review.