Data today is not merely information about individuals. It is a strategic asset. When aggregated at scale, data enables predictive analytics, market control, behavioural nudging, and algorithmic gatekeeping. The power lies not in a single data point, but in who controls the datasets, the infrastructure, and the analytical capacity to exploit them.
India’s digital governance story is often presented as a regulatory success. In a little over a decade, the country has moved from legal silence on data to a dense framework governing privacy, consent, localisation, cybersecurity, and fiduciary obligations. The Digital Personal Data Protection Act, 2023, stands as the centrepiece of this transformation. Yet this progress conceals a deeper regulatory gap. While Indian law has become adept at managing how data is collected and processed, it remains largely indifferent to a more consequential question: who accumulates data at scale, and what power that accumulation creates.
This distinction is not semantic. It goes to the heart of how digital markets function, how political influence is exercised, and how economic power is accumulated in the twenty-first century.
From Data Protection to Data Dominance
Indian data regulation is overwhelmingly individual-centric. The DPDP Act focuses on protecting the personal data of the “Data Principal” from misuse by “Data Fiduciaries.” Consent, purpose limitation, and data minimisation form the backbone of the framework. These are necessary safeguards, but they are not sufficient to address the structural realities of data concentration.
Data today is not merely information about individuals. It is a strategic asset. When aggregated at scale, data enables predictive analytics, market control, behavioural nudging, and algorithmic gatekeeping. The power lies not in a single data point, but in who controls the datasets, the infrastructure, and the analytical capacity to exploit them. India’s legal regime remains largely silent on this question of concentration.
The Myth of Neutral Markets
Indian competition law, particularly under the Competition Act, 2002, is ill-equipped to deal with data dominance. Traditional metrics—market share, pricing power, and consumer harm—struggle to capture the realities of zero-price markets, platform ecosystems, and cross-market leveraging.
A platform may offer services for free, yet consolidate immense informational advantage across sectors such as search, advertising, payments, health, mobility, and governance interfaces. Data collected in one domain strengthens dominance in another, creating self-reinforcing monopolies without overt price manipulation.
The Competition Commission of India has made incremental progress in recognising data as a source of market power, particularly in cases involving digital platforms. However, these interventions remain ex post, fragmented, and slow, often arriving after market structures have already ossified.
The Political Economy of Data Power
The implications of data concentration go far beyond markets. Data power reshapes the relationship between citizens, corporations, and the State.
Private entities that control large datasets increasingly influence public discourse, electoral behaviour, and access to essential services. At the same time, the State’s expanding reliance on digital infrastructure, identity systems, welfare databases, and surveillance tools raises uncomfortable questions about informational asymmetry and accountability.
Yet Indian law treats the accumulation of private and public data in silos. Surveillance concerns are discussed separately from corporate data hoarding. Welfare databases are debated in isolation from platform monopolies. What is missing is a unified theory of data power.
Why Privacy Law Cannot Do This Job Alone
Privacy law, by design, protects individuals, not markets or democracy. Consent does not meaningfully check asymmetry when services are indispensable. Transparency notices do little when algorithms remain opaque. Even anonymisation fails when re-identification becomes technologically trivial at scale.
By framing data harms primarily as violations of individual rights, Indian regulation overlooks collective and systemic risks such as market foreclosure, political manipulation, and technological dependency. This is not a failure of intent, but of regulatory imagination.
Learning Without Imitating
The European Union has begun to recognise data concentration through instruments like the Digital Markets Act, which treats certain platforms as gatekeepers based on their structural position rather than proven harm. However, India cannot simply import these models. Our digital economy, state capacity, and developmental priorities are distinct.
What India needs is not heavier regulation, but smarter calibration—one that identifies data concentration as a source of power requiring sector-agnostic oversight.
Towards a Data Power Framework
First, India must explicitly recognise data accumulation as a competition concern, independent of price effects. This requires updating competition analysis to include access to datasets, interoperability barriers, and cross-platform data leverage.
Second, regulatory coordination is essential. Data protection authorities, competition regulators, and sectoral bodies cannot function in isolation when the same datasets influence markets, governance, and speech.
Third, transparency must extend beyond consent to structural visibility. This means clarity on who holds what data, for how long, and with what downstream impact.
Finally, democratic accountability demands that both State and corporate data power be subject to proportional limits, judicial oversight, and public scrutiny.
Conclusion
India has rightly focused on protecting citizens from data misuse. But a protection-only analysis is incomplete. In the digital age, the real risk lies not only in data breaches but in data monopolies.
Until Indian law confronts data concentration as a form of power—economic, political, and social—our regulatory framework will remain one step behind the realities it seeks to govern. The challenge before us is not whether to regulate data, but whether we are willing to regulate who controls the future through it.
Disclaimer: The views expressed in this article are those of the authors solely. TheRise.co.in neither endorses nor is responsible for them. Reproducing this content without permission is prohibited.