Privacy Meets Competition Law: Data, Dominance and the DPDP Act

Introduction

A privacy policy is usually read as a compliance document. When the business behind it has market power, it is also a set of terms users may have no practical way to refuse, and competition law can test them. India's competition authorities have done so, and from 13 May 2027 the Digital Personal Data Protection Act, 2023 (the DPDP Act) will apply its own consent test to every business, dominant or not.

In DPDP terms, a data fiduciary decides why and how personal data is processed, a data principal is the person it is about, and a data processor acts on a fiduciary's behalf. We cover the cases, their fit with DPDP consent, two gaps (portability and the missing link between regulators) and a payments app that wants to share data with a lender in its group.

The legal position

What the CCI ordered

On 18 November 2024, in Suo Motu Case No. 01 of 2021, the Competition Commission of India (CCI) held Meta, through WhatsApp, dominant in OTT messaging apps through smartphones in India. WhatsApp's 2021 update made acceptance of wider data sharing with Meta companies mandatory. The CCI found an unfair condition (s.4(2)(a)(i) of the Competition Act, 2002), denial of market access to rivals in display advertising (s.4(2)(c)) and leveraging of dominance into that market (s.4(2)(e)). It imposed a penalty of ₹213.14 crore and directed, with three months to comply (para 247.3), that:

• WhatsApp not share user data with other Meta companies for advertising for five years (para 247.1);
• its policy explain each type of data shared and the purpose of each (para 247.2.1);
• sharing beyond providing WhatsApp not be a condition of access in India (para 247.2.2);
• every user, including those who accepted in 2021, get an in-app opt-out and a settings tab to revisit it (para 247.2.3);
• future updates follow suit (para 247.2.4).

The CCI saw "no inherent conflict or repugnancy" between the two bodies of law: competition law "supplements data protection regulations" (para 28.9).

What survived appeal

The National Company Law Appellate Tribunal (NCLAT) ruled on 4 November 2025. It upheld the unfair-condition finding (mandatory acceptance of a "take it or leave it" policy "amounted to coercion") and the market-access finding, though Meta was not dominant in display advertising. It set aside the five-year ban but kept the conduct directions. Its clarification of 15 December 2025 explains why: once users can freely opt in or out, the ban "becomes redundant", since "any non-essential collection or cross-use (like advertising etc.) can occur only with the concerned user's express and revocable consent". The clarification also fixed a drafting slip, so that all four paragraph 247.2 directions cover every non-WhatsApp purpose, advertising included, with three months to comply. The tribunal found "no repugnancy" between the Competition Act and the DPDP Act (para 70). Reports say it upheld the penalty in full and set aside the leveraging finding; we could not read its operative paragraph.

Meta's appeals (Civil Appeal Nos. 301–302 of 2026, with connected appeals) were admitted on 3 February 2026. The Supreme Court added the Ministry of Electronics and Information Technology as a respondent, noted that the full ₹213.14 crore was already deposited, forbade its withdrawal and directed a final hearing before three judges. On 23 February the appellants withdrew two stay applications and undertook to implement the NCLAT's directions by 16 March 2026. The most recent order available to us, of 21 May 2026, listed it for 12 August 2026. We could not confirm what happened then; press reports describe one connected appeal as the CCI's, seeking to revive the ban.

Beyond WhatsApp: Google Play and the draft bill

In its October 2022 Play Store billing order, the CCI directed Google to publish a clear policy on the data it collects, uses and shares, including with related entities; not to leverage competitively relevant transaction and consumer data from its billing system; and to give developers access, with safeguards, to data generated through their apps.

The draft Digital Competition Bill, 2024, released by the Ministry of Corporate Affairs (MCA) for consultation from 12 March to 15 May 2024, would have imposed similar ex-ante duties on "Systemically Significant Digital Enterprises": no use of business users' non-public data to compete with them; no cross-use of personal data across services, or third-party use, without consent, which for end users would carry its DPDP meaning; and easy data portability (draft s.12). It has not reached Parliament. MCA told the Standing Committee on Finance (report of August 2025) that 106 responses were under examination and that market studies were also needed. Later press reports say MCA tendered a study of the bill's thresholds and core digital services in November 2025, now run by Management Development Institute, Gurgaon; none reports a formal withdrawal.

Analysis

Is a bundled consent free?

Section 6(1) of the DPDP Act requires consent that is "free, specific, informed, unconditional and unambiguous", limited to the data necessary for the specified purpose. Its telemedicine illustration keeps consent to the service but not to contact-list access it does not need, and s.6(2) voids any part of a consent that infringes the law. The NCLAT's standard, express and revocable consent for non-essential cross-use, arrives at much the same place by another road. The regimes still part company in two ways:

• Who and when. Competition law needs dominance but bites today. DPDP consent rules start on 13 May 2027 and bind every fiduciary, so a start-up's "agree to everything" screen is no abuse yet may still yield invalid consent.
• Stakes. The CCI can order changes in conduct and impose up to ten per cent of three-year average turnover (s.27(b)). A DPDP consent failure sits in the Schedule's residual tier, up to ₹50 crore.

In our view "free" in s.6(1) should be read against the user's alternatives. Where she cannot realistically switch, a choice between extra sharing and losing the service is hard to call free, however clearly explained, and s.6(10) puts the burden of proving consent on the fiduciary. Trayambic's article on notices and consent covers bundling generally.

Moving data between group companies

Under the DPDP Act a transfer to a sister company is "sharing", itself processing (s.2(x)), and each company is a separate "person" (s.2(s)) and fiduciary (s.2(i)); nothing exempts intra-group flows. The sender needs a ground to disclose and the recipient a ground for its own use, with a notice wherever the ground is consent (s.5; Rule 3). Section 7(a) covers only the purpose for which the person volunteered the data, rarely a sister company's business. Competition law looks the other way: s.4(1) reaches abuse by "an enterprise or group". Two DPDP duties follow the data: the sender must identify recipients on request (s.11(1)(b)), and data used for a decision or passed to another fiduciary must be complete, accurate and consistent (s.8(3)).

Portability: a remedy without a right

The DPDP Act gives no right to data portability, and s.11 yields a summary, not a copy; Trayambic's article on data principal rights explains the gap. Portability-like results come only from case-specific competition remedies, such as developer data access in the Play Store order; from sector schemes, such as the RBI's account aggregator framework for financial data; and, if revived, from draft s.12(3) of the Digital Competition Bill. A dominant platform's customer has no general right to take her data to a rival.

No bridge between the regulators

Sections 21 and 21A of the Competition Act let a "statutory authority" and the CCI refer issues to each other for an opinion within sixty days. In our view the Data Protection Board sits awkwardly within the s.2(w) definition, which covers bodies established "for the purposes of regulating" the supply of goods or services or their markets. The DPDP Act has no matching provision; s.38(1) simply makes it additional to other laws. With no Board members appointed as of October 2026, only the CCI and the NCLAT read privacy terms through a market lens.

Practical implications

Worked example (illustrative)

A group runs a wallet and UPI payments app used by about 3 crore people, and an RBI-registered NBFC. The NBFC wants twelve months of the app's transaction summaries to pre-approve small credit lines and show offers in the app.

1. 1.At sign-up. The payments company processes transaction data to run payments, which s.7(a) covers. Lending is a new purpose in another company, so the group adds a separate, unticked choice with a Rule 3 notice naming the NBFC, the data items and the purpose. A customer who says no keeps full use of payments. If the app leads its market, this also tracks paragraph 247.2.2 of the WhatsApp order.
2. 2.When an offer appears. The app runs the NBFC's loan journey, so in our view it is the NBFC's lending service provider: it needs a s.8(2) contract, and the RBI's NBFC Credit Facilities Directions require explicit consent before data is shared with a third party (para 13(4)). Trayambic's NBFC and digital lending study covers the rest.
3. 3.When she applies. The NBFC decides on the shared data, so both companies owe s.8(3) accuracy. Its KYC directions bar cross-selling on account-opening data without express permission (para 61), so KYC data does not flow back to the app for marketing.
4. 4.When she withdraws. One switch stops the sharing and reaches the NBFC (s.6(4), s.6(6)), which erases the offer data (s.8(7)) but keeps the loan records the law requires.
5. 5.When she wants to move. She asks for her history for a rival lender. The DPDP Act gives no right to it; the group may offer an export, and must still tell her, on request, that the NBFC received her data (s.11(1)(b)).

Key takeaways

Consent design is now reviewable as market conduct when a firm is dominant, and from May 2027 as data protection for everyone. Still open are the Supreme Court's view of the remedies, the ex-ante bill and how the CCI and a Board without members will divide the ground. None of that changes what a group should build now: the service first, extras optional, recipients named and choices reversible.

• The CCI's 2024 WhatsApp order treated a mandatory data-sharing policy as an abuse of dominance; the NCLAT set aside the five-year advertising ban but upheld the conduct directions, which now cover advertising too.
• The Supreme Court admitted the appeals in February 2026 and the full ₹213.14 crore has been deposited; we found no judgment as of October 2026.
• The NCLAT's test, express and revocable consent for non-essential cross-use, sits close to the DPDP Act's demand for free, specific and unconditional consent, which binds every business from 13 May 2027.
• There is no intra-group exemption: a sister company using shared customer data for its own business needs its own ground and, where that is consent, a notice naming it.
• The DPDP Act has no portability right; the draft Digital Competition Bill, which would have added one for the largest platforms, has not been introduced.