Bridging the Gap: Data Privacy and Safety of Women
DOI:
https://doi.org/10.47814/fy6bvs82Keywords:
Data Privacy, Digital Personal Data Protection Act, 2023, Corporate Data Handling, Corporate Accountability, Artificial intelligence, DeepfakesAbstract
This paper looks at how far India's Digital Personal Data Protection Act, 2023 actually succeeds in regulating the way companies collect, store, and use personal data, with particular attention paid to the gap left by newer technologies such as deepfakes and AI-generated content. Using doctrinal analysis and comparative reference to the United Kingdom and the European Union, it traces the development of Indian data protection law from the Information Technology Act, 2000 through Justice K.S. Puttaswamy v. Union of India to the 2023 Act. This legal analysis is combined with primary survey data collected from seventy-seven respondents on their awareness, trust, and concern about corporate data handling. The findings show that public concern about how companies use personal data consistently outstrips trust that companies handle it responsibly, and that most respondents were unaware of the DPDP Act itself. The paper argues that while India's framework broadly matches global standards, it is not yet equipped to deal with AI-driven and gender-based harms, and that how effective it turns out to be will depend on enforcement through the Data Protection Board rather than on the text of the law alone.
References
Ajder, H., et al. (2019). The state of deepfakes: Landscape, threats, and impact. Deeptrace.
Ayres, I., & Braithwaite, J. (1992). Responsive regulation: Transcending the deregulation debate. Oxford University Press.
Barnes, S. B. (2006). A privacy paradox: Social networking in the United States. First Monday, 11.
California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq.
California Privacy Rights Act of 2020.
CERT-In. (2022). Directions under § 70B(6) of the IT Act, 2000.
Citron, D. K. (2019). Sexual privacy. Yale Law Journal, 128, 1870.
CNIL. (2022, January). Decision re Google LLC.
Committee of Experts under the Chairmanship of Justice B. N. Srikrishna. (2018). A free and fair digital economy: Protecting privacy, empowering Indians. MeitY.
COPPA, 15 U.S.C. §§ 6501–6506.
Data (Use and Access) Act 2025, c. 13, § 138 (U.K.) (inserting § 66D into the Sexual Offences Act 2003).
Data Protection Act 2018, c. 12 (U.K.).
The Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code (2023).
Equifax Inc. (2017, September 7). Equifax announces cybersecurity incident involving consumer information (Form 8-K). U.S. Securities and Exchange Commission.
eSafety Commissioner. (n.d.). Image-based abuse. https://esafety.gov.au
Ewick, P., & Silbey, S. S. (1998). The common place of law: Stories from everyday life. University of Chicago Press.
Facebook–Cambridge Analytica data scandal. (n.d.). In Wikipedia. (detailing the unauthorised harvesting of data from approximately 87 million Facebook users)
Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809.
HIPAA, Pub. L. No. 104-191.
The Indian Penal Code, 1860, §§ 354A, 509, No. 45 of 1860.
Information Commissioner's Office. (n.d.). About the ICO. https://ico.org.uk
The Information Technology Act, 2000, § 43A, No. 21 of 2000, as inserted by the IT (Amendment) Act, 2008.
The Information Technology Act, 2000, §§ 66E, 67A, as inserted by the IT (Amendment) Act, 2008.
IRDAI. (2017). Guidelines on information and cyber security for insurers.
Irish Data Protection Commission. (2023, May). Decision re Meta Platforms Ireland Ltd. (€1.2 billion fine).
The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, G.S.R. 139(E), r. 3(2) (India).
The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, G.S.R. 313(E) (India).
Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
Kaspersky. (2023). The state of stalkerware 2022. Securelist.
Kaspersky. (2024). The state of stalkerware 2023. Securelist.
Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295.
Kokolakis, S. (2017). Privacy attitudes and privacy behaviour: A review of current research on the privacy paradox phenomenon. Computers & Security, 64, 122.
Luxembourg CNPD. (2021, July). Decision re Amazon Europe Core S.à r.l. (€746 million fine).
National Crime Records Bureau. (2022). Crime in India 2022: Statistics. https://ncrb.gov.in
OECD. (1980). Guidelines governing the protection of privacy and transborder flows of personal data.
Online Safety Act 2021 (Cth) pt 6 (Austl.).
Online Safety Act 2023, c. 50, § 188 (U.K.) (amending the Sexual Offences Act 2003, c. 42, § 66B).
Parliamentary Committee on Empowerment of Women. (2026). Cyber crimes and cyber safety of women (Fourth Report). Parliament of India.
R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632.
RBI. (2021). Master directions on digital payment security controls.
Regulation (EU) 2016/679 (General Data Protection Regulation), 2016 O.J. (L 119) 1.
Rogers, R. W. (1975). A protection motivation theory of fear appeals and attitude change. Journal of Psychology, 91, 93.
SEBI. (n.d.). Cyber security and cyber resilience framework.
Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154, 477.
Wang, M. Y. (2023). Don't believe your eyes: Fighting deepfaked nonconsensual pornography with tort law. University of Chicago Legal Forum, 2022, 415.
Zuboff, S. (2019). The age of surveillance capitalism: The fight for a human future at the new frontier of power. PublicAffairs.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Nikshit Sharma
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain copyright of their published work and grant the International Journal of Social Science Research and Review (IJSSRR) the right of first publication.
Articles published in IJSSRR are distributed under the terms of the Creative Commons Attribution 4.0 International License (CC BY 4.0), which permits use, distribution, and reproduction in any medium, provided that the original work is properly cited.
Authors are permitted to share, archive, and distribute the published version of their work, provided that proper acknowledgement of the original publication in IJSSRR is given.
