Come December each year, most apps are ready with stylised, vibrant, year-end reviews, mapping everything from the music and podcasts that filled your (y)ears to whom you spoke with frequently. 

Most of us enjoy these lists because they may tell us something about ourselves (e.g., my step-count is abysmal; I need to spend more time running in 2026). These pithy year-end summaries could, however, shed some light on the bigger picture: what personal data can an individual access on request, and is responding to an access request as straightforward as it sounds?

Here’s a listicle that unpacks this in an Indian data protection law context.  

In August this year, India’s data protection law, the Digital Personal Data Protection Act, 2023 (fondly, the DPDPA) completed two years around the sun. I commemorated the anniversary with a list of 5 issues that had lingered despite the passage of time – questions without easy answers. There was a sense then that the draft rules, once finalised, might answer some of these (and other) questions.

Three months on, we have a chance to verify this. On 13 November, the DPDPA resurfaced, bringing with it the finalised Digital Personal Data Protection Rules, 2025 (now, also fondly, the DPDP Rules) and an 18-month implementation timeline. While this should wrap things up neatly in a bow by 13 May 2027 (which is when the law is supposed to fully take effect), several questions still remain. Questions that may be compounded by a shrinking –  and now, likely to be compressed – implementation timeline.

Here are 5 more issues to consider as the DPDPA heads into implementation season.

Much has been written about the recently-released Swiped. Some critics liked the movie (due, in no small part, to Lily James’ performance), which is inspired by Whitney Wolfe Herd’s journey from co-founding Tinder through to reshaping online dating with Bumble. Others have suggested that the film can be one-note at the expense of fleshing out the complex issues at its heart and the underlying tech journey. (To be fair, asking a two-hour film to be everything to everyone is unrealistic.) 

As a technology lawyer, watching an app or feature being built, shaped, or deployed in real life is always exciting (and watching it on screen comes close). More so for me, personally, when it’s a woman-led tech venture or story.

But this isn’t a post about women in tech (or tech law), or the cinematic ups and downs of the biopic itself (I’ll save that for another time). It’s about how an app built grievance redressal into its business model and product design, and why there's an important lesson in there for everyone.