Recently, the government passed the Digital Personal Data Protection Act (DPDP). Its primary purpose is to regulate the collection and processing of digital personal data and respect individuals' rights. 

The way the system will work is that the government will create a Data Protection Board, as the supervising agency to monitor, enforce rules and impose penalties when appropriate. The board would adjudicate a dispute between those whose personal data has been given to a platform and the platform which has in turn breached the obligations under the Act. Companies are understandably concerned that even unintended slips can lead to serious charges of violation. This opens up a completely new industry that promises auditing of an organisation’s processes to ensure compliance. The cost of doing business will consequently jump. 
This podcast explains.