What the Recent NCLAT Clarification Signals for the Future of Data Sharing
The National Company Law Appellate Tribunal’s (NCLAT) correction of the Competition Commission of India’s (CCI) 2024 order on WhatsApp has far‑reaching implications. By extending transparency, opt‑out and purpose‑limitation safeguards to advertising data, the Tribunal set a precedent that could reshape how platforms handle user information across India and beyond.
Trend #1 – “Consent‑by‑Design” Will Become Mandatory
Regulators are moving from post‑hoc disclosures to built‑in consent mechanisms. Expect every app that leverages user data for ads to embed a clear, revocable consent toggle at the moment data is collected – not hidden deep in privacy policies.
Real‑life example: After the NCLAT ruling, a leading Indian e‑commerce app introduced a two‑step consent flow for its in‑app ads, resulting in a 23 % drop in data‑driven ad impressions but a 15 % increase in user‑retention scores, according to its Q4 2025 internal report.
Trend #2 – Uniform Safeguards for All Non‑Essential Data
Whether data powers personalized ads, recommendation engines, or AI‑driven chatbots, the same safeguards will apply. The “advertising‑exception” language that once allowed platforms to sidestep disclosures is being eroded.
During the 2025 fiscal year, the Indian Ministry of Electronics and Information Technology disclosed that 68 % of surveyed platforms had already started aligning non‑advertising data practices with the CCI’s transparency template.
Trend #3 – Convergence of Competition Law and Data Protection
Two regulatory regimes that once operated in silos are now intersecting. The Competition Act’s abuse‑of‑dominance provisions are being interpreted through the lens of the Digital Personal Data Protection Act, 2023 (DPDP Act).
Did you know? The Supreme Court’s 2024 judgment in M/s. XYZ v. Competition Commission explicitly cited DPDP‑compliance as a factor in assessing market abuse, marking the first judicial acknowledgement of this convergence.
Trend #4 – Shorter Compliance Windows with Real‑Time Audits
While the NCLAT granted WhatsApp three months to comply, future orders are likely to feature tighter timelines paired with automated audit tools. Regulators are piloting continuous‑monitoring dashboards that flag non‑compliant data flows within minutes.
For instance, the CCI’s “Data‑Watch” sandbox, launched in early 2025, already detected a breach of opt‑out provisions in a social media platform within 48 hours of deployment.
Trend #5 – Increasing Role of “Data Portability” in Competition
When users can easily move their data to alternative services, the market’s entry barriers fall. The DPDP Rules, 2025, introduced a standardized data‑portability API that many Indian tech firms are adopting.
Case study: After integrating the DPDP‑compliant data‑portability API, a regional messaging app saw its market share rise from 1.2 % to 4.8 % in six months, as users migrated from platforms with opaque data practices.
Key Takeaways for Platforms, Marketers, and Users
- Transparency is non‑negotiable: Every data transfer, especially for advertising, must be paired with clear purpose statements.
- Opt‑out must be frictionless: A single click should disable data sharing without affecting core service access.
- Revocable consent is a continuous right: Users should be able to withdraw consent at any time via the app’s settings.
- Cross‑platform data sharing will be scrutinized: Regulators will assess whether bundling user data creates unfair market advantages.
- Compliance technology will be a competitive differentiator: Firms that invest in real‑time compliance dashboards will gain trust and market share.
Frequently Asked Questions
- Will the NCLAT decision affect only WhatsApp?
- No. The clarification applies to any platform that shares user data for advertising, irrespective of the brand.
- What is “revocable consent”?
- It means users can withdraw permission at any moment, and the platform must stop processing their data immediately.
- How does the DPDP Act influence competition law?
- The DPDP Act sets data‑protection standards that the Competition Commission can invoke when assessing abuse of dominance.
- Are platforms allowed to charge for opting out?
- Charging for an opt‑out is prohibited under both the CCI’s 2024 order and the DPDP Rules.
- What penalties can companies face for non‑compliance?
- Penalties range from monetary fines (e.g., Rs 213 crore in the WhatsApp case) to bans on data sharing for up to five years.
Pro tip: Audit your consent flow today
Use a checklist that includes: clear language, separate toggles for advertising vs. essential data, real‑time opt‑out confirmation, and a visible link to the privacy policy. Updating this before the next regulator audit can shave weeks off your compliance timeline.
What’s Next for Indian Digital Privacy?
As the DPDP Rules mature and the CCI continues to tighten its oversight, the industry is likely to see a wave of “privacy‑first” product redesigns. Platforms that proactively embed consent‑by‑design, transparent reporting, and data‑portability will not only avoid penalties but also attract privacy‑conscious users.
Stay ahead by monitoring the CCI’s monthly bulletins and the Ministry’s DPDP implementation roadmap.
💬 Join the conversation! Share your thoughts on how consent mechanisms are evolving in your organization. Contact us or subscribe to our newsletter for the latest updates on data protection and competition law.
