India’s Tryst with Privacy

Executive Summary There is no one ‘Indian digital consumer’. Privacy risk is processed differently across classes, shaped by literacy, dependence and ability to exit.

Across industries, privacy incidents prompt complaints, but rarely trigger exit.

Surveys show concerns about data misuse, yet behaviour remains stable. This gap reflects constraint, not ignorance.

A landmark legal judgement around privacy as a fundamental right has had only limited impact on everyday consumer behaviour or expectations.

Exit is weakening across digital markets globally, but in India it is often impractical. Digital identity and payments function as essential infrastructure.

Privacy enforcement therefore shifts upwards. Regulation and system design substitute for consumer agency, placing responsibility on firms and institutions.

. India’s digital consumers are often discussed as if they were a monolith. They are not. Privacy risk in India is not processed uniformly, nor is it negotiated through choice in the way many market frameworks assume. Behaviour is shaped by class, literacy, dependence and constrained exit options. The result is a consumer landscape where privacy concerns are visible but behavioural change is rare, and where the responsibility for privacy outcomes rests mainly with institutions. This pattern is not unique to India. Across digital markets, exit is increasingly limited by scale, network effects and infrastructural dependence. The difference lies in how risk is governed once exit weakens. This paper examines how privacy risk is actually internalised, tolerated or ignored by Indian consumers, and why businesses and regulators end up carrying the burden of action.

The Indian Consumer is Not a Monolith Any discussion of privacy in India demands careful segmentation. Urban, English-speaking, digitally literate consumers form a narrow but vocal segment. They adopted digital platforms early, consume global media and understand concepts such as data breaches, tracking and surveillance. They know when something has gone wrong, drawing on online discussions and scrolling. They adjust settings, experiment with alternative apps and express dissatisfaction publicly. Yet even here, the space to exit is limited, reflecting a broader global pattern rather than an Indian anomaly. Network effects, professional dependence and social coordination costs pull them back. Consumer behaviour centres around tolerance rather than outright refusal.

A second, much larger segment consists of the aspirational ‘middle users’. Such consumers came online mainly after 2016, largely through cheap smartphones and low-cost data. Their usage is mobile-first, vernacular-heavy and functional and many are only partially ‘privacy literate’. Risk is understood through direct harm, not abstraction. Fraud, scams and social embarrassment register deeply; algorithmic profiling, data retention and surveillance do not. The choice to exit exists but is rarely utilised. If a service is cheap, popular or government-linked, it is assumed to be ‘safe enough’.

The third segment comprises mass users with low formal education and high dependence on state systems. For them, digital participation is not optional. Aadhaar, SIM verification, benefit authentication and banking access are particularly vital to their livelihoods. Privacy as a concept barely exists. What matters is whether the system works today. Opting out is not a rational choice because it means exclusion from welfare, finance or communication.

These distinctions matter because incidents play out differently across segments. Privacy breaches that generate outrage in one group barely register in the other.

What Incidents Reveal About Behaviour India has experienced repeated privacy-related incidents in the last 20 years, across banking, telecom, government infrastructure and consumer technology. Several clear response patterns emerge:

Financial data breaches, whether in wallets, banks or payment apps, trigger reaction. Consumers complain, seek redress and become temporarily cautious, but they do not abandon digital finance. Usage continues to rise even after high-profile leaks. Between FY18 and FY25, digital payments volumes grew more than 6x despite repeated fraud waves and large-scale data breaches. Complaint volumes, according to the RBI, crossed 1.3 mn in FY25, largely related to digital transactions, yet platform usage and adoption continued to expand. The expectation is that banks, regulators or platforms will fix the system. This mirrors the more developed markets, but liability and enforcement tend to be stronger there relative to India.

Government digital systems show an even sharper pattern. Aadhaar leaks, surveillance revelations and pandemic-era data exposures generated intense media and activist scrutiny, but mass behaviour did not change. Enrolment and Aadhar-linking continued and overall usage expanded. By 2019, over 90% of Indian adults were enrolled in Aadhaar. According to a nationwide survey by Dalberg Advisors, >70% reported found it convenient even as nearly half expressed concern about excessive linkage across services. For most citizens, refusing participation was infeasible. The cost of resistance exceeded the perceived risk. In contrast to Western systems, where similar trade-offs exist but are cushioned by clearer accountability and redress mechanisms, Indian consumers face higher stakes with thinner safeguards.

Telecom incidents follow the same logic. SIM linking exercises, data leaks and chronic spam abuses produce resentment, not defection. India has added hundreds of millions of mobile connections both during and after mandatory Aadhaar re-verification, despite documented cases of data misuse at retail points. A working phone connection is essential infrastructure. Consumers complied first and relied on courts or regulators later. Having been exposed to the benefits of cheap data, few attempted to reverse it.

Social media scandals are the clearest illustration of the gap between voice and behaviour. The WhatsApp policy backlash of 2021 generated visible anger, millions of downloads of alternative apps and sustained media coverage. Yet, post-controversy surveys by LocalCircles showed that only about 5% of Indian users actually deleted WhatsApp, while roughly two-thirds continued usage unchanged. Network dominance reasserted itself. For the median user, the controversy soon faded away.

Consumer technology breaches, from e-Commerce to food delivery, tend to be absorbed. Large-scale customer data leaks affect tens of millions of users without producing measurable churn. The exception is predatory lending apps. Here privacy abuse translates directly into social humiliation and financial distress, driving behavioural change – such as shifting away from abusive platforms. Yet even here, it was regulatory enforcement, not consumer self-organisation that proved decisive.

Across categories, there is a consistency to the learnings. Media outrage and activist discourse are not reliable indicators of mass behaviour. Behaviour changes only when harm is immediate, personal and sustained, or when institutions intervene on the user’s behalf.

Concern, but Not Exit High stated concern combined with low exit rates is not a uniquely Indian experience. India differs in degree, with fewer viable alternatives and weaker behavioural guardrails. PwC’s 2022 Global Consumer Insights Pulse Survey indicates high stated concern about privacy among Indian consumers, with over 80% saying they value data protection, and 68% concerned about data misuse. They say they distrust social media platforms and express anxiety about misuse. Yet adoption, retention and engagement continue to climb. Complaint volumes and breach reporting rise without corresponding churn. This gap cannot be explained by ignorance alone. It is driven by four forces:

Exit is often impractical. Digital services are now deeply embedded in welfare access and economic participation. Leaving one platform rarely solves the problem because alternatives behave similarly, are less functional or do not exist.

Privacy carries an implicit cost. Safer options often mean higher prices, lower convenience or weaker networks. Most consumers choose utility over abstraction.

Responsibility is externalised. There is a widespread expectation that if something is truly harmful, the government or regulator will step in. Privacy is treated as the system’s obligation, not an individual bargaining chip.

Harm is probabilistic and delayed. Data misuse does not always produce immediate consequences. Concern fades in the absence of visible damage.

Resultantly, the Indian consumer develops a rational adaptation to constraint.

Why Regulation Carries the Load The Supreme Court’s 2017 landmark Puttaswamy judgement recognised privacy as a fundamental right. Its behavioural impact, though, has been limited. The judgement was internalised by courts, policymakers, lawyers and a narrow urban elite. It reshaped institutional language and justified subsequent regulation but did not fundamentally alter everyday consumer behaviour. Most citizens did not encounter the ruling directly, nor did it change how they navigated digital services. In India, where access to welfare services, payments or connectivity are contingent on compliance, rights remain abstract. The Puttaswamy judgement constrained institutions but did not recalibrate consumer expectations or bargaining power.

This reflects a deep structural difference from Western markets. Digital identity and payments in India are tightly coupled with inclusion. Exit is often impractical. Literacy follows adoption rather than preceding it. Trust is routed through continuity and authority rather than contractual consent. In this context, consumer choice cannot serve as the primary enforcement mechanism for privacy. Market discipline through exit is weak and uneven. Regulation therefore functions as a behavioural proxy. India’s data protection framework substitutes for consumer agency by shifting responsibility onto system design, defaults and institutional accountability. Where consumers cannot reliably self-regulate, regulation becomes the mechanism through which privacy standards are imposed.

Implications for CXOs For firms operating in India, silence should not be read as comfort or approval, but rather dependence. Outrage here does not predict churn, but it does invite scrutiny. The real risk lies not in immediate user losses, but in delayed regulatory intervention and reputational risks. Privacy failures rarely destroy demand overnight, and how a business handles a crisis matters more than the language of its policy statements. Further, global precedents should not offer false assurances: Where consumer exit is weak, regulatory and reputational exposure tends to be higher, not lower. In a nutshell, companies must internalise privacy risk, because consumers cannot be expected to discipline the market. As digital systems become more and more embedded, organisations will need to be more responsible, and self-regulating, on issues around privacy.