Data Privacy Laws and the Economy

How laws like Europe's GDPR and India's Digital Personal Data Protection Act regulate personal data, and their economic effects.

Personal data, such as names, locations, purchases and browsing habits, powers much of the digital economy. Data protection laws set rules on how organisations can collect, use and share it.

The European Union’s General Data Protection Regulation, or GDPR, took effect in May 2018. It requires organisations to:

Have a legal basis, such as consent, for processing personal data.
Tell people how their data is used.
Let people access, correct and delete their data.
Report data breaches promptly.

Fines can reach 4 percent of a company’s global annual revenue. Regulators have fined major technology companies large sums under the GDPR.

India’s law

India passed the Digital Personal Data Protection Act in 2023. It requires consent for processing personal data in most cases, gives individuals rights over their data, and creates a Data Protection Board to enforce the rules. Implementing rules were issued in 2025.

Economic effects

Economists have studied the GDPR’s effects:

Compliance costs: businesses spent heavily on legal advice, systems and staff.
Market concentration: some studies found the GDPR reduced the number of third-party technology vendors on websites, with large firms like Google gaining relative share, possibly because big firms can bear compliance costs more easily.
Innovation and investment: research by Jian Jia, Ginger Jin and Liad Wagman found venture investment in EU technology firms fell relative to the United States after the GDPR.
Consumer benefits: greater control over data, fewer unwanted uses and more trust.

The cookie banner

Since the GDPR, many websites show pop-ups asking permission to use cookies that track browsing. For users, this offers choice, but many simply click "accept" to get to the content. For blind users, badly designed banners can be hard to navigate with screen readers, showing how privacy rules and accessibility interact.

Balancing goals

Privacy laws aim to balance protecting individuals with allowing useful data-driven innovation. Getting the balance right, and designing rules simple enough for small businesses, remains a challenge.

Thinking privacy laws only affect big tech companies

Data protection laws apply to organisations of all sizes that handle personal data, from shops and hospitals to schools. Compliance costs can weigh most heavily on small businesses.

Key takeaways

Data protection laws regulate how personal data is collected and used.
Europe's GDPR took effect in 2018; India passed its Digital Personal Data Protection Act in 2023.
Studies found compliance costs, increased concentration and lower venture investment after the GDPR.
Laws aim to balance individual control over data with innovation.