I do not understand why legislator of a non-US country is not instantly copying GDPR. It has solid spread already and the rules are adequately balancing customers, law and company interests (yes, that does not look like but hey, advertisement is still possible). International collaboration is much easier like that.

GDPR has this very fancy article saying: This all applies, except a law says otherwise. As a government, this is then up to you how many laws you create for your own surveillance and other state apparatus. Citizens get a nice benefit. Big companies anyway need to adhere to GDPR one way or the other due to the international market. Local companies which want to collect citizens data should get their users consent. That is not so hard. Even data privacy paranoid Germany has a private credit rating system which works for 50+ years.

There is no other reason except corruption/lobbyism which would require a legislator to vote against a GDPR like approach. There is no risk to your economy by introducing good data privacy.

Just a rant. India might have its reasons.