India’s first data protection law, now in force, gives citizens control over their digital lives, forces companies to rebuild consent and security systems, and triggers a ₹10,000-crore compliance boom, but rights advocates warn of sweeping state exemptions and delayed enforcement