Businesses increasingly depend on global cloud infrastructure, international group companies, overseas vendors and remote service providers. As a result, cross-border data transfers have become an important legal and operational issue for organisations operating in India. Personal data may move from an Indian customer to a cloud server overseas, from an Indian subsidiary to its foreign parent company, or from an Indian business to an international analytics or support provider. India's regulatory framework is evolving through the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The framework generally permits international transfers, while giving the Central Government power to restrict transfers to specified countries or territories. However, this does not mean businesses can ignore sector specific localisation rules, contractual obligations, security requirements or foreign privacy laws. Understanding these overlapping requirements is essential for organisations managing international data flows. What Are Cross Border Data Transfers? A cross border data transfer occurs when personal data is transferred, accessed, stored or otherwise processed across national boundaries. The concept can cover more than simply sending a database from India to another country. For example, an Indian company may use a cloud provider whose servers are located overseas. An Indian subsidiary may allow its parent company in another country to access employee information. A software provider may send customer information to an overseas support centre. Even remote access by an overseas service team can create an international data flow depending on the circumstances and applicable law. The legal assessment therefore needs to examine the complete data journey rather than only the physical location of the primary database. India's Legal Framework for International Data Transfers The principal framework is the Digital Personal Data Protection Act, 2023, commonly referred to as the DPDP Act. The Act was enacted on 11 August 2023 and establishes India's general framework for processing digital personal data. Section 16 is particularly important for international transfers. It adopts a relatively permissive model. A Data Fiduciary may transfer personal data outside India unless the Central Government restricts transfer to a particular country or territory through notification. This approach differs from the European Union model, where transfers to third countries are governed by a more structured adequacy and safeguards framework. The DPDP Rules, 2025 provide additional detail. Rule 15 permits personal data processed under the Act to be transferred outside India, subject to requirements the Central Government may specify concerning making such data available to a foreign State or an entity under the control of, or an agency of, such State. Businesses should therefore avoid treating international transfer as automatically unrestricted. The general position is permissive, but restrictions and other legal requirements may apply. Is Cross Border Data Transfer Permitted Under the DPDP Act? Yes. The DPDP Act does not impose a blanket prohibition on transferring personal data outside India. Its approach is commonly described as a negative list model. Instead of requiring every destination to be approved before a transfer can occur, the law allows transfers unless the Central Government restricts a destination. This is an important distinction for multinational companies. The DPDP Act does not currently create a general requirement for organisations to use Standard Contractual Clauses merely because personal data leaves India. However, Section 16 also preserves the operation of other Indian laws offering a higher degree of protection or imposing greater restrictions on international transfers. Consequently, compliance cannot stop with checking the DPDP Act. Current Enforcement Position in India A critical point for businesses is the phased commencement of the DPDP framework. The DPDP Act was enacted in 2023, while the final DPDP Rules were notified in November 2025. MeitY has published the Rules together with the official enforcement timeline. The substantive provisions relating to international transfers are part of the eighteen month implementation phase. Section 16 and Rule 15 are expected to become operational in May 2027 based on the commencement notifications issued in November 2025. Current legal commentary identifies 13 May 2027 as the relevant date. This phased approach should not be misunderstood as a reason to delay compliance planning. Businesses with international data flows need time to identify destinations, review vendors, update agreements, assess sector specific requirements and establish internal controls. Does India Require Data Localisation? The DPDP framework should not be confused with a universal data localisation requirement. The general DPDP position allows international transfers unless the Government restricts particular destinations. It does not require every category of personal data to remain physically stored in India. However, localisation requirements can arise from other Indian laws and regulatory frameworks. The Reserve Bank of India provides an important example. Its Storage of Payment System Data direction requires payment system providers to store the entire payment system data in systems located in India. The RBI also provides specific treatment for the foreign component of cross border transactions. Therefore, an organisation should never ask only whether the DPDP Act permits an overseas transfer. It should also ask whether a sector specific regulator imposes a separate storage, access or processing requirement. This distinction is especially relevant to financial services, payments, insurance, telecommunications, healthcare and other regulated industries. How Sector Specific Laws Affect International Transfers Section 16 operates alongside other applicable Indian legislation and regulatory requirements. For example, payment businesses need to consider RBI requirements concerning payment data. The RBI has clarified that while certain payment processing may occur outside India, prescribed payment data must continue to be stored in India. An organisation operating in a regulated sector may therefore face a layered compliance structure. The DPDP Act may permit an international transfer while another regulation restricts where particular information can be stored or processed. This makes a data flow assessment more useful than a simple country based checklist. What Businesses Should Check Before Transferring Data Overseas The first step is to identify the data being transferred. Organisations should determine whether the information constitutes personal data under the applicable framework and identify the individuals concerned. The next step is to establish the purpose of the transfer. A transfer for payroll administration, customer support, cloud hosting, fraud monitoring and international analytics may each involve different recipients and different legal risks. Businesses should then identify the destination country, recipient organisation, processing location and any onward transfer arrangements. Vendor contracts deserve particular attention. Where an overseas service provider processes personal data on behalf of an Indian Data Fiduciary, the agreement should clearly define the processing relationship, permitted purposes, confidentiality obligations, security measures, assistance requirements and incident handling responsibilities. The organisation should also understand whether the overseas provider can appoint sub processors and whether data may be transferred to additional jurisdictions. Why Data Mapping Matters A strong cross border compliance programme begins with accurate data mapping. Many organisations know which software platforms they use but do not know precisely where personal data travels within those systems. A customer relationship management platform may involve servers in several countries. An international payroll provider may allow access from multiple jurisdictions. A cloud backup may replicate information automatically. A data map should therefore record the source of the information, categories of personal data, purpose of processing, recipient, destination country, storage location, access location, retention period and applicable legal restrictions. This information creates an evidence trail for compliance decisions and helps organisations respond quickly when laws or government restrictions change. Contractual Safeguards for Overseas Vendors Indian law should be considered alongside the contractual framework governing an international relationship. A data processing agreement can establish practical controls even where Indian law does not prescribe a specific transfer instrument. The agreement can address confidentiality, security, permitted processing, deletion, breach reporting, audit rights, subcontracting and assistance with individual rights. For multinational organisations subject to the GDPR or another foreign privacy regime, additional transfer mechanisms may be necessary. Standard Contractual Clauses, Binding Corporate Rules or other recognised mechanisms may become relevant under the law governing the outbound transfer. These mechanisms should not be described as mandatory DPDP transfer tools. Their relevance usually comes from another applicable legal regime. GDPR and Indian Cross Border Transfers The DPDP framework differs materially from the GDPR. The GDPR generally regulates international transfers through adequacy decisions and specified safeguards. These include Standard Contractual Clauses and Binding Corporate Rules, alongside other mechanisms under Chapter V. India instead uses a more permissive statutory model under Section 16. Transfers are generally allowed unless the Central Government restricts particular countries or territories. This difference matters for Indian businesses serving European customers. An Indian company may satisfy the Indian transfer framework while still needing to meet GDPR requirements for data originating from the European Economic Area. The correct approach is therefore to identify every applicable jurisdiction rather than assume one country's compliance automatically satisfies another. What About Overseas Cloud Providers? Using an international cloud provider does not automatically mean a business is violating Indian data protection law. The legal assessment depends on the type of data, processing arrangement, storage location, access arrangements, applicable sectoral rules and any government restrictions. Businesses should obtain sufficient information from cloud providers about data residency, replication, remote access, subcontractors, security controls and deletion practices. A cloud contract should also be reviewed from a privacy perspective rather than treated purely as an information technology agreement. International Transfers and Data Security Cross border compliance is closely connected with information security. Moving personal data to another jurisdiction can increase exposure to unauthorised access, government requests, security incidents and uncontrolled onward transfers. Organisations should therefore apply appropriate technical and organisational safeguards throughout the data lifecycle. Encryption, access controls, authentication, logging, monitoring, data minimisation and secure deletion can reduce risk. The appropriate controls depend on the nature and volume of data and the potential consequences of misuse. Security should also be considered when selecting international processors. A transfer to a permitted destination does not make an insecure processing arrangement acceptable. What Happens If a Data Breach Occurs Overseas? An international incident can create obligations in more than one jurisdiction. An organisation should maintain a documented incident response process covering identification, containment, investigation, assessment, notification and remediation. The DPDP framework introduces breach related obligations for Data Fiduciaries, while other laws may impose separate reporting requirements. CERT In directions also require specified cyber incidents, including data breaches and data leaks, to be reported within the prescribed six hour period from noticing the incident. Organisations should therefore assess the applicable cyber security reporting requirements separately from privacy obligations. The existence of an overseas processor does not necessarily remove the Indian organisation's responsibility. Contracts should clearly allocate operational responsibilities and escalation procedures. Practical Compliance Roadmap for Cross Border Data Transfers Organisations preparing for the DPDP framework should begin with a complete inventory of international data flows. The next stage is to classify each transfer according to the type of information, purpose, recipient, destination and applicable law. Businesses should then identify sector specific localisation requirements and assess whether the destination could become subject to a future government restriction. Vendor agreements should be reviewed and updated where necessary. Privacy notices should accurately describe relevant processing activities. Security controls should be tested, and internal teams should understand how international data flows are approved and monitored. A transfer register can provide a central record of these decisions. It should be reviewed periodically rather than treated as a one time exercise. Organisations with complex international structures may also benefit from specialist cross-border data protection services when conducting transfer assessments, vendor reviews and international privacy compliance exercises. What Should Multinational Companies Do Before 2027? The remaining transition period should be used to build operational readiness. Indian subsidiaries should identify all transfers to parent companies, affiliates and global service providers. Indian companies serving overseas customers should determine whether foreign privacy laws apply alongside Indian requirements. Organisations should also review contracts for cloud services, customer relationship management platforms, payroll systems, marketing technology, analytics tools and outsourced support. A robust compliance programme should be capable of answering five basic questions quickly: what personal data leaves India, why it leaves, where it goes, who can access it and which law permits or restricts the transfer. Maintaining this evidence will become increasingly important as international data governance develops. Where cross border arrangements form part of a broader corporate structure, corporate compliance legal support can help align contractual, regulatory and governance requirements across different business functions. Penalties and Compliance Risk The DPDP Act provides significant financial penalties for certain breaches. The Schedule includes penalties of up to ₹250 crore for specified failures relating to security safeguards, while other categories carry lower maximum amounts. The financial exposure is only one part of the risk. Non compliant transfers can also create contractual disputes, regulatory scrutiny, customer concerns, operational disruption and difficulties during mergers, acquisitions or international due diligence. For this reason, cross border data governance should be treated as part of enterprise risk management rather than as a narrow privacy function. Conclusion Cross border data transfers are becoming a central issue for Indian businesses operating in a global digital economy. India's DPDP framework takes a comparatively permissive approach by allowing international transfers unless particular destinations are restricted. Yet this does not create a simple free transfer regime. Businesses must consider sector specific localisation rules, contractual controls, security safeguards, overseas privacy laws and future government notifications. The distinction between permission to transfer and responsibility to govern the transfer is especially important. With the substantive transfer framework moving towards implementation in 2027, organisations should use the transition period to map international data flows, assess overseas vendors, strengthen contracts and establish clear governance processes. A well documented transfer framework can help businesses support international operations while maintaining compliance with India's evolving data protection landscape. Frequently Asked Questions (FAQs) Q1. Is cross border data transfer allowed under Indian law? Yes. The DPDP Act generally permits transfer of personal data outside India, subject to restrictions which may be imposed by the Central Government and any stricter requirements under other applicable Indian laws. Q2. Does the DPDP Act require all personal data to be stored in India? No. The DPDP Act does not establish a universal data localisation requirement. However, sector specific laws and regulations may impose storage or processing restrictions for particular categories of data. Q3. What is Section 16 of the DPDP Act? Section 16 establishes India's principal statutory framework for transfer of personal data outside India. It permits transfers subject to restrictions which the Central Government may notify. Q4. What is Rule 15 of the DPDP Rules 2025? Rule 15 deals with transfer of personal data outside India and allows such transfers subject to requirements which the Central Government may specify concerning making data available to a foreign State or related entities. Q5. Are Standard Contractual Clauses mandatory under Indian DPDP law? The DPDP Act does not establish GDPR style Standard Contractual Clauses as a general mandatory mechanism for every international transfer. SCCs may nevertheless be required where another applicable privacy law, such as the GDPR, governs the transfer. Q6. Can Indian companies use overseas cloud servers? Generally, yes, subject to the DPDP framework, applicable sector specific requirements, contractual obligations, security requirements and any restrictions notified by the Central Government. Q7. Do sector specific localisation rules still apply? Yes. The DPDP framework does not eliminate stricter requirements imposed by other Indian laws. RBI payment data requirements provide an important example. Q8. When will the main cross border transfer provisions become operational? Section 16 of the DPDP Act and Rule 15 of the DPDP Rules are part of the eighteen month implementation phase and are expected to become operational on 13 May 2027 based on the November 2025 commencement notifications. Q9. Does an overseas vendor become responsible for DPDP compliance? The contractual relationship and statutory allocation of responsibilities must be examined carefully. A Data Fiduciary remains responsible for its obligations under the DPDP framework, while processors should be governed through appropriate contractual and security controls. Q10. What should a business do before transferring personal data abroad? The business should identify the data, purpose, recipient and destination, check applicable Indian and foreign laws, review sector specific restrictions, assess the vendor, establish contractual safeguards and maintain records of the transfer decision.

A strong privacy compliance framework gives an organisation a structured way to manage personal data from collection to deletion. It connects legal requirements with everyday business processes, technology, contracts and employee responsibilities. For Indian organisations, this has become increasingly important following the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The Rules were notified by the Ministry of Electronics and Information Technology in November 2025 and introduced a phased implementation structure. Privacy compliance is no longer simply a matter of publishing a privacy policy. An organisation needs to understand what personal data it collects, why it collects it, where it is stored, who can access it, which third parties receive it and when it should be deleted. A practical framework brings these activities together so privacy becomes part of business operations rather than a document prepared only when a regulatory issue arises. What Is a Privacy Compliance Framework? A privacy compliance framework is an organised system of policies, procedures, controls, responsibilities and monitoring mechanisms used to manage personal data lawfully and responsibly. It should explain how the organisation identifies privacy obligations and converts them into operational controls. The framework normally covers data collection, notices, consent, legitimate uses, data security, access management, retention, deletion, individual rights, grievance handling, vendor management, incident response and internal accountability. The exact structure will depend on the organisation. A technology company processing large volumes of customer information will have different risks from a manufacturer primarily processing employee and supplier information. A healthcare business, financial institution or education provider may also have sector specific obligations. A good framework therefore starts with the organisation's actual data environment rather than copying a generic policy template. Why Organisations Need a Privacy Compliance Framework? Personal data moves through many parts of a modern organisation. Marketing teams may collect information through websites. Sales teams may store customer details in CRM platforms. Human resources departments maintain employee records. Finance teams process payment and tax information. Technology teams operate cloud infrastructure. External vendors may process information on behalf of the organisation. Without central oversight, these activities can develop independently. One department may retain information for years while another deletes it after a few months. A vendor may receive more information than it needs. A website may collect information not mentioned clearly in its privacy notice. A privacy compliance framework provides consistency. It also creates evidence of responsible governance. This becomes particularly important when an organisation needs to demonstrate how it identified risks, implemented controls and responded to an incident. The International Bar Association has noted the importance of a centralised privacy compliance approach in India because the DPDP framework operates alongside sector specific legal requirements. Different sectors may have different retention and operational requirements, making a coordinated framework valuable for organisations with complex data environments. Understand Which Laws Apply to Your Organisation The first step is determining the legal landscape relevant to the organisation. The DPDP Act is central to India's digital personal data regime, but it should not automatically be treated as the only applicable law. An organisation may also need to consider sector specific regulations, contractual obligations, cybersecurity requirements and foreign privacy laws if it processes information relating to individuals in other jurisdictions. The DPDP Act applies to the processing of digital personal data within India in the circumstances specified by the legislation. It can also apply to processing outside India where the processing is connected with offering goods or services to Data Principals in India. Organisations should therefore document their regulatory scope before designing controls. This prevents a common compliance problem where policies are drafted first and legal requirements are considered later. For the latest statutory material, businesses should refer to the Ministry of Electronics and Information Technology's official Act and policy resources. Map Personal Data Across the Organisation Data mapping is one of the most important foundations of a privacy programme. An organisation cannot properly protect information if it does not know where the information exists. The exercise should identify the categories of personal data collected, the source of the information, the purpose of processing, relevant systems, internal users, external processors, storage locations, retention periods and deletion methods. For example, an ecommerce business may collect names, addresses, contact details, transaction information and customer support records. These datasets may move between the website, payment providers, logistics companies, CRM platforms and cloud services. The organisation should document these flows and identify whether each processing activity is necessary for the stated purpose. PwC's analysis of India's DPDP requirements similarly highlights the importance of creating an inventory of applications and data stores and identifying third party processors involved in personal data processing. Data mapping should not be treated as a one time exercise. New software, vendors, products and marketing tools can change the data environment. The map should therefore be reviewed periodically. Establish Clear Data Governance and Accountability A privacy framework needs clearly assigned ownership. Legal, compliance, information security, IT, human resources, procurement, marketing and product teams may all handle personal data. Senior management should define who is responsible for privacy governance and how privacy issues are escalated. The DPDP Act creates specific additional obligations for Significant Data Fiduciaries. These include appointment of a Data Protection Officer, appointment of an independent data auditor and periodic Data Protection Impact Assessments and audits. Not every organisation will fall into the Significant Data Fiduciary category. Even where a statutory DPO is not required, assigning internal responsibility for privacy can make compliance substantially more effective. Governance should also include reporting mechanisms. Management should know about significant privacy risks, unresolved rights requests, major vendor concerns and material security incidents. Build a Clear Notice and Consent Process Consent should be treated as an operational process rather than a checkbox on a website. Under the DPDP framework, organisations need to communicate clearly about the processing of personal data and provide appropriate mechanisms for consent where consent is the relevant ground for processing. The Act also recognises specified legitimate uses in circumstances prescribed by law. Privacy notices should therefore match actual business practices. If a company says it uses information only for account management but later uses the same information for unrelated marketing, the documentation and operational practice may become inconsistent.  Consent records should also be maintained in a manner which allows the organisation to understand when consent was obtained, for which purpose and how withdrawal is handled. For children, additional requirements apply. Section 9 of the DPDP Act provides for verifiable parental or guardian consent before processing a child's personal data, subject to the statutory framework and prescribed exemptions. It also restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exceptions. Implement Data Minimisation and Retention Controls A privacy programme should ask a simple question about every category of personal data: why does the organisation need it? Collecting information without a clear business purpose increases exposure. More data means more systems, access points, vendors and potential consequences if information is compromised. The organisation should define retention periods based on the purpose of processing and applicable legal or contractual obligations. Information should not remain indefinitely simply because storage is inexpensive. Retention schedules should also distinguish between operational data, records subject to statutory retention duties and information which can be securely deleted once its purpose has ended. Deletion should be practical. It may involve databases, backups, email systems, cloud storage, employee devices and third party platforms. Strengthen Security and Incident Response Privacy compliance and cybersecurity are closely connected but they are not identical. Security controls protect information from unauthorised access, loss, alteration or disclosure. Privacy governance also determines whether information should be collected, used or retained in the first place. The DPDP framework requires Data Fiduciaries to implement reasonable security safeguards. Organisations should translate this requirement into practical controls such as access management, authentication, encryption where appropriate, logging, vulnerability management, secure development practices and incident response procedures. An incident response plan should identify who receives an alert, who assesses the incident, who coordinates containment, who manages legal and regulatory reporting and who communicates with affected stakeholders. The DPDP Rules, 2025 introduce specific breach related requirements, making preparedness especially important as the phased framework moves towards full implementation. The official Rules and enforcement timeline are available through MeitY. Manage Vendors and Data Processors Carefully Third party risk is often overlooked when organisations design privacy programmes. A company may have strong internal controls while a vendor handling its customer or employee information operates with weaker safeguards. Vendor management should therefore form part of the privacy framework from procurement through contract termination. Before appointing a vendor, the organisation should understand what personal data the vendor will process, why the information is required, where it will be stored, who may access it and how incidents will be reported. Contracts should clearly establish responsibilities for data handling, security, confidentiality, assistance with rights requests, incident management, deletion and audit or assurance requirements where appropriate. Vendor reviews should also continue during the relationship. A supplier's services, systems or processing locations may change over time. Build Processes for Data Principal Rights The DPDP Act gives Data Principals specific rights relating to their personal data. These include rights concerning access to information, correction and erasure, grievance redressal and nomination, subject to the statutory conditions. A privacy framework should translate these rights into an internal workflow. The organisation needs a method for receiving requests, verifying the requester, identifying relevant records, coordinating with internal teams and responding within the applicable period. The process should also cover cases where information has been shared with processors. A rights request should not fail simply because relevant information is stored across multiple systems. Clear ownership is essential. Employees should know where requests are sent and who is responsible for coordinating the response. Embed Privacy Into Product Development Privacy should be considered before a new product, feature or service goes live. Product teams should ask what personal information a feature requires, whether the information is necessary, what users will be told, who will receive the information and how long it will be retained. Higher risk processing may require more detailed assessment. For Significant Data Fiduciaries, the DPDP Act specifically provides for periodic Data Protection Impact Assessments and audits. Privacy review can also improve product design. Early identification of privacy risks is usually easier and less expensive than changing systems after launch. Train Employees and Create a Privacy Culture Policies cannot protect information if employees do not understand their responsibilities. Training should reflect the roles employees actually perform. Marketing teams may need guidance on consent and communications. HR teams may need stronger controls for employee information. Developers need secure data handling practices. Procurement teams need to identify privacy requirements when selecting vendors. Training should also cover practical scenarios such as phishing, accidental disclosure, unauthorised access, data sharing and incident escalation. Privacy awareness should be refreshed periodically rather than treated as an induction exercise. Monitor, Test and Improve the Framework A privacy compliance framework should evolve with the organisation. Periodic reviews can assess whether privacy notices still reflect actual practices, whether data maps remain accurate, whether vendors continue to meet requirements and whether deletion processes work as intended. Organisations can also maintain internal compliance metrics. Useful indicators may include unresolved rights requests, completion of privacy training, vendor assessment status, overdue remediation actions and the number of systems covered by the data inventory. Framework reviews should also consider regulatory developments. The DPDP Rules were notified in 2025 with an eighteen month phased implementation structure, making regulatory monitoring particularly important during the transition period. Common Mistakes When Building a Privacy Framework One of the biggest mistakes is treating the privacy policy as the entire compliance programme. A policy explains the organisation's approach, but it cannot replace operational controls. Another common problem is incomplete data mapping. Organisations often document customer information while overlooking employee records, marketing databases, customer support platforms, archived files and vendor systems. Some businesses also focus heavily on consent while neglecting security, retention and rights management. Consent is only one component of a broader privacy governance structure. A further mistake is creating procedures without assigning ownership. A process without a responsible person can fail when an urgent request or security incident occurs. Finally, organisations should avoid building a framework once and leaving it unchanged. Business models, technology, vendors and legal requirements evolve. Privacy governance must evolve with them. How Legal Support Can Strengthen Privacy Governance? Privacy compliance often involves questions extending beyond a standard privacy policy. Businesses may need to assess contractual arrangements, interpret statutory requirements, review vendor terms, address cross border processing, structure consent mechanisms or respond to regulatory developments. Engaging privacy compliance services can help an organisation convert legal requirements into practical policies, contracts, procedures and governance controls. The right approach should remain proportionate to the organisation's size, industry, data practices and risk profile. A strong privacy framework also benefits from broader corporate compliance support services, particularly where data protection intersects with employment, technology contracts, consumer protection, intellectual property, cybersecurity or sector specific regulation. The objective is not to create unnecessary paperwork. It is to establish a system where legal requirements are reflected in how the organisation actually handles information. A Practical Roadmap for Building the Framework An organisation starting from scratch can approach the process in stages. Begin by identifying applicable laws and business activities. Then conduct a data discovery and mapping exercise. Assess existing policies, contracts, systems and procedures against the identified requirements. Next, establish governance ownership and prioritise material risks. Update privacy notices, consent mechanisms, retention practices and vendor agreements. Build processes for Data Principal rights and grievance handling. Security controls should then be reviewed alongside incident response procedures. Employee training should follow implementation so employees understand the processes they are expected to follow. Finally, introduce periodic testing and management review. This creates a cycle of assessment, remediation and improvement rather than a one time compliance project. Conclusion A privacy compliance framework should be viewed as an operating system for responsible data governance. It connects legal obligations with people, processes, technology and contracts. For Indian organisations, the DPDP Act, 2023 and DPDP Rules, 2025 provide an important statutory foundation. Yet effective compliance requires more than reading the legislation. Businesses need visibility over their data, clear accountability, appropriate security measures, reliable rights processes, responsible vendor management and regular review. Organisations that build these controls into everyday operations are better placed to manage privacy risk as their products, workforce, customer base and technology environment grow. A practical framework also creates a stronger foundation for responding to regulatory change and demonstrating responsible data governance. Frequently Asked Questions (FAQs) Q1. What is a privacy compliance framework? A privacy compliance framework is a structured system of policies, procedures, responsibilities and controls used to manage personal data in accordance with applicable legal requirements and organisational standards. Q2. Is a privacy policy enough for compliance in India? No. A privacy policy is only one part of a wider privacy programme. Effective compliance also requires appropriate governance, data mapping, security safeguards, consent or other lawful processing mechanisms, retention controls, rights management and vendor oversight. Q3. Does the DPDP Act apply to all businesses in India? The DPDP Act has a defined scope based on the processing of digital personal data and specified circumstances. Organisations should assess their activities and any applicable exemptions rather than assuming the law applies in exactly the same way to every business. Q4. What is data mapping in privacy compliance? Data mapping identifies what personal data an organisation holds, where it comes from, why it is processed, where it moves, who can access it, which third parties receive it and when it should be deleted. Q5. Is a Data Protection Officer mandatory for every company? No. The DPDP Act specifically requires Significant Data Fiduciaries to appoint a Data Protection Officer. Other organisations may still benefit from assigning internal responsibility for privacy governance. Q6. How should businesses manage third party data processors? Businesses should identify what information each processor handles and establish appropriate contractual and operational controls covering security, confidentiality, permitted processing, incident response and deletion. Q7. How often should a privacy compliance framework be reviewed? The framework should be reviewed periodically and whenever there is a significant change in law, technology, business operations, products, vendors or data processing activities. Q8. What should a company do after discovering a privacy gap? The organisation should document the gap, assess its legal and operational significance, identify the responsible owner, establish a remediation plan and track completion. Higher risk issues may require immediate legal or technical intervention.

Data protection is no longer only an IT issue. For Indian companies, it is becoming a core legal, governance and operational responsibility. A practical privacy compliance checklist helps businesses identify what personal data they collect, why they process it, who can access it, how it is protected and when it should be deleted. It also helps management identify gaps before they become regulatory, contractual or reputational problems. India's privacy framework has evolved significantly with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The Rules were notified by the Ministry of Electronics and Information Technology on 14 November 2025 and provide the operational framework for several obligations under the Act. For companies, compliance should therefore be approached as an ongoing business process rather than as a one time policy exercise. What Does Data Protection Compliance Mean for an Indian Company? The DPDP Act regulates the processing of digital personal data. Its objective is to recognise an individual's right to protect personal data while allowing personal data to be processed for lawful purposes. A business may process personal data in many ordinary activities. These include customer onboarding, employee administration, marketing, website analytics, payments, delivery services, customer support and recruitment. The compliance question is therefore broader than whether a company has a privacy policy. A company needs to understand the complete data lifecycle. This includes collection, use, disclosure, storage, access, retention, deletion and handling of individual requests. The following checklist provides a practical framework for conducting this review. Privacy Compliance Checklist for Indian Companies 1. Identify Which Privacy Laws Apply The first step is to determine the legal framework applicable to each processing activity. The DPDP Act is central to India's digital personal data framework. However, businesses may also operate in regulated sectors where additional requirements apply. Financial institutions, healthcare organisations, telecommunications businesses and entities operating digital platforms may need to consider sector specific rules alongside general data protection requirements. Businesses serving customers outside India may also need to examine foreign privacy laws depending on their activities and the jurisdictions involved. A compliance assessment should therefore begin with the question: Which laws apply to each category of personal data and each processing activity?  This prevents businesses from adopting a generic policy which does not reflect their actual legal obligations. 2. Create a Personal Data Inventory A company cannot properly protect data it has not identified. Create an inventory of personal data processed across customer systems, employee records, websites, applications, marketing platforms, cloud services and internal databases. The inventory should identify what information is collected, where it enters the organisation, where it is stored, who uses it, who receives it and how long it remains in the system. It should also record the purpose associated with each major processing activity. Data mapping is one of the most useful foundations for privacy governance because it exposes duplicate databases, unnecessary collection, uncontrolled vendor access and outdated records. International privacy checklists consistently place data mapping near the beginning of the compliance process. 3. Document the Purpose of Processing Every important data collection activity should have a clearly defined business purpose. For example, an online retailer may need a customer's name and delivery address to fulfil an order. A company may need employee bank details to process salary payments. A recruitment platform may need professional information to assess an application. Problems arise when businesses collect information for one purpose and later use it for an unrelated purpose without reviewing the legal basis or transparency requirements. Purpose documentation should therefore be part of product and process design. When a new feature requires additional personal data, the privacy impact should be considered before launch rather than after implementation. 4. Review Consent Mechanisms Where consent is relied upon under the DPDP framework, businesses should ensure the consent mechanism is clear and capable of being demonstrated. Consent should not be buried inside lengthy terms and conditions. Users should understand what they are agreeing to and why their personal data is being processed. Companies should also maintain appropriate records showing how consent was obtained. Withdrawal mechanisms require equal attention. If an individual can provide consent through a simple digital process, withdrawing consent should not become unnecessarily difficult. The privacy compliance checklist should therefore include the consent interface, consent record, withdrawal mechanism and internal process for acting on withdrawal. 5. Update Privacy Notices A privacy notice should describe actual business practices. It should not promise controls or limitations which the company does not follow internally. Businesses should review their websites, applications, registration pages, forms and other collection points to determine whether users receive appropriate information about personal data processing. The notified DPDP Rules provide specific requirements around notices and require information to be presented in a clear and understandable manner. Privacy notices should also be reviewed whenever a company introduces a new product, changes its data practices, adds a new category of personal data or significantly changes its third party arrangements. 6. Review Children's Data Processing Businesses offering services to children require additional attention. Section 9 of the DPDP Act provides additional obligations for processing children's personal data. These include requirements concerning verifiable parental consent and restrictions relating to detrimental processing, tracking, behavioural monitoring and targeted advertising, subject to the statutory framework and applicable exemptions. Companies should therefore determine whether their products are likely to be accessed by children and whether age assurance or parental consent mechanisms may be required. This is especially important for education platforms, gaming services, social applications, children's content platforms and online learning businesses. 7. Establish Reasonable Security Safeguards Privacy compliance cannot be separated from information security. The DPDP Act requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches. A failure to comply with the statutory security obligation can attract a penalty of up to ₹250 crore under the Schedule to the Act. Security controls should be proportionate to the organisation's data environment and risk profile. Companies should examine access controls, authentication, encryption where appropriate, system monitoring, backups, vulnerability management, employee access and vendor security. The review should also consider whether former employees retain access to systems containing personal data. 8. Prepare a Personal Data Breach Response Process A company should know what happens immediately after a suspected data breach. The response process should identify who investigates the incident, who makes legal and regulatory assessments, who communicates with affected individuals where required and who coordinates technical containment. The DPDP Act separately provides for notification obligations concerning personal data breaches. The Schedule provides for penalties of up to ₹200 crore for breach of the obligation concerning notice to the Board or affected Data Principals. A written incident response plan is therefore essential. It should not remain a document sitting in the legal department. IT, security, HR, customer support and senior management should understand their respective roles. 9. Establish a Data Retention and Deletion Framework Keeping personal data forever creates unnecessary risk. Companies should determine how long different categories of information need to be retained and identify the legal or business reason for retention. Some records may need to be retained because of statutory requirements. Others may no longer be necessary once the relevant business purpose has ended. Retention schedules should cover production databases, cloud systems, employee records, email repositories, backups and third party systems where relevant. Deletion should also be tested. A company may believe information has been deleted while copies remain in another system. 10. Review Data Processor and Vendor Relationships Third party service providers can create significant privacy risk. A company may share personal data with cloud providers, payroll processors, customer relationship management platforms, payment service providers, marketing technology companies, analytics providers and outsourced support teams. Businesses should identify each provider and determine what personal data it receives and why. Contracts should clearly allocate privacy and security responsibilities. They should also address confidentiality, security safeguards, incident management, access, deletion and cooperation with the Data Fiduciary. Vendor onboarding should include privacy assessment rather than treating privacy as a matter for procurement alone. 11. Control Internal Access to Personal Data Not every employee needs access to every customer or employee record. Access should be based on business requirements. Companies should regularly review permissions and remove access when an employee changes roles or leaves the organisation. Privileged accounts deserve particular scrutiny because they may provide access to large volumes of personal data. Employee awareness is equally important. Staff should understand phishing risks, password security, unauthorised disclosure, data sharing and incident reporting. A strong privacy programme combines technical controls with clear employee responsibilities. 12. Build a Process for Data Principal Rights The DPDP Act provides rights for Data Principals, including rights relating to access to information about personal data, correction and erasure, grievance redressal and nomination, subject to the Act and applicable conditions. Companies should establish a process for receiving, verifying, assessing and responding to such requests. Customer support teams should know where requests should be routed. The organisation should also be able to locate relevant personal data within its systems. This again demonstrates why data mapping is foundational. A rights process should include response ownership, identity verification, escalation, record keeping and closure. 13. Establish a Grievance Redressal Mechanism A privacy programme should provide a practical route for individuals to raise concerns. The DPDP Act requires Data Fiduciaries to establish an effective mechanism for redressing grievances. The process should be easy to find and internally supported. Companies should maintain records of grievances, their subject matter, investigation and resolution. Repeated complaints may indicate a wider problem with a product, notice, consent process or internal practice. 14. Assess Whether Significant Data Fiduciary Obligations May Apply Some organisations may be notified as Significant Data Fiduciaries based on factors prescribed under the statutory framework. The DPDP Act provides additional obligations for Significant Data Fiduciaries, including requirements concerning appointment of a Data Protection Officer, independent data auditing and periodic impact assessments, subject to the applicable provisions. Businesses with substantial data processing activities should therefore monitor whether they fall within this category. The assessment should be revisited as the organisation grows. 15. Maintain Evidence of Compliance A company should be able to demonstrate how its privacy controls operate. Useful evidence may include data inventories, privacy notices, consent records, vendor agreements, security assessments, employee training records, incident reports, retention schedules and records of rights requests. Documentation is important because compliance is not only about having a policy. It is also about demonstrating implementation. This is particularly valuable during investor due diligence, commercial contracting, regulatory enquiries, internal audits and incident investigations. How Often Should a Privacy Compliance Checklist Be Reviewed? Privacy compliance should be treated as a continuous process. A formal review may be conducted periodically, but companies should also trigger a review when they launch a new product, introduce a new technology, collect a new category of personal data, change vendors, enter a new market, experience a security incident or significantly change their business model. A mature programme links privacy reviews with product development, procurement, information security and legal review. This approach is more effective than conducting a single annual exercise. Common Privacy Compliance Mistakes One common mistake is treating the privacy policy as the entire compliance programme. Another is collecting more personal data than the business actually needs. Some companies also rely on outdated consent language or fail to maintain evidence of consent. Vendor risk is another recurring problem. A company may carefully protect its own systems while giving broad and poorly controlled access to an external provider. Businesses also sometimes overlook employee data, marketing databases, analytics tools and information stored outside their primary business application. The final major mistake is failing to update privacy practices when the business changes. Privacy compliance should evolve with the organisation. How Indian Companies Can Prepare for DPDP Implementation The notified DPDP Rules, 2025 introduce the operational detail required for several provisions of the Act and establish a phased commencement structure. MeitY has published the Rules along with an enforcement timeline and related implementation material. Companies should therefore use the implementation period to identify gaps rather than waiting until every obligation becomes operational. A sensible sequence is to begin with data mapping, processing purposes, privacy notices, consent mechanisms, security controls, vendor contracts, retention, children's data and rights handling. Businesses can then prioritise higher risk processing activities.  This approach allows management to allocate resources based on actual exposure instead of attempting to change every system simultaneously. Companies requiring data protection compliance services may also use a formal readiness assessment to identify legal, contractual, operational and technical gaps before implementing corrective measures. Conclusion A useful privacy compliance checklist should do more than list legal provisions. It should help a company connect law with its actual systems, people, contracts and business processes. For Indian companies, the DPDP Act and the notified DPDP Rules provide the central framework for digital personal data protection. The practical starting point is clear: identify the data, understand the purpose, review the legal basis, improve transparency, control access, secure information, manage vendors, establish retention rules and prepare for individual rights and breach response. Compliance should then be reviewed whenever the business changes. Companies which build privacy into product development, procurement, security and governance are better placed to manage regulatory risk and maintain customer trust. The objective is not simply to tick boxes. It is to create a repeatable system through which personal data is handled responsibly throughout its lifecycle. For organisations seeking broader corporate compliance services, privacy governance can also be integrated with contracts, employment processes, technology arrangements, corporate governance and wider regulatory compliance. Frequently Asked Questions (FAQs) Q1. Is a privacy policy enough for DPDP compliance? No. A privacy policy is only one part of a broader compliance framework. Businesses also need appropriate processes for consent, security, rights handling, grievances, retention, vendors and personal data breach management. Q2. Does every Indian company need to comply with the DPDP Act? The Act applies to processing of digital personal data within its statutory scope. It can also apply to certain processing outside India where it is connected with offering goods or services to Data Principals in India. Businesses should assess their activities against the Act rather than assuming compliance obligations based only on company size. Q3. What is the first step in a privacy compliance assessment? The most practical starting point is a personal data inventory and data flow assessment. A business needs to know what information it processes before it can determine how to protect it. Q4. Does the DPDP Act apply to employee data? Employee information can constitute digital personal data where it relates to an identifiable individual. The business should assess the relevant processing activities and applicable provisions rather than treating employee information as outside the privacy framework. Q5. What are the penalties under the DPDP Act? The Schedule provides for penalties of up to ₹250 crore for failure to observe the obligation to take reasonable security safeguards. Other specified breaches can attract penalties of up to ₹200 crore, ₹150 crore or ₹50 crore depending on the provision involved. Q6. Does the DPDP Act require consent for every type of processing? No. The Act provides for processing based on consent as well as specified legitimate uses. Businesses should identify the appropriate legal basis for each processing activity. Q7. How should businesses handle children's data? Businesses processing children's personal data need to consider the additional obligations under section 9, including requirements relating to verifiable parental consent and restrictions on specified forms of processing. Q8. Should startups follow the same privacy framework as large companies? The core legal obligations should be assessed based on the processing activities and applicable statutory requirements. A startup may have a smaller data environment, but a business processing children's data, financial information or large volumes of customer information may still face significant privacy risks.

For businesses operating in India, understanding the difference between personal data and sensitive personal data is important for building an effective privacy compliance framework. However, the legal position in India requires some care because the terminology used under the older Information Technology Rules, 2011 is different from the terminology used under the Digital Personal Data Protection Act, 2023. The DPDP Act does not create a separate statutory category called sensitive personal data. The distinction remains relevant during the transition because the Information Technology framework continues to govern specified processing activities until the relevant DPDP provisions take effect. This distinction is important for companies handling financial information, health records, biometric information, passwords, employee information, customer records or other data capable of identifying individuals. What Is Personal Data Under Indian Privacy Law? The DPDP Act uses the expression “personal data” rather than maintaining the older distinction between ordinary personal information and sensitive personal data. Personal data broadly means any data about an individual who is identifiable by or in relation to such data. The Act applies to digital personal data within its statutory scope. It can also apply to processing outside India where the processing relates to offering goods or services to Data Principals in India, subject to the Act's conditions. This means personal data can cover a wide range of information. A person's name, mobile number, email address, customer identification number, photograph, location information or online account details may all constitute personal data where the individual can be identified. The important point is simple: personal data is defined primarily by identifiability, not by whether the information appears commercially or socially sensitive. What Was Sensitive Personal Data Under the Earlier Framework? The expression sensitive personal data or information comes from the Information Technology Rules, 2011, made under section 43A of the Information Technology Act, 2000. Rule 3 identified specific categories of sensitive personal data or information. These included passwords, financial information such as bank account and payment instrument details, physical, physiological and mental health information, sexual orientation, medical records and history, and biometric information. The Rules also covered certain information relating to these categories when provided for services or received for processing. The framework imposed additional requirements concerning collection, consent, disclosure, retention, security and grievance handling.Businesses therefore need to distinguish between the historical SPDI framework and the new DPDP framework when reviewing older privacy documents. Does the DPDP Act Recognise Sensitive Personal Data? No. This is one of the most important points for businesses to understand. The DPDP Act, 2023 does not establish a separate statutory category called “sensitive personal data”. Its central concept is personal data. This does not mean information such as financial records, health information or biometric information has become unimportant from a privacy and risk perspective. Instead, the DPDP framework approaches heightened obligations differently. Additional requirements can arise from factors such as the nature of the Data Fiduciary, the processing of children's data, security obligations and other provisions under the Act and Rules. Therefore, a business should not simply transfer the old SPDI classification system into its DPDP compliance programme. Personal Data vs Sensitive Personal Data: The Practical Difference Under the older framework, the distinction was relatively direct. Personal information could fall within the broader definition of information capable of identifying an individual. Certain specified categories were separately classified as sensitive personal data or information. The SPDI Rules then imposed additional requirements for those specified categories. Under the DPDP Act, the approach is different. Personal data is the principal statutory category. For example, a person's name and mobile number may be personal data. A bank account number can also be personal data. A medical record can be personal data. Biometric information can be personal data. The DPDP Act does not place the latter categories into a separate statutory class called sensitive personal data. For compliance teams, the practical lesson is important: do not assume a category based on its sensitivity alone. First identify whether the information is personal data and then determine which provisions of the applicable legal framework govern the processing. Why the Older SPDI Rules Still Matter During the Transition The transition period makes the legal position more nuanced. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. They use a phased commencement structure. Rules 1, 2 and 17 to 21 came into force upon publication. Rule 4 takes effect one year after publication. Rules 3, 5 to 16, 22 and 23 take effect eighteen months after publication. The Government has also expressly stated that during the eighteen month implementation period, data protection continues to be governed by the Information Technology SPDI Rules, 2011 for relevant processing. This creates an important compliance window for businesses. A company should not discard its existing SPDI controls merely because the DPDP Act does not use the term sensitive personal data. At the same time, it should not assume the old framework represents the final compliance position. Businesses should prepare for the transition while maintaining the obligations currently applicable to their processing activities. How Consent Requirements Differ in Practice The SPDI Rules contain specific consent requirements for collecting sensitive personal data or information. Rule 5 requires consent regarding the purpose of use before collection and requires collection to be connected with a lawful purpose and considered necessary for that purpose. The DPDP Act takes a different approach to consent. Where consent is relied upon, it must be free, specific, informed and unambiguous, with a clear affirmative action. The Data Principal should also be able to withdraw consent. The DPDP Rules, 2025 provide further requirements concerning privacy notices and mechanisms for exercising rights and withdrawing consent. The notified Rules require notices to provide clear information about the personal data being processed and the purposes involved. Therefore, businesses should review existing consent forms rather than simply retaining language prepared under the SPDI framework. Financial Information Requires Careful Handling Financial information deserves particular attention because it was expressly included within the SPDI definition under the 2011 Rules. Bank account information, credit card details, debit card details and other payment instrument information were included within the specified category. Under the DPDP Act, such information remains personal data where it relates to an identifiable individual. The absence of a separate sensitive data category under the DPDP Act does not make financial information low risk. A payment platform, lender, fintech business or e commerce company should still consider strong access controls, appropriate security safeguards, vendor oversight, retention practices and clear processing purposes. Health and Medical Information Health information also requires careful treatment. Medical records, medical history and health conditions were expressly included within the SPDI Rules. Under the DPDP framework, health information can fall within personal data where it identifies or relates to an individual. Businesses processing health information may also be subject to sector specific requirements beyond general privacy law. Hospitals, diagnostic providers, health technology companies and employee health benefit providers should therefore consider the wider regulatory environment rather than relying solely on the DPDP Act. Biometric Information and Identity Data Biometric information was another category expressly identified under the SPDI Rules. Fingerprints, facial patterns, iris information and other biometric characteristics can have serious security implications because a compromised biometric identifier cannot be replaced as easily as a password. Although the DPDP Act does not create a separate sensitive personal data category, businesses using biometric systems should conduct careful privacy and security assessments. The same applies to businesses using identity verification technologies, facial recognition systems or biometric authentication. Children's Data Is Treated Differently Under the DPDP Framework The DPDP Act does create special rules for children's personal data. Section 9 requires a Data Fiduciary to obtain verifiable consent of the parent before processing personal data of a child, subject to the statutory framework. The Act also restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to specified provisions and exemptions. This is a useful example of how the DPDP framework approaches heightened protection. The additional obligation arises because of who the data relates to, rather than because children's data is categorised as sensitive personal data. Security Obligations Apply Beyond Sensitive Information A common misunderstanding is to assume enhanced security is required only for information traditionally classified as sensitive. Businesses should avoid this approach. Section 8 of the DPDP Act places responsibility on Data Fiduciaries to comply with the Act and rules in respect of processing carried out by them or on their behalf. The framework also requires reasonable security safeguards to prevent personal data breaches. The security programme should therefore reflect the volume and nature of personal data, the processing environment, technology risks and consequences of unauthorised access. A company should not wait for a separate sensitive data classification before strengthening security. What Businesses Should Do During the Transition Businesses should begin by creating a clear data inventory. The inventory should identify what personal data is collected, where it originates, why it is processed, who can access it, which vendors receive it and how long it is retained. Next, the business should identify information previously treated as SPDI. Financial information, health records, biometric information and other categories covered by the 2011 Rules deserve particular review. Existing privacy policies, consent mechanisms, vendor contracts and security controls should then be compared against the DPDP framework. This exercise can reveal provisions written using outdated terminology or controls which may not satisfy future requirements. Businesses seeking data privacy legal services can use this transition period to conduct a structured legal and operational review rather than waiting until the complete DPDP framework becomes applicable. How Businesses Should Update Their Privacy Policies A privacy policy should accurately describe the organisation's present processing activities. It should not automatically label certain information as “sensitive personal data” under the DPDP Act because the Act does not use this classification. Where older policies contain SPDI terminology, businesses should assess whether the terminology remains relevant because of currently applicable transitional requirements or whether the document should be revised. The policy should also align with actual business operations. If a company collects location information, uses analytics tools, shares information with processors or processes children's data, its documentation should reflect those activities accurately. The Role of Contracts With Data Processors Businesses often share personal data with external service providers. Cloud hosting providers, payroll platforms, customer relationship systems, marketing platforms, payment processors and analytics providers may all process personal data on behalf of an organisation. The legal agreement should clearly address responsibilities, security measures, confidentiality, incident handling, access and deletion requirements. This becomes particularly important where information previously classified as SPDI is involved. A business should also know whether its vendor receives the information for its own purposes or processes it on behalf of the business. The legal consequences can differ considerably. Common Mistakes Businesses Should Avoid One common mistake is assuming every piece of important information is automatically “sensitive personal data” under current Indian law. Another is assuming the absence of a sensitive category under the DPDP Act means financial, health or biometric information requires no special attention. Businesses also sometimes copy old SPDI provisions into new privacy policies without checking whether they align with the DPDP framework. Another problem is maintaining a privacy policy which does not reflect actual data flows. Finally, some organisations focus on consent while overlooking security, retention, vendor management and rights handling. A sound privacy programme should address all of these areas together. Conclusion The phrase sensitive personal data remains important in India's privacy landscape, but its legal meaning needs to be understood in context. The Information Technology SPDI Rules, 2011 expressly created a category of sensitive personal data or information and imposed additional obligations around collection, consent, disclosure, retention and security. The DPDP Act, 2023 takes a different approach. It does not create a separate sensitive personal data category. Instead, it establishes a broader personal data framework and introduces specific obligations based on factors such as processing activities, children's data, security and the status of certain Data Fiduciaries. For businesses, the practical approach is to avoid treating the two frameworks as interchangeable. Existing SPDI obligations should be respected during the transition, while privacy programmes should simultaneously be prepared for the DPDP regime. A careful review of data inventories, consent mechanisms, privacy notices, security controls, vendor contracts and retention practices can help businesses move from the older terminology to the new framework without creating compliance gaps. India's privacy regime is evolving. Businesses should therefore rely on the notified legislation and Rules, rather than outdated descriptions of sensitive personal data, when designing their compliance strategy. Frequently Asked Questions (FAQs) Q1. What is the difference between personal data and sensitive personal data? Under the older SPDI framework, sensitive personal data or information was a defined subset of personal information covering specified categories such as financial information, health information, medical records, passwords and biometrics. The DPDP Act, 2023 does not create a separate statutory category called sensitive personal data. Q2. Does the DPDP Act classify health information as sensitive personal data? No. Health information can constitute personal data under the DPDP Act, but the Act does not classify it separately as sensitive personal data. Q3. Is financial information still protected under Indian privacy law? Yes. Financial information relating to an identifiable individual can constitute personal data. During the transition period, relevant SPDI requirements also remain important for covered entities. Q4. Are biometric details covered by the DPDP Act? Biometric information can constitute personal data where it relates to an identifiable individual. The DPDP Act does not create a separate statutory category called sensitive personal data. Q5. Are children's data and sensitive personal data the same? No. Children's data receives specific protection under section 9 of the DPDP Act because of the age of the Data Principal. It is not treated as a separate sensitive personal data category. Q6. Are the SPDI Rules, 2011 still relevant? Yes, during the transition period. The Government has stated that data protection continues to be governed by the SPDI framework during the eighteen month period provided for implementation of relevant DPDP provisions. Q7. Should companies remove the term sensitive personal data from their privacy policies? Not automatically. Businesses should first assess whether their existing policies refer to the SPDI Rules, which remain relevant during the transition. They should then update the documents so the terminology accurately reflects both current and future legal requirements. Q8. Does personal data always require consent? No. The DPDP Act provides for processing based on consent and specified legitimate uses. Businesses should identify the appropriate statutory basis for each processing activity. Q9. Should businesses consult a lawyer when updating their privacy framework? Businesses with substantial personal data processing, complex vendor relationships, children's data, health or financial information, biometric systems or international operations may benefit from specialist legal review. Legal advice can help reconcile the transitional SPDI requirements with the DPDP framework.