Data protection compliance in India is an important consideration for international companies serving Indian customers, employing local staff, establishing Indian subsidiaries or using Indian service providers. As business operations become increasingly digital, organisations must understand how Indian privacy laws interact with their existing global compliance programmes. A policy designed for Europe or the United States may provide a useful starting point, but it does not automatically satisfy Indian legal requirements. India’s Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025, introduces a dedicated framework for processing digital personal data. International businesses should assess its territorial scope, consent requirements, security obligations, cross border transfers and phased implementation timeline. Early preparation can reduce legal uncertainty and help organisations maintain consistent privacy standards across jurisdictions. Does Indian Data Protection Law Apply to Foreign Companies? The DPDP Act applies to digital personal data processed within India. It can also apply to processing outside India when the processing is connected with offering goods or services to individuals in India. A foreign company does not necessarily need a physical office in the country for its activities to fall within the Act’s scope. For example, an overseas ecommerce platform selling directly to Indian customers, a global application collecting information from users in India or an international company processing Indian customer records through a central database may need to assess its obligations under the Indian framework. The precise position depends on the activities and circumstances involved. The Act generally covers personal data in digital form, including information collected offline and subsequently digitised. Purely offline personal data which is never digitised falls outside its scope, subject to the Act’s provisions and other applicable laws. Businesses should therefore map their data processing activities rather than assume every operation is covered in the same way. Understanding India’s DPDP Act and Rules The DPDP Act establishes obligations for Data Fiduciaries, the entities which determine the purpose and means of processing personal data. Data Processors handle personal data on behalf of a Data Fiduciary. An international group may occupy different roles across its operations, so these roles should be assessed for each processing activity. The framework addresses transparency, consent, specified legitimate uses, reasonable security safeguards, personal data breach notifications and individual rights. It also provides for enhanced responsibilities for Significant Data Fiduciaries and financial penalties for specified breaches. The Digital Personal Data Protection Rules, 2025 were notified in November 2025. However, implementation is phased. As of October 2026, businesses must distinguish provisions already in force from substantive operational requirements scheduled to commence in May 2027. The Government of India’s official explanation of the DPDP Rules provides background on the framework and its implementation. International companies should maintain a commencement tracker and assign responsibility for preparing each requirement. Treating every provision as already operational may create confusion, while waiting until the final implementation date can leave insufficient time for system and contract changes. Key Compliance Obligations for International Businesses 1. Review Consent and Privacy Notices A central compliance task is to ensure personal data is collected and used under a valid basis recognised by the Indian framework. Consent is important, but the Act also recognises specified legitimate uses. Companies should not assume the broader lawful bases available under other privacy laws automatically justify processing in India. Privacy notices should explain the personal data being collected and the purposes for which it will be used in clear, accessible language. Businesses should review website forms, mobile applications, employee notices, marketing subscriptions and customer onboarding processes. Where consent is relied upon, the organisation should maintain a reliable record and provide appropriate mechanisms for managing or withdrawing it. 2. Protect Customer and Employee Data International businesses often process Indian customer information, recruitment records, payroll details and employee performance data through shared global systems. Access should be limited to people who need the information for authorised purposes, and appropriate safeguards should be applied to storage, transmission and use. Practical measures include access controls, encryption where appropriate, secure authentication, monitoring, backup arrangements and staff training. Organisations should also review how personal information is used by analytics platforms, artificial intelligence tools and external service providers. A global security certification may support a compliance programme, but it does not by itself establish compliance with Indian law. Companies need to assess their actual processing activities, applicable legal obligations and the effectiveness of their controls. 3. Prepare for Personal Data Breaches A data breach can trigger legal, regulatory, contractual and reputational consequences. International groups should establish a response process covering detection, containment, evidence preservation, impact assessment, internal escalation and required notifications. Indian requirements must be assessed alongside other applicable reporting duties. CERT In directions, for example, require specified cyber incidents to be reported within six hours of noticing them or being informed of them, for entities and incidents within scope. The DPDP framework introduces separate personal data breach obligations, with substantive operational provisions subject to phased commencement. A multinational company may also have contractual duties to notify a global customer or parent company within a shorter period. A single incident response plan should identify each applicable deadline, responsible decision maker and reporting channel. 4. Manage Cross Border Data Transfers International companies frequently transfer personal data between India, regional offices, global headquarters and cloud service providers. The DPDP Act does not impose a universal requirement to store all personal data in India. Instead, Section 16 provides a framework under which the Central Government may restrict transfers to specified countries or territories, while preserving stricter requirements under other applicable Indian laws. This means companies must assess the relevant transfer restrictions rather than assume either unrestricted transfers or blanket localisation. Sector specific requirements, contractual commitments and foreign privacy laws may impose additional conditions. For example, regulated financial services may have separate rules governing particular records or systems. A transfer review should identify the data involved, recipient entities, processing purpose, storage locations, onward transfers and applicable restrictions. Contracts and vendor assessments should reflect the findings. 5. Review Vendor and Intra Group Agreements A multinational group may share services across several jurisdictions, including human resources, customer support, finance, cybersecurity and cloud hosting. These arrangements need clear documentation of each party’s responsibilities and the permitted use of personal data. Legal and procurement teams should review confidentiality obligations, security measures, incident notification, subcontracting, access controls, data retention, deletion and cooperation with regulatory requests. Intra group data sharing should be assessed with the same care as transfers to external suppliers. Companies seeking advice from data protection advocates can use legal reviews to identify gaps between their existing global contracts and Indian requirements. The objective is to establish enforceable responsibilities and workable processes, not merely add generic privacy clauses to every agreement. DPDP Act and GDPR: Why One Global Policy May Not Be Enough Companies already complying with the European Union’s General Data Protection Regulation may have mature privacy notices, records of processing, security controls and vendor management procedures. These resources can help with Indian compliance, but the two regimes are not interchangeable. The GDPR provides several lawful bases for processing, including legitimate interests, while the DPDP Act uses consent and specified legitimate uses within its own framework. The laws also differ in their treatment of territorial scope, individual rights, children’s data, organisational duties and international transfers. For example, the DPDP Act generally treats a child as an individual under 18 and establishes specific requirements for processing children’s personal data, subject to applicable statutory exceptions and exemptions. A global platform designed around a different age threshold may need to review its Indian user journey. International businesses should maintain a common global privacy standard where practical, supported by a country specific assessment for India. This approach preserves consistency while allowing local legal requirements to be addressed accurately. Practical Steps for Building an India Compliance Programme A useful starting point is a data inventory covering customer, employee, supplier and website information. The business should identify which legal entities determine processing purposes, which service providers process data, where information moves and which retention periods apply.The next step is a gap assessment against current Indian obligations and requirements scheduled for future commencement. Findings should be converted into a prioritised plan covering notices, consent processes, security controls, contracts, individual request handling and incident response. Ownership should be assigned to legal, compliance, IT, HR and procurement teams. Businesses should also maintain records of decisions, conduct periodic vendor reviews, train relevant staff and test incident response procedures. Working with a corporate law firm may help international groups coordinate Indian privacy requirements with technology contracts, commercial arrangements, cybersecurity obligations and wider corporate governance. Conclusion Data protection compliance in India requires international companies to understand how their operations, data flows and existing global policies interact with Indian law. The DPDP Act and Rules create a distinct framework, so organisations should not assume GDPR compliance alone is sufficient or presume all personal data must be stored locally.By mapping data, reviewing notices and contracts, assessing cross border transfers, strengthening security and preparing for phased implementation, international businesses can reduce legal uncertainty and improve operational readiness. Regular legal and technical reviews will help ensure their privacy programme remains aligned with changing business activities and applicable requirements. Frequently Asked Questions (FAQs) Q1. Does the DPDP Act apply to foreign companies without an office in India? It may. The Act can apply to processing outside India when it is connected with offering goods or services to individuals in India. Applicability depends on the company’s activities and the statutory scope. Q2. Is GDPR compliance enough for operating in India? No. GDPR compliance can provide a strong foundation, but India has distinct rules on lawful processing, notices, children’s data, individual rights and other obligations. Businesses should conduct a separate Indian compliance assessment. Q3. Does India require all personal data to be stored within the country? No. The DPDP Act does not create a blanket localisation requirement for all personal data. However, government restrictions, sector specific rules and other applicable laws may limit particular transfers or require certain records to be stored locally. Q4. When do the main DPDP compliance requirements commence? The framework has a phased commencement schedule. Many substantive operational requirements are scheduled to commence in May 2027. Businesses should check the official notifications and identify the effective date of each provision relevant to their operations. Q5. What penalties can apply for DPDP Act violations? The Act provides for financial penalties depending on the type of contravention. The maximum penalty for failure to take reasonable security safeguards to prevent a personal data breach can reach ₹250 crore. The applicable provision and circumstances determine the potential exposure. Q6. What should an international company do first to prepare for Indian data protection compliance? It should map personal data, assess whether the Act applies, identify current and upcoming obligations, review privacy notices and vendor agreements, assess cross border transfers, and establish a documented breach response process. A prioritised implementation plan can then address identified gaps.

Data protection lawyers for businesses help organisations understand privacy laws, manage personal information responsibly and reduce the legal risks associated with collecting, storing, using and sharing data. As companies increasingly rely on digital platforms, customer databases, cloud services and third party providers, data protection has become an essential part of business governance. A privacy issue can lead to regulatory scrutiny, contractual disputes, financial losses and damage to customer trust. In India, the evolving data protection framework makes early legal guidance particularly valuable. Businesses need to understand their current obligations, prepare for upcoming regulatory requirements and build processes employees can follow in practice. Data protection lawyers support this work by translating legal rules into clear policies, contracts, risk assessments and incident response procedures. Why Data Protection Is a Legal Priority for Businesses? Personal information is used across nearly every business function. Sales teams manage customer details, human resources departments process employee records, finance teams handle payment information, and digital platforms collect information through websites and applications. Each activity can create legal risks if information is collected without an appropriate basis, used for an undisclosed purpose, retained unnecessarily or shared without suitable safeguards. A data breach is only one possible source of liability. Businesses may also face complaints about misleading privacy notices, inappropriate marketing, weak vendor controls, excessive employee monitoring or failure to respond properly to requests concerning personal information. Poor documentation can make it difficult to demonstrate how a decision was reached or whether the organisation followed its own procedures.  Data protection lawyers help identify these risks before they develop into disputes. Their role is not limited to interpreting legislation. They also help management understand how legal requirements affect commercial decisions, technology projects, employment practices and customer relationships. Understanding India’s Data Protection Legal Framework 1. Digital Personal Data Protection Act, 2023 The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in India. It sets out obligations for Data Fiduciaries, provisions relating to individual rights, safeguards for personal data and consequences for non compliance. The Digital Personal Data Protection Rules, 2025 provide further detail on how key requirements are intended to operate. The framework is being implemented in phases. As of October 2026, some institutional and preliminary provisions are in force, while many substantive operational duties are scheduled to commence on 13 May 2027. Businesses should therefore distinguish between requirements already effective and those requiring advance preparation. The official DPDP Act commencement notification and implementation timeline provides the legal basis for these dates. Data protection lawyers can help businesses assess which provisions currently apply, identify future obligations and prepare an implementation plan. This may involve reviewing privacy notices, consent mechanisms, internal responsibilities, data retention practices, individual request procedures and arrangements with service providers. 2. Information Technology Act and CERT In Directions The Information Technology Act, 2000 and applicable rules remain relevant to cybersecurity and information handling. CERT In, India’s national cyber incident response agency, has issued directions under Section 70B of the Act. These include reporting specified cyber incidents within six hours of noticing them or being informed of them, alongside requirements concerning system logs and other cybersecurity practices for entities within scope. A business may have to consider cybersecurity reporting obligations even where an incident does not involve personal data. Legal advisers can help identify the relevant reporting route, coordinate with technical teams and ensure deadlines are not overlooked. The applicable directions and clarifications are available on the official CERT In website. Depending on the industry, businesses may also need to consider sector specific rules, contractual commitments and foreign privacy laws. A company serving international customers may have obligations beyond the Indian framework, depending on its activities and the laws applicable to those activities. How Data Protection Lawyers Reduce Business Legal Risks? 1. Identifying Legal Risks Through Data Mapping Businesses cannot manage data protection risks effectively without understanding what information they hold and how it moves through the organisation. Legal advisers help map personal data across customer onboarding, marketing, employee management, payments, analytics and third party services. The assessment considers why information is collected, who can access it, where it is stored, how it is shared and when it should be deleted. It can reveal unnecessary data collection, unclear responsibilities, excessive access permissions and gaps in vendor arrangements. The findings help businesses prioritise improvements based on legal exposure and practical risk. 2. Drafting Privacy Policies and Notices Privacy notices explain how an organisation handles personal information. If the notice is vague, incomplete or inconsistent with actual practices, customers may be misled and the business may struggle to demonstrate responsible data handling. Data protection lawyers help draft notices which accurately reflect the organisation’s activities and applicable legal requirements. They can also review website forms, app permissions, cookie notices, employee privacy statements and marketing communications. The objective is to ensure disclosures are understandable, relevant and consistent with how information is actually processed. A policy alone does not establish compliance. Employees and systems must follow the documented approach, and the organisation should update its notices when its data practices materially change. 3. Reviewing Contracts With Vendors and Business Partners Many businesses rely on cloud providers, payroll platforms, customer relationship management systems, marketing agencies and outsourced support teams. These arrangements can create uncertainty over security responsibilities, permitted data use, breach notifications and deletion of information when a contract ends. Lawyers help review service agreements and data processing terms to define each party’s responsibilities. Relevant provisions may cover confidentiality, access controls, security safeguards, incident notification, subcontracting, audit cooperation, data transfers and return or deletion of records. Clear terms reduce the risk of disputes and help the business respond more effectively when a vendor fails to meet its obligations. 4. Preparing for Data Breaches and Regulatory Investigations A suspected breach often requires rapid coordination between IT, management, communications teams and legal advisers. Organisations must establish what happened, which information may be affected, whether systems remain compromised and which notifications may be required. Legal advisers help interpret applicable reporting duties, preserve relevant evidence and document decisions. They can also assist with communications to regulators, affected individuals, customers and contractual partners where appropriate. A prepared response plan reduces the risk of missed deadlines, inconsistent statements and avoidable delays. Businesses should not wait for an incident before establishing these procedures. Regular exercises help confirm whether staff know how to escalate a problem and whether decision makers can access the information needed to respond. 5. Supporting Employee Data and Workplace Compliance Employee information may include identity documents, salary details, performance records, health related information and access logs. Collecting or sharing such information without appropriate safeguards can create privacy concerns and employment disputes. Lawyers help review employee notices, monitoring policies, recruitment procedures, background checks and record retention practices. They can also advise on access restrictions and internal processes for handling complaints. The approach should balance legitimate business needs with applicable privacy requirements and employee expectations. 6. Managing Data Retention and Deletion Keeping information indefinitely increases exposure if systems are compromised or records are used inappropriately. However, deleting records too early can also create legal problems where tax, corporate, employment or litigation requirements call for continued retention. Data protection lawyers help develop retention schedules based on the type of information, its purpose and applicable legal obligations. They also advise on legal holds, secure deletion, backup systems and responsibilities when a vendor relationship ends. A documented schedule helps avoid both unnecessary retention and premature destruction of important records. 7. Assessing New Technology and Business Projects New applications, artificial intelligence tools, analytics platforms and digital marketing systems may introduce privacy risks before a product reaches customers. Personal information entered into an external AI tool, for example, may be processed under terms the business has not reviewed. Legal advisers can assess proposed uses of data, review supplier terms and identify issues involving transparency, access, retention, confidentiality and transfers. Businesses seeking guidance from data privacy lawyers can use this review to build privacy considerations into product development and procurement decisions rather than trying to resolve problems after launch. When Should a Business Consult a Data Protection Lawyer? Legal support is useful when a business launches a new website or application, expands into a new market, introduces AI tools, changes its marketing practices, appoints a new data processor or experiences a suspected breach. It is also valuable when responding to a customer complaint, negotiating a contract involving personal information or preparing for upcoming legal requirements.Smaller businesses may not need a full time privacy legal team. They can still benefit from periodic reviews, clear internal responsibilities and access to specialist advice when a significant risk arises. Businesses working with technology corporate lawyers can also align privacy requirements with technology contracts, commercial transactions, intellectual property concerns and wider corporate governance. Practical Steps to Reduce Data Protection Risks Businesses should begin by creating an inventory of the personal information they hold and identifying the legal requirements relevant to each activity. They should review privacy notices, restrict access to sensitive records, establish retention schedules and assess third party providers. Staff training should explain how to handle personal information and report suspected incidents. Management should assign responsibility for privacy compliance and review progress periodically. Legal and technical teams should work together because a policy cannot compensate for weak security, while technical controls cannot resolve every issue involving lawful processing, transparency or contractual responsibility. Records of assessments, training, decisions and incident responses can help demonstrate a consistent compliance approach. Conclusion Data protection lawyers help businesses reduce legal risks by identifying gaps in data handling, interpreting applicable laws, reviewing contracts and preparing organisations for privacy complaints or security incidents. Their involvement can support better decisions throughout the data lifecycle, from collecting information to retaining, sharing and deleting it. For Indian businesses, a practical approach involves understanding the phased DPDP framework, complying with applicable cybersecurity requirements and building reliable internal processes. Early legal advice can help organisations prepare for regulatory change, protect customer trust and reduce avoidable disputes. Regular reviews are essential because business models, technology and legal requirements continue to evolve. Frequently Asked Questions (FAQs) Q1. What do data protection lawyers do for businesses? They advise businesses on privacy laws, data handling practices, privacy notices, vendor contracts, data retention, individual requests and breach response. They also help identify compliance gaps and develop practical procedures to manage legal risks. Q2. Why does a small business need data protection legal advice? Small businesses often collect customer, employee and supplier information even without operating a technology focused business. Legal advice can help them understand relevant obligations, establish appropriate policies, review vendors and avoid preventable compliance problems. Q3. What laws should Indian businesses consider for data protection? Relevant frameworks include the Digital Personal Data Protection Act, 2023 and its Rules as they commence, the Information Technology Act, 2000, applicable CERT In directions and any sector specific or contractual requirements. Businesses should verify which provisions are effective for their circumstances. Q4. Can data protection lawyers help after a data breach? Yes. They can help identify applicable reporting obligations, coordinate with technical responders, preserve evidence, review communications and advise on regulatory or contractual exposure. The business should also take immediate technical steps to contain the incident. Q5. When should a company review its privacy policies? A review is appropriate when the business changes its data collection practices, launches a new product, adopts new technology, enters a new market, appoints a new service provider or becomes subject to new legal requirements. Periodic reviews can also identify outdated disclosures and procedures. Q6. How can businesses prepare for the DPDP framework? Businesses can map personal data, assess gaps, review notices and contracts, define responsibilities, establish breach response procedures and train employees. They should also track commencement notifications and distinguish current legal duties from requirements scheduled to take effect later.

Cybersecurity and data protection are closely connected, but they serve different purposes. Cybersecurity protects systems, networks and information from unauthorised access, disruption, alteration or destruction. Data protection governs how personal information is collected, used, stored, shared and deleted. Together, cybersecurity and data protection help businesses protect sensitive information, meet legal obligations and maintain the trust of customers, employees and business partners. For businesses in India, the connection has become increasingly important as digital operations expand and cyber threats grow more sophisticated. A ransomware attack, data leak or compromised employee account may create technical, financial, contractual and regulatory consequences. Understanding the applicable legal framework helps organisations move beyond reactive security measures towards a structured approach to risk management and accountability. What Is the Difference Between Cybersecurity and Data Protection? Cybersecurity focuses on protecting digital assets against threats. Common measures include encryption, access controls, network monitoring, multi factor authentication, secure software development, vulnerability management and incident response. Its primary concern is preventing or managing unauthorised activity involving systems and information. Data protection focuses on the rights of individuals and the responsible handling of personal information. It considers whether an organisation has a lawful basis to process data, whether the collection is necessary, who can access the information, how long it should be retained and when it must be erased. The National Institute of Standards and Technology’s explanation of the relationship between cybersecurity and privacy explains how these disciplines overlap while addressing distinct risks. A business can have strong cybersecurity and still mishandle personal data. For example, a company may encrypt its customer database but use the information for purposes which were never properly disclosed. Conversely, a business may publish a comprehensive privacy policy but leave its database exposed through weak access controls. Effective compliance requires both secure systems and responsible data governance. The Legal Framework for Cybersecurity and Data Protection in India 1. The Information Technology Act, 2000 The Information Technology Act, 2000 remains a key part of India’s cyber law framework. Section 43 addresses specified unauthorised acts involving computer systems, while Section 66 deals with certain acts described under Section 43 when committed dishonestly or fraudulently. Section 66C concerns identity theft, and Section 66D addresses cheating by personation using computer resources. Section 43A historically provided for compensation in specified circumstances involving failure by a body corporate to maintain reasonable security practices while handling sensitive personal data or information. However, the legal position must be read alongside subsequent data protection legislation and commencement notifications. Businesses should not assume older provisions operate unchanged or in isolation from the newer framework. 2. The Digital Personal Data Protection Act, 2023 The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in India. It places obligations on Data Fiduciaries, including responsibility for implementing appropriate technical and organisational measures to protect personal data. It also addresses personal data breach notifications, individual rights and accountability. The Act and the Digital Personal Data Protection Rules, 2025 were introduced with a phased commencement schedule. As of October 2026, organisations must distinguish provisions already in force from substantive obligations scheduled for later commencement. Many core operational requirements under the Rules are scheduled to commence 18 months after notification, in May 2027. Businesses should consult the Ministry of Electronics and Information Technology’s official DPDP Rules and enforcement timeline before treating a future requirement as an existing legal duty. The practical lesson is clear: businesses should prepare their systems and policies in advance while accurately identifying which legal provisions apply at the relevant time. 3. CERT-In Cybersecurity Directions The Indian Computer Emergency Response Team, or CERT-In, operates under Section 70B of the Information Technology Act. Its directions issued in April 2022 impose specific cybersecurity requirements on entities within their scope. These include reporting specified cyber incidents within six hours of noticing them or being informed of them, maintaining logs of ICT systems for a rolling period of 180 days within Indian jurisdiction, and meeting applicable requirements concerning time synchronisation and records. The reporting obligation is particularly important because the response team may not have all the facts within six hours. CERT-In guidance permits organisations to report the information available within the required period and provide further details later. Businesses should establish escalation procedures so employees do not delay reporting while waiting for a complete forensic investigation. The applicable directions and FAQs are available on the official CERT-In directions. Sector specific rules, regulatory directions and contractual requirements may create additional obligations for organisations operating in financial services, telecommunications, healthcare and other regulated industries. Why Cybersecurity Is Essential for Legal Compliance? 1. Protecting Personal and Confidential Information Businesses routinely process names, contact details, identity records, payment information, employee files, customer communications and confidential commercial data. Unauthorised disclosure can expose individuals to fraud and identity theft while causing financial and reputational harm to the organisation. Security controls should reflect the sensitivity of the information and the risks associated with its use. Practical measures include limiting access to authorised personnel, encrypting sensitive data, reviewing user permissions, maintaining reliable backups and testing recovery procedures. Security should also extend to paper records, removable devices, cloud platforms and third party systems where relevant. 2. Meeting Breach Reporting Obligations A cyber incident may trigger several reporting duties. The applicable requirements depend on the type of incident, the organisation, the data involved and the legal or contractual framework. A report to CERT-In may be required even where the incident does not involve personal data. Conversely, an incident involving personal information may engage data protection duties alongside sectoral or contractual requirements. Businesses should not assume a single notification satisfies every obligation. The DPDP framework includes personal data breach notification requirements, with important operational provisions subject to phased commencement. International customers may also impose additional reporting deadlines under contracts or foreign privacy laws. A documented reporting matrix helps legal, security and management teams identify the correct recipient, deadline and information required. 3. Maintaining Accountability and Evidence After an incident, regulators, customers, insurers or courts may ask what happened, when the organisation became aware of it, which safeguards were in place and how the response was managed. Logs, access records, risk assessments, incident tickets, vendor communications and decision records can help establish a reliable account. Evidence should be preserved in a controlled manner, with access restricted to appropriate personnel. Organisations should also consider legal holds and applicable retention requirements before deleting potentially relevant material. Documentation does not eliminate liability, but it can demonstrate that the business followed a considered process rather than responding without governance. Practical Steps Businesses Should Take 1. Conduct a Data and Cyber Risk Assessment Begin by identifying the personal and confidential information held by the organisation, where it is stored, why it is processed and who can access it. Map data flows between internal teams, cloud providers, software vendors and other service providers. This exercise helps identify excessive access, unnecessary collection, insecure transfers and information retained longer than required. 2. Establish Written Policies and Clear Responsibilities A cybersecurity policy should define acceptable use, access management, password and authentication controls, device security, backups, vulnerability handling and incident escalation. A data protection policy should address collection, permitted use, transparency, retention, deletion, individual requests and sharing with third parties. The policies should work together and reflect the organisation’s actual systems and risk profile. 3. Train Employees and Test Incident Response Human error remains a common source of security exposure. Regular training should cover phishing, suspicious attachments, social engineering, safe handling of personal data and prompt reporting of unusual activity. Staff should know whom to contact if an account is compromised or information is sent to the wrong recipient. An incident response plan should identify decision makers, technical responders, legal advisers, communications leads and external specialists. Tabletop exercises can test whether the organisation can contain an attack, preserve evidence, assess the affected data and meet reporting deadlines. Lessons from exercises and actual incidents should lead to documented improvements. 4. Review Vendors and Contracts A business may remain exposed even when its own systems are secure if a service provider suffers a breach. Before appointing a vendor, assess its security practices, access requirements, incident history where available and ability to support recovery. Contracts should address confidentiality, security controls, incident notification, cooperation with investigations, subcontracting, data return and deletion, and allocation of responsibilities. Certification can provide useful evidence of a vendor’s security programme, but it does not automatically establish compliance with every legal requirement. Organisations should assess whether the vendor’s controls fit the nature of the data and the services provided. The Role of Legal Advice in Cybersecurity Governance Cybersecurity is not solely an IT responsibility. Legal teams help identify applicable laws, interpret reporting duties, review contractual exposure, assess cross border data flows and coordinate communications following an incident. Technical specialists establish what occurred and how systems can be secured; legal advisers help determine what the organisation must do, when it must act and how to document its decisions.Businesses may consult cybersecurity and data protection lawyers to review incident response plans, privacy practices, vendor agreements and regulatory obligations. Early legal input can help prevent avoidable delays, inconsistent notifications and unsupported public statements during a crisis.For ongoing governance, corporate legal advisory can help align cybersecurity policies with board oversight, risk management, commercial contracts and wider compliance procedures. This integrated approach is particularly useful for growing businesses, organisations handling sensitive information and companies serving customers across multiple jurisdictions. Conclusion Cybersecurity and data protection are complementary parts of responsible business management. Cybersecurity protects systems and information from unauthorised access, disruption or damage, while data protection governs the lawful and responsible handling of personal data. Neither can replace the other. Indian businesses should understand their obligations under the Information Technology Act, applicable CERT-In directions, the DPDP framework and relevant sectoral or contractual rules. By mapping data, strengthening security controls, preparing for breach reporting, training employees and reviewing vendors, organisations can reduce legal risks and build a more resilient compliance framework. Seeking timely legal guidance and integrating corporate legal advisory services into business risk management can help organisations align their cybersecurity measures with applicable laws, contractual commitments and evolving regulatory requirements. Regular legal and technical reviews remain essential as cyber threats and compliance obligations continue to evolve. Frequently Asked Questions (FAQs) Q1. What is the relationship between cybersecurity and data protection? Cybersecurity protects systems and information from unauthorised access, disruption or damage. Data protection governs how personal data is collected, used, stored, shared and deleted. Strong cybersecurity supports data protection, but organisations must also ensure their processing practices are lawful and transparent. Q2. Which Indian laws govern cybersecurity and data protection? The principal frameworks include the Information Technology Act, 2000, applicable CERT-In directions and the Digital Personal Data Protection Act, 2023, together with its Rules as they commence. Sector specific regulations and contractual requirements may also apply. Q3. Is cybersecurity legally mandatory for businesses in India? Legal requirements depend on the organisation, its activities, the information it handles and the rules applicable to it. CERT-In directions impose specified requirements on entities within their scope, while data protection and sectoral laws may require appropriate safeguards. Businesses should assess their specific obligations rather than assume one standard applies to everyone. Q4. What should a business do after a data breach? The organisation should activate its incident response plan, contain the incident, preserve relevant evidence, assess the affected systems and information, and involve appropriate technical and legal personnel. It should identify all applicable reporting duties and deadlines, notify the relevant authorities or affected individuals where legally required, and document the response. Q5. Does the DPDP Act require businesses to report personal data breaches? The DPDP Act establishes personal data breach notification obligations, with detailed operational requirements provided by the Rules. Since commencement is phased, businesses should verify the applicable effective dates and requirements. They should also assess separate obligations under CERT-In directions, sectoral rules and contracts. Q6. How can small businesses improve cybersecurity and data protection compliance? Small businesses can start by mapping the personal data they hold, restricting access, enabling multi factor authentication, updating software, encrypting sensitive information, maintaining tested backups and training employees. They should also maintain written policies, review vendors and prepare an incident response process proportionate to their risks.

Businesses collect personal information, financial records, employee documents, customer communications and operational data every day. However, retaining information indefinitely can create privacy, security and regulatory risks. Data retention policies help organisations determine what information they should keep, why it is required, how long it should remain accessible and when it must be securely deleted. For businesses in India, an effective retention framework must balance privacy obligations under the Digital Personal Data Protection Act, 2023, statutory recordkeeping requirements, contractual commitments and legitimate operational needs. The objective is not simply to store less data. It is to retain the right information for a defensible period and dispose of it responsibly when the reason for keeping it ends. What Are Data Retention Policies? A data retention policy is a documented framework governing how an organisation stores, manages, archives and disposes of information throughout its lifecycle. It defines the principles for retaining records and establishes responsibilities for implementing those principles across business systems. A policy should explain the categories of information covered, the purpose of retention, applicable legal requirements, retention periods, deletion triggers and approved disposal methods. It should also identify who can approve exceptions and how the organisation will demonstrate compliance. A retention policy is different from a retention schedule. The policy establishes the overall rules, while the schedule assigns specific periods to categories such as customer records, invoices, employment documents, contracts, consent records, security logs and marketing data. Both are necessary because a general statement about retaining information only as long as necessary is difficult to implement without clear operational rules. Why Do Businesses Need a Data Retention Policy? Poor retention practices create risks in both directions. Deleting information too early can undermine tax reporting, contractual obligations, audits, investigations or legal claims. Keeping it too long can increase storage costs, expand the impact of a data breach and expose individuals to unnecessary privacy risks. A documented policy helps businesses identify which records must remain available and which can be removed. It also improves operational efficiency by reducing duplicate information and unnecessary storage. During an audit, investigation or customer dispute, a well maintained retention schedule helps the organisation locate relevant records and explain why they remain in its possession. Retention also supports accountability. If a business promises customers a defined retention period, its systems and internal procedures should reflect that promise. A policy which exists only as a document, without corresponding technical controls, offers limited practical protection. Data Retention Requirements Under Indian Law India does not prescribe one universal retention period for every category of business information. The applicable period depends on the record, the organisation, the relevant law and the purpose for which the information is retained. The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data. Section 8 addresses the responsibilities of Data Fiduciaries, including erasure when consent is withdrawn or the specified purpose is no longer served, subject to applicable legal requirements and exceptions. The Act and Rules also provide for specific retention and erasure obligations. The DPDP Rules, 2025 introduce further detail through Rule 8 and the Third and Seventh Schedules. Rule 8 addresses when a specified purpose is deemed no longer served for certain classes of Data Fiduciaries and purposes. It also provides for a minimum one year retention period for specified personal data, associated traffic data and processing logs, subject to the Rule's conditions and exceptions. These substantive requirements are scheduled to commence 18 months after publication of the Rules, generally on 13 May 2027. Businesses should therefore distinguish between requirements already in force and future obligations for which preparation is necessary. The official DPDP Rules, 2025 published by MeitY provide the relevant statutory text and commencement schedule. Other laws can require longer retention periods for particular records. For example, Section 128 of the Companies Act, 2013 generally requires companies to preserve books of account and relevant vouchers for at least eight financial years, subject to the statutory provisions and exceptions. GST law also contains record retention requirements. Section 36 of the Central Goods and Services Tax Act generally requires relevant accounts and records to be retained for 72 months from the due date for furnishing the annual return for the relevant year, with additional requirements where proceedings or investigations are pending. Businesses should map these obligations to the records concerned rather than apply one period to all company information. How the DPDP Framework Affects Data Retention The DPDP framework makes purpose and accountability central to personal data governance. Businesses should be able to explain why personal data is retained and identify when the purpose has been fulfilled. Retention should not continue merely because storage is inexpensive or a system has no automatic deletion setting. The position requires careful assessment because privacy obligations and statutory recordkeeping duties may overlap. A business may need to delete personal information after its operational purpose ends, while another applicable law may require certain transaction records to remain available. In such cases, the organisation should identify the precise legal requirement, retain only the information necessary to meet it and restrict access where appropriate. Businesses should also prepare for the phased commencement of the DPDP framework. A retention policy adopted now should be reviewed against the applicable commencement notifications, the Rules and any subsequent amendments or clarifications. Treating future requirements as already fully operative can be misleading, but ignoring them during system design can make later compliance costly. How to Create an Effective Data Retention Policy The first step is to prepare a data inventory. Businesses should identify the information they collect, the systems holding it, the people responsible for it and the purposes for which it is used. The inventory should include cloud platforms, customer relationship management systems, employee databases, email accounts, analytics tools, shared drives, archives and third party applications. Information held by vendors should not be overlooked simply because it is outside the organisation's own infrastructure.The next step is to identify the legal, contractual and operational requirements for each category. Legal and compliance teams should determine whether a statute requires a minimum period, whether a contract creates a preservation obligation and whether an investigation or dispute requires information to be retained. Business teams should then explain any continuing operational need. Each category should have a defined retention trigger. For example, the period may begin when a contract expires, an employee leaves, an invoice is issued, a transaction is completed or a customer account closes. The schedule should state the duration and the action required when the period ends. “Retain for five years” is incomplete unless the organisation knows when those five years begin. The policy should also assign responsibility. Legal, finance, HR, information security, IT and business owners may control different records. A named policy owner should coordinate changes, approve exceptions and ensure retention rules are implemented consistently. Choosing the Correct Retention Period There is no universal retention period suitable for every business record. The correct period depends on applicable legislation, the purpose of processing, contractual commitments, limitation periods, audit needs and the risk associated with keeping the information. Financial records may need to be retained to meet accounting and tax obligations. Employee records may need different periods depending on the type of document and applicable employment requirements. Customer profiles, marketing leads and website analytics may require shorter, purpose based periods. Security logs may need to remain available for investigations and compliance with applicable cyber security requirements. Businesses should avoid copying retention schedules from unrelated organisations or adopting indefinite retention by default. Each period should have a documented rationale. Where several laws apply, the organisation should identify the relevant minimum requirements and resolve any conflict through an appropriate legal review. Secure Deletion, Archiving and Backups A retention policy must explain what happens when the authorised period ends. Depending on the record and applicable requirements, the organisation may securely delete it, anonymise it or preserve it under a documented legal exception. Pseudonymisation alone does not necessarily remove information from privacy law if a person can still be identified using additional information. Archiving is not the same as deletion. Moving old records to a separate storage system may reduce costs or restrict access, but the information still exists and may remain subject to applicable retention obligations. Similarly, deleting a record from a live database does not necessarily remove copies held in backups, email systems, analytics platforms or vendor environments. Businesses should define backup rotation periods and restrict access to archived information. Where immediate removal from backups is not technically feasible, the organisation should document how copies expire, how restored systems handle previously deleted information and how legal requirements are met. Secure disposal should cover both electronic records and physical documents, including appropriate destruction of storage media where necessary. Managing Legal Holds and Investigations Routine deletion must not undermine a legal obligation to preserve evidence. Litigation, regulatory investigations, audits or reasonably anticipated disputes may require an organisation to suspend normal deletion for relevant records. A legal hold procedure should identify who can issue the hold, which records and systems are covered, who must preserve them and who can authorise release. The organisation should record the reason for the hold and review it periodically. A legal hold should not automatically stop deletion across the entire business. It should apply to the information relevant to the matter. Once the hold is formally released, the normal retention schedule can resume, provided no other preservation requirement remains. Data Retention in Employment and Customer Records Employee records often include identity documents, payroll details, performance reviews, attendance information, benefits records and disciplinary documents. These categories may be subject to different legal and operational requirements. HR teams should therefore avoid applying one retention period to every employee file. Recruitment records for unsuccessful candidates, for example, may require a different approach from payroll and statutory employment records. Customer information also needs careful classification. Transaction records, account credentials, support conversations, marketing preferences and consent evidence serve different purposes. Closing a customer account does not necessarily mean every record must be deleted immediately, but it also does not justify keeping all information indefinitely. Businesses should identify which records must remain for legal or contractual reasons and remove unnecessary personal data when the applicable conditions are met. Third Party Vendors and Data Retention Outsourcing does not remove the need to manage retention. Cloud providers, payroll vendors, customer support platforms and analytics services may hold copies of personal data on behalf of a business. Contracts should specify permitted retention, secure deletion, backup handling, subcontractor controls and confirmation of disposal where appropriate. The organisation should also verify whether the vendor uses information for independent purposes. A vendor may retain certain records under its own legal obligations, but the arrangement should be understood and documented. Retention promises in customer facing privacy notices should align with the actual behaviour of the business and its providers. Common Data Retention Mistakes A common mistake is using a single retention period for all data. Another is treating a policy as complete without confirming whether deletion actually happens in production systems, archives, backups and third party platforms. Businesses may also forget to suspend deletion when a legal hold applies or fail to restart normal disposal once the hold ends. Indefinite retention is another concern. It should be supported by a clear legal or operational reason, not simply by convenience. Policies also become outdated when laws change, new systems are introduced or the business begins processing additional categories of personal data. Regular reviews and documented approvals help prevent these failures. For organisations seeking to improve governance, a data privacy compliance law firm can assist with identifying applicable retention obligations, reviewing privacy documentation, assessing vendor contracts and aligning the retention schedule with Indian data protection requirements. How Businesses Can Maintain Ongoing Compliance A retention programme should be reviewed periodically and whenever a significant legal, technical or business change occurs. Organisations should test whether automated deletion rules work as intended, check whether vendors follow contractual requirements and verify whether records subject to legal holds remain preserved. Evidence of implementation can include approved retention schedules, system configurations, deletion logs, vendor confirmations, audit findings and records of exceptions. These materials help demonstrate that the organisation has moved beyond policy drafting to practical enforcement. Corporate lawyers for businesses can also help assess how recordkeeping duties interact with commercial contracts, employment matters, tax requirements and disputes. The goal is to create a consistent approach which preserves records when necessary and prevents unjustified retention. Conclusion Data retention policies are essential for responsible information management. They help businesses preserve records required by law, maintain evidence for legitimate business needs and reduce risks associated with excessive storage. An effective framework begins with a reliable data inventory, maps legal requirements to specific records, establishes clear retention triggers and assigns responsibility for secure disposal. For Indian organisations, the DPDP Act and Rules must be considered alongside company, tax, employment, contractual and sector specific requirements. The phased commencement of the DPDP framework makes advance preparation particularly important. Businesses should review their systems, document retention decisions, manage legal holds, control third party retention and test whether deletion procedures work in practice. A well implemented policy does more than support compliance: it creates a disciplined, secure and accountable approach to the entire information lifecycle. Frequently Asked Questions (FAQs) Q1. What is the purpose of a data retention policy? A data retention policy defines how long an organisation keeps information, why it needs it and what happens when the retention period ends. It helps balance legal recordkeeping duties, operational needs, privacy and security. Q2. Is a data retention policy mandatory in India? Specific recordkeeping obligations apply under several Indian laws, while the DPDP framework establishes personal data processing, erasure and retention requirements subject to phased commencement. A written policy is a practical way to identify and manage these obligations, even where a particular law does not prescribe a standalone policy document. Q3. How long should businesses retain personal data? The period depends on the purpose, applicable law, contractual obligations and any legal hold. Businesses should avoid adopting one universal period for every category of personal data. Q4. Does the DPDP Act require businesses to delete personal data? The Act addresses erasure when the purpose is no longer served or consent is withdrawn, subject to applicable legal requirements and exceptions. The detailed Rule 8 framework includes specific conditions and scheduled commencement, so businesses should assess the relevant provisions before setting their deletion procedures. Q5. What is the difference between data retention and data backup? Retention determines how long information should exist for an approved purpose. Backup creates copies to restore information after loss or system failure. Backup copies need their own lifecycle controls and should not become a reason for indefinite retention. Q6. Can a business retain data after a customer closes an account? Potentially. Certain records may need to be retained for tax, accounting, contractual or legal reasons. The organisation should document the reason, restrict access where appropriate and delete information once continued retention is no longer justified. Q7. How often should a data retention policy be reviewed? Businesses should establish a regular review cycle and reassess the policy when laws change, new systems are introduced, vendors change or business purposes are modified. Significant incidents and audit findings may also require updates.