Businesses operating in India increasingly depend on personal data for customer acquisition, employee management, payments, marketing, analytics and digital services. As a result, Data Protection Laws have become an important part of corporate compliance rather than a matter limited to the information technology department. India now has a dedicated statutory framework through the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The framework is being introduced through a phased commencement structure, making it important for businesses to understand both the law and its implementation timeline. This guide explains the present Indian data protection framework, the obligations businesses need to prepare for, the continuing relevance of the earlier legal regime, sector specific requirements, penalties, children's data, cross border processing and practical steps for compliance.

Top Four Ranking Resources for “Data Protection Laws”

Search results for this subject are changing quickly because India's new privacy regime is moving from legislation towards implementation. The following resources provide useful coverage of the current framework:

1. Data Protection Laws and Regulations 2026: India
2. Data Protected: India
3. Data protection and cybersecurity laws in India
4. Data Protection Laws in India: Complete Guide for Businesses

The leading material generally covers the DPDP Act, scope, consent, individual rights, security, breach notification, children's data, cross border transfers and enforcement. A stronger business focused approach also needs to explain the phased commencement of the new regime and how organisations should manage the transition from the older framework.

How India's Data Protection Framework Has Evolved

India's privacy framework did not begin with the DPDP Act. For many years, protection of personal information was spread across the Information Technology Act, 2000, the Information Technology Rules, contractual principles, sectoral regulations and constitutional jurisprudence. Section 43A of the Information Technology Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 were particularly relevant to businesses handling sensitive personal data. The framework required reasonable security practices and addressed matters such as privacy policies, consent and disclosure of sensitive information. The constitutional position also changed significantly with the Supreme Court's decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1. A nine Judge Bench recognised privacy as a constitutionally protected right linked to liberty, dignity and autonomy. The Court also held privacy is not absolute and restrictions must satisfy constitutional requirements including legality, legitimate need and proportionality. The DPDP Act represents a major shift because it establishes a dedicated statutory framework for digital personal data.

What Are the Main Data Protection Laws in India?

The principal modern framework is the Digital Personal Data Protection Act, 2023, read with the Digital Personal Data Protection Rules, 2025. The DPDP Act received Presidential assent on 11 August 2023. It establishes the concepts of Data Fiduciaries and Data Principals and regulates the processing of digital personal data. Its provisions address lawful processing, notice, consent, legitimate uses, security safeguards, children's data, Significant Data Fiduciaries, individual rights, cross border processing and enforcement. The Government notified the DPDP Rules, 2025 in November 2025. The Rules provide operational detail for several obligations under the Act. They also introduce a phased implementation timetable rather than making every obligation effective on the same day. This distinction is important. A business should not describe the entire DPDP framework as immediately enforceable in the same way across all provisions.

Understanding the DPDP Act's Phased Implementation

The commencement notification dated 13 November 2025 divides the Act into different implementation stages. Several institutional provisions, including provisions relating to the Data Protection Board, commenced on 13 November 2025. Certain other provisions are scheduled to commence one year later. The core provisions dealing with processing, notice, consent, general obligations, children's data, Significant Data Fiduciaries, individual rights, exemptions and penalties are scheduled to commence eighteen months after 13 November 2025, which falls on 13 May 2027. The Rules follow a similar phased structure. Rules 1, 2 and 17 to 21 commenced upon publication. Rule 4 is scheduled one year after publication, while Rules 3, 5 to 16, 22 and 23 are scheduled eighteen months after publication. For businesses, the practical lesson is simple. Preparation should begin before the compliance deadline. Privacy notices, contracts, consent architecture, data inventories and technical controls cannot always be redesigned immediately.

Who Is Covered by the DPDP Act?

The Act applies to the processing of digital personal data within India where the data is collected in digital form or is digitised subsequently. It can also apply to processing outside India where such processing is connected with offering goods or services to Data Principals in India. This makes the law relevant to foreign businesses serving Indian customers, even where the technical infrastructure or parent organisation is located overseas. The key regulated entity is the Data Fiduciary. In simple terms, this is the person or organisation which determines the purpose and means of processing personal data. A Data Processor processes personal data on behalf of a Data Fiduciary. Businesses therefore need to consider their own processing activities as well as the external vendors handling data on their behalf.

What Counts as Personal Data?

The DPDP Act adopts a broad concept of personal data. It concerns data about an individual who is identifiable by or in relation to such data. Examples can include a person's name, telephone number, email address, identification information, account details, employment information, customer records and other information connected with an identifiable individual. Importantly, the Act focuses on digital personal data. A business should therefore examine how paper records become digitised and subsequently enter its information systems. Businesses should not limit their assessment to customer databases. Employee records, recruitment platforms, vendor contacts, marketing databases, website enquiries and customer support systems can also contain personal data.

Consent and Lawful Processing

Consent is a central part of the DPDP framework. Where consent is relied upon, the Act requires it to be free, specific, informed and unambiguous, with a clear affirmative action. A Data Principal must also be able to withdraw consent. The processing undertaken following consent must remain connected with the purpose for which consent was obtained. This has practical consequences for website forms and applications. A statement buried in lengthy terms and conditions may not provide a sound basis for a consent based processing activity. Businesses should instead consider whether their notice clearly explains the relevant purpose and whether the user can understand what they are agreeing to. The Act also recognises certain legitimate uses. Therefore, consent is not the only possible ground for every processing activity. Businesses should identify the appropriate legal basis rather than automatically seeking consent for everything.

Notice Requirements for Businesses

Transparency is a fundamental part of the framework. The DPDP Act requires notice to be given in connection with the processing of personal data. The Rules provide further detail concerning the form and content of notices. A good privacy notice should be understandable to its intended audience. It should explain what personal data is being processed, the purpose of processing and the relevant rights and mechanisms available to the Data Principal. The notice should also match reality. If a privacy policy says information is collected only for account administration but the business subsequently uses the same information for targeted marketing, the organisation may create a mismatch between its published position and actual processing.

Rights of Data Principals

Individuals are referred to as Data Principals under the DPDP Act. The framework provides rights relating to access to information about personal data, correction and erasure, grievance redressal and nomination. Businesses therefore need operational processes for responding to rights requests. It is not enough to place an email address in a privacy policy. The organisation should determine who receives requests, how identity is verified, how requests are logged, which internal teams respond and how deadlines are monitored. A central register of privacy requests can help create an audit trail.

Children's Data Receives Additional Protection

The DPDP Act imposes additional obligations concerning children's personal data. A child is generally defined as an individual who has not completed eighteen years of age. The Data Fiduciary must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, subject to prescribed exemptions. The Act also restricts processing likely to cause a detrimental effect on a child's well being. It prohibits tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exemptions. Businesses operating educational platforms, gaming services, children's applications and other products likely to be used by minors therefore require specific compliance controls rather than relying solely on a general privacy policy.

Security Safeguards and Data Breaches

Security is not merely a technical consideration under the DPDP framework. Section 8 requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches. The Rules provide further requirements concerning security safeguards and breach response. A mature compliance programme should therefore connect legal requirements with actual security controls. Access management, encryption where appropriate, authentication, monitoring, vulnerability management, incident response and vendor security should be assessed according to the nature and volume of data processed. The organisation should also have a documented breach response procedure. A legal team should not discover the incident for the first time after a technical team has already taken external action.

Data Retention and Erasure

Data protection is not only about how information is collected. It also concerns how long information remains in an organisation's systems. The DPDP framework places importance on erasure once the purpose for which personal data was processed is fulfilled, unless retention is necessary for a legal purpose. Businesses should therefore create retention schedules. For example, information collected for a temporary marketing campaign should not necessarily remain indefinitely in a CRM system. Former employee information, customer accounts and inactive user profiles may also require separate retention assessments. Data deletion should extend beyond the main production database where appropriate. Backups, archives and third party systems should also be considered.

Significant Data Fiduciaries

The DPDP Act creates a separate category known as a Significant Data Fiduciary. The Government may notify an organisation or class of organisations as Significant Data Fiduciaries based on factors specified in the Act, including the volume and sensitivity of personal data processed, risk to the sovereignty and integrity of India, risk to electoral democracy, security of the State, public order and other relevant factors. Significant Data Fiduciaries face additional obligations. These include appointing a Data Protection Officer based in India, appointing an independent data auditor and undertaking specified assessments and audits. Businesses likely to fall within this category should not wait for notification before building suitable governance structures.

Cross Border Data Processing

International businesses should pay particular attention to Section 16 of the DPDP Act and the Rules concerning transfers and availability of personal data outside India. The Act permits the Central Government to restrict transfers of personal data outside India to notified countries or territories. The Rules also contemplate restrictions concerning making personal data available to foreign States or entities under their control. This does not mean every business must automatically store all personal data exclusively in India. Instead, organisations should understand the applicable restrictions, their infrastructure arrangements, group data flows and vendor locations. Cloud hosting agreements and intra group data sharing arrangements deserve particular attention where personal data moves across jurisdictions.

Sector Specific Regulations Still Matter

The DPDP Act does not eliminate every other regulatory obligation affecting personal information. Businesses in financial services, insurance, securities, healthcare, telecommunications and other regulated sectors may remain subject to sector specific requirements. For example, regulatory directions issued by authorities such as the Reserve Bank of India, Securities and Exchange Board of India and Insurance Regulatory and Development Authority of India can impose additional requirements concerning data security, outsourcing, technology governance and information handling. This creates a layered compliance environment. A fintech business should therefore assess both the DPDP framework and applicable financial sector requirements rather than treating the DPDP Act as its only privacy obligation.

What Happens to the Earlier IT Act Framework?

The transition from the older framework needs careful attention. Section 44(2) of the DPDP Act provides for omission of Section 43A of the Information Technology Act. However, this particular amendment has a later commencement date under the phased notification. It is scheduled to take effect on 13 May 2027. This is an important distinction for businesses preparing compliance policies in 2026. The older provisions should not simply be treated as having disappeared immediately after enactment of the DPDP Act. Organisations should assess the framework applicable to their activities during the transition period.

Penalties for Non Compliance

The DPDP Act provides for substantial financial penalties. The Schedule permits penalties of up to ₹250 crore for failure to take reasonable security safeguards, up to ₹200 crore for certain breach notification failures, and up to ₹200 crore for breaches concerning children's data. Significant Data Fiduciary failures can attract penalties of up to ₹150 crore. Other breaches can attract penalties of up to ₹50 crore. These figures represent statutory maximums rather than automatic fines. Section 33 requires the Board to consider factors including the nature, gravity and duration of the breach, the type of data affected, whether the breach is repetitive, any gain or loss involved, mitigation measures, proportionality and the likely impact of the penalty. The financial exposure is therefore significant, but the broader commercial consequences can also include customer disputes, contractual claims, investor concerns and reputational damage.

How Businesses Can Prepare for Data Protection Compliance

The first practical step is a data mapping exercise. A business should identify what personal data it collects, where it comes from, why it is processed, where it is stored, who can access it and which third parties receive it. The next step is to compare actual practices with privacy notices and contractual documents.Businesses should then review their consent mechanisms, retention practices, security controls, vendor agreements and incident response procedures. Contracts with Data Processors deserve particular attention. Organisations should establish clear responsibilities concerning security, confidentiality, breach reporting, assistance with rights requests and deletion or return of information.Businesses should also establish internal ownership. Privacy compliance usually involves legal, information technology, cybersecurity, human resources, marketing, product and procurement teams. Without defined responsibility, compliance gaps can remain unnoticed. For organisations requiring specialist advice, engaging best data privacy law firms may be appropriate where processing involves sensitive commercial operations, large datasets, international transfers or significant regulatory exposure.

Why Data Protection Should Be Treated as a Business Function

Privacy compliance can influence more than regulatory risk. A company preparing for investment may face questions concerning its customer database, employee information, technology vendors and international data flows. A company entering an enterprise contract may be required to provide detailed privacy assurances. A business preparing for an acquisition may need to demonstrate how its data was collected and whether its processing practices comply with applicable law. Privacy therefore has a direct connection with corporate value. A well organised data governance programme can make due diligence easier, reduce operational uncertainty and give management a clearer understanding of one of its most important business assets. A passionate corporate lawyer can also help connect privacy requirements with corporate contracts, employment documentation, technology agreements, intellectual property arrangements and broader governance requirements.

Conclusion

India's data protection framework has moved from a fragmented model towards a dedicated statutory regime. The DPDP Act, 2023 and DPDP Rules, 2025 provide the foundation for regulating digital personal data while recognising individual rights and placing accountability on organisations processing personal information.For businesses, compliance should not begin with rewriting a privacy policy. It should begin with understanding the data itself. Organisations should know what information they hold, why they collect it, how they use it, where it travels, which vendors process it and when it should be removed. They should also understand how the rules apply to children, international operations, security incidents and Significant Data Fiduciaries. The phased implementation of the DPDP framework gives businesses time to prepare. It does not remove the need for preparation. A sound privacy programme should ultimately connect legal requirements with actual business operations. When privacy notices, contracts, technology systems and internal processes all tell the same story, compliance becomes considerably more defensible.

Frequently Asked Questions

Q1. What are the main Data Protection Laws in India?

The principal statutory framework for digital personal data is the Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules, 2025. The constitutional right to privacy and sector specific regulatory requirements also form part of India's wider privacy landscape.

Q2. Is the DPDP Act currently applicable to all businesses?

The Act has commenced in phases. Several institutional provisions came into force on 13 November 2025, while the principal operational provisions concerning processing and many business obligations are scheduled for 13 May 2027. Businesses should therefore distinguish between enacted provisions and provisions currently in force.

Q3. What is a Data Fiduciary?

A Data Fiduciary is an individual or organisation which determines the purpose and means of processing personal data under the DPDP framework.

Q4. Is consent mandatory for every type of personal data processing?

No. Consent is an important legal basis, but the DPDP Act also recognises specified legitimate uses. Businesses should determine the appropriate legal basis for each processing activity rather than assuming consent is always required.

Q5. Does the DPDP Act apply to foreign companies?

It can. The Act applies to processing outside India where the processing is connected with offering goods or services to Data Principals in India.

Q6. What rights do individuals have under the DPDP Act?

Data Principals have rights including access to information about their personal data, correction and erasure, grievance redressal and nomination, subject to the statutory framework.

Q7. What is the maximum penalty under the DPDP Act?

The highest scheduled penalty can extend to ₹250 crore for failure to take reasonable security safeguards. Other specified contraventions carry separate maximum penalties. The actual amount is determined following the statutory process and relevant factors.

Q8. Does India have a separate law for children's personal data?

The DPDP Act provides specific protections for children's personal data under Section 9. These include parental consent requirements and restrictions concerning detrimental processing, tracking, behavioural monitoring and targeted advertising, subject to prescribed exemptions.

Q9. Do businesses need a Data Protection Officer?

Not every organisation automatically needs a Data Protection Officer under the same requirements. Additional obligations apply to Significant Data Fiduciaries, including the appointment of a Data Protection Officer based in India. Businesses should assess whether they fall within the relevant category.

Q10. What should a business do before the main DPDP obligations become effective?

Businesses should map personal data, review notices and consent mechanisms, assess vendor contracts, establish retention policies, strengthen security controls, prepare breach response procedures and create processes for handling Data Principal rights.

This update was released on 27 Aug 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.