Data Privacy Law in India: DPDP Act, 2023, Rules, Compliance and Legal Remedies

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.

Data privacy concerns the way information relating to identifiable individuals is collected, used, stored, disclosed, secured and, where applicable, deleted. For businesses in Pune and elsewhere in India, privacy compliance increasingly affects websites, mobile applications, employee records, customer databases, financial information, marketing systems, cloud services and technology contracts.

Indian data protection law is developing through a combination of the Digital Personal Data Protection Act, 2023, its implementing rules, sector-specific requirements, contractual obligations and constitutional principles concerning privacy. A business therefore needs to examine both the legal framework and the way data is actually handled in its operations.

What is data privacy?

Data privacy concerns the lawful and responsible handling of personal information. The legal question is not simply whether an organisation possesses data, but why it was collected, whether the processing has a lawful basis, what information was communicated to the individual, who can access it, how long it is retained, whether it is shared with another person or organisation, and what safeguards are applied.

Personal data can include information that identifies an individual directly or that can identify an individual when combined with other information. Examples may include a person’s name, contact details, identification information, account information, location-related information, online identifiers and other information covered by the applicable legal framework.

Constitutional privacy and data protection

The Supreme Court has recognised privacy as a constitutionally protected right under Article 21 and the broader guarantees of Part III of the Constitution. The judgment in K.S. Puttaswamy (Retd.) v. Union of India established an important constitutional foundation for privacy in India.

Data protection legislation operates within this broader constitutional environment. The statutory framework applicable to a particular organisation must, however, be assessed separately from broad constitutional principles because the rights, duties, exemptions and remedies may differ according to the facts.

Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a statutory framework for processing digital personal data. The Act uses concepts including Data Principal, Data Fiduciary, Data Processor, consent, specified purpose and personal data breach.

The Act applies to processing of digital personal data within India in the circumstances specified by the legislation. It can also apply to certain processing outside India where the processing is connected with offering goods or services to individuals in India.

The precise duties of an organisation depend on whether it is acting as a Data Fiduciary, Data Processor or in another capacity and on the provisions applicable to the particular processing activity.

Digital Personal Data Protection Rules, 2025

A significant recent development is the notification of the Digital Personal Data Protection Rules, 2025 by the Central Government on 13 November 2025. The Rules provide implementation details under the 2023 Act and establish a phased commencement structure rather than making every rule operative on the same date.

The notified framework includes provisions concerning notice, consent mechanisms, security safeguards, personal data breach-related obligations, rights of Data Principals, obligations of Data Fiduciaries and other implementation matters. Some provisions commenced on publication, while other provisions are subject to the one-year or eighteen-month commencement periods specified in the notification.

For organisations preparing for compliance, this phased structure is important. A business should not assume that every provision has the same commencement date. The applicable commencement provision should be checked for the specific obligation being considered.

What is a Data Principal?

The Act generally uses the expression Data Principal for the individual to whom the personal data relates. In practical terms, a customer, employee, applicant, user or other identifiable individual may be a Data Principal in relation to personal data processed by an organisation.

Where the Act recognises special circumstances involving children or persons with lawful guardians, additional requirements may apply. Organisations handling such information should therefore identify the category of individual involved before designing a processing activity.

What is a Data Fiduciary?

A Data Fiduciary is the person who, alone or together with another person, determines the purpose and means of processing personal data under the statutory framework. The role is important because the Data Fiduciary carries specified responsibilities concerning lawful processing, notices, security, grievance mechanisms and other obligations.

A business should identify its role for each processing activity rather than assuming that every organisation involved in handling data has identical legal responsibilities.

What is a Data Processor?

A Data Processor processes personal data on behalf of a Data Fiduciary. Cloud service providers, technology vendors, payroll providers, customer-support platforms and other service providers may process personal data depending on the arrangement.

Contracts with processors should address the permitted processing, security expectations, confidentiality, assistance with data-related obligations, incident reporting and what happens when the commercial relationship ends. The precise contractual requirements should be aligned with the applicable law and the nature of the processing.

Notice and transparency

Individuals should receive appropriate information about the processing of their personal data. A privacy notice should be understandable and should correspond to the organisation’s actual practices.

A common compliance problem occurs when a privacy policy says one thing while the organisation’s technical or operational systems do something else. Privacy documentation should therefore be reviewed against data flows, application settings, vendor arrangements, retention practices and actual business operations.

Consent and other lawful grounds

Consent is an important concept under the DPDP framework, but privacy compliance should not be reduced to inserting a consent checkbox on a website. The organisation should identify the legal basis applicable to the particular processing activity and provide information in the manner required by the law.

Consent, where relied upon, should be obtained through an appropriate mechanism and should be capable of being managed in accordance with the statutory framework. Organisations should also avoid collecting information merely because a technical system makes collection easy.

Purpose limitation and data minimisation

Privacy compliance is closely connected with the purpose for which information is processed. A business should identify why a category of personal data is needed and avoid collecting information that has no genuine connection with the stated business purpose.

For example, an application form should be reviewed field by field. If a particular piece of information is not required for the relevant purpose, collecting it can create unnecessary security, retention and compliance risks.

Security safeguards

Organisations processing personal data should adopt reasonable security safeguards appropriate to their activities and the applicable legal requirements. Security is not limited to installing antivirus software. It can involve access controls, authentication, encryption where appropriate, logging, backups, vulnerability management, employee awareness, vendor controls and incident-response procedures.

Access should ordinarily be based on business need. Former employees and contractors should not retain unnecessary access to systems containing personal data after their relationship ends.

Personal data breaches

A personal data breach can involve unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data in circumstances covered by the applicable law.

When an incident occurs, an organisation should preserve relevant evidence, identify the affected systems and data, contain the incident, assess the scope, document the response and comply with applicable notification and other statutory requirements. The appropriate response depends on the incident and the obligations applicable at that time.

Employee data and workplace privacy

Data privacy is not limited to customer information. Employers may process employee names, addresses, identity documents, salary records, attendance information, performance records, health-related information and other personal data.

Employment documentation should therefore be reviewed alongside internal access controls, HR systems, payroll arrangements, background verification processes and third-party vendors. Employees should not automatically be treated as outside the privacy framework merely because the data is held in an employment context.

Customer databases and marketing

Businesses often collect customer information for sales, support, communications and marketing. The privacy implications depend on what data is collected, the purpose, the communication method and the legal framework applicable to the processing.

Marketing databases should be reviewed for the source of the information, the notices provided, the mechanism used for communication, retention practices and processes for handling individual requests. Purchased or shared databases should receive particular scrutiny because the origin of the information may not establish that every subsequent use is lawful.

Children’s personal data

Organisations that process personal data relating to children must pay particular attention to the requirements applicable to children under the DPDP framework. Online services, educational platforms, gaming-related services and family-oriented applications should identify whether their users may fall within this category.

The compliance approach should take account of age-related requirements, parental consent mechanisms where applicable, and restrictions concerning processing that are imposed by the statutory framework.

Data retention and deletion

Keeping personal data indefinitely can increase both legal and cybersecurity risks. Organisations should identify retention periods appropriate to the purpose of processing, statutory record-keeping requirements, contractual needs and legitimate business requirements.

Deletion should also be considered at the system level. A company may remove a record from its main database while retaining copies in backups, email systems, spreadsheets or third-party platforms. A practical retention policy should therefore address the relevant systems and vendors.

Privacy by design

Privacy should be considered while a product or service is being developed rather than only after launch. A privacy-by-design review can examine what data is collected, which fields are necessary, who can access it, how it is transferred, how long it is retained and what happens when the user closes an account.

For startups, this can be particularly useful because changing an established data architecture can be more difficult than building appropriate controls at the beginning.

Cloud services and third-party vendors

Many businesses do not store all personal data on their own infrastructure. They may use cloud platforms, customer relationship management systems, payment processors, payroll vendors, analytics tools and communication services.

Vendor due diligence should therefore consider what data is shared, the vendor’s role, contractual protections, security practices, access rights, retention, incident reporting and deletion or return of data when the contract ends.

Cross-border processing

Digital businesses may process information across multiple countries. The DPDP Act contains provisions relevant to processing outside India in specified circumstances and provides for restrictions concerning transfers outside India as may be prescribed or notified.

Cross-border arrangements should therefore be reviewed with reference to the current statutory and regulatory position rather than relying on a generic statement that data may be transferred anywhere.

Data privacy and contracts

Privacy obligations frequently appear in commercial agreements. Agreements with technology providers, processors, consultants, marketing agencies and other vendors may contain provisions dealing with confidentiality, security, breach notification, data access, audit rights, subcontracting, retention and termination.

Contract language should correspond to the actual data flow. A contract that imposes obligations on a vendor but gives the vendor unrestricted access to personal data without operational controls may not adequately address the underlying risk.

Data protection impact and risk assessment

Organisations handling large volumes of personal data or processing information in higher-risk contexts may benefit from a structured privacy risk assessment. The assessment can identify the categories of data, purpose, affected individuals, systems, vendors, access rights, security controls, retention and potential consequences of misuse.

The exact assessment requirements depend on the organisation and the applicable legal framework. A risk-based approach can nevertheless help management identify gaps before an incident or regulatory issue occurs.

Data Principal rights and grievance handling

The DPDP framework recognises rights for Data Principals, subject to the Act and applicable rules. Organisations should establish a practical mechanism for receiving, verifying, recording and responding to requests within the applicable requirements.

A grievance mechanism should not exist only on paper. Requests should be routed to responsible personnel, tracked, documented and closed consistently. Organisations should also maintain records showing how requests were handled.

Data Protection Board of India

The statutory framework provides for the Data Protection Board of India as the body responsible for specified functions under the DPDP Act. The Government also notified measures concerning establishment of the Board as part of the 2025 implementation framework.

Businesses should therefore treat privacy compliance as an ongoing governance issue rather than a one-time website-policy exercise.

Recent legal development: implementation of the DPDP framework

The notification of the Digital Personal Data Protection Rules, 2025 is an important development for Indian businesses. The Rules were notified on 13 November 2025 and contain a phased commencement mechanism. The Ministry of Electronics and Information Technology has subsequently described the notified Rules as establishing the implementation framework for the DPDP Act and has highlighted the eighteen-month phased timeline.

The practical significance is that organisations should review their privacy governance against the notified framework and identify which obligations have already commenced and which are scheduled to commence later. Policies, notices, consent mechanisms, vendor contracts, security procedures, breach-response plans and Data Principal request processes may need to be reviewed in light of the applicable commencement dates.

Data privacy compliance checklist for a business

• Map the categories of personal data being processed.
• Identify the purpose for each major processing activity.
• Identify whether the organisation is acting as a Data Fiduciary, Data Processor or another relevant role.
• Review privacy notices and make sure they reflect actual practices.
• Review consent and withdrawal mechanisms where consent is relied upon.
• Maintain appropriate security and access controls.
• Review employee and contractor access to personal data.
• Identify third-party processors and data-sharing arrangements.
• Review retention and deletion practices.
• Establish a documented personal-data breach response process.
• Maintain a process for Data Principal requests and grievances.
• Review contracts containing data-processing and confidentiality clauses.
• Identify cross-border processing and related legal requirements.
• Train personnel who regularly handle personal data.
• Periodically review privacy practices against changes in law and technology.

Common mistakes in data privacy compliance

• Using a generic privacy policy that does not match actual processing.
• Collecting unnecessary personal information.
• Giving excessive system access to employees or vendors.
• Failing to maintain records of consent or privacy requests where required.
• Ignoring personal data held in spreadsheets, email and local devices.
• Failing to review vendor and processor contracts.
• Keeping information indefinitely without a documented retention rationale.
• Failing to test the breach-response process.
• Assuming that encryption alone establishes privacy compliance.
• Ignoring privacy requirements during product development.
• Failing to distinguish current obligations from provisions that commence later.

Data privacy disputes and legal remedies

A privacy dispute can arise from unauthorised disclosure, misuse of information, contractual breach, cybersecurity incidents, misleading privacy representations or other conduct. The available remedy depends on the facts and the law applicable to the particular situation.

Depending on the matter, the legal analysis may involve statutory remedies, contractual claims, constitutional principles, regulatory proceedings, civil proceedings or other mechanisms. Evidence such as access logs, emails, system records, contracts, privacy notices, incident reports and communications can become important.

What documents should a business maintain?

Depending on the nature and size of the organisation, useful records may include privacy notices, internal data maps, vendor agreements, confidentiality agreements, consent records, security policies, access-control records, incident-response documents, retention schedules, grievance records, employee policies and training records.

Documentation should reflect actual operations. Creating a policy without implementing the corresponding technical and organisational measures can create additional risk because the organisation may be unable to demonstrate that its stated practices are followed.

When legal review may be relevant

Legal review may be relevant when a business launches a new digital product, changes its data practices, enters into a major technology agreement, experiences a personal data incident, receives a privacy-related complaint, begins processing information of children, changes its international data flows or needs to assess its obligations under the DPDP framework.

The appropriate review will depend on the business model, information processed, technology architecture, contractual arrangements and applicable law.

Frequently Asked Questions

1. What is data privacy?

Data privacy concerns how personal information is collected, used, stored, disclosed, secured and otherwise processed in accordance with applicable law.

2. What is the main data protection law in India?

The Digital Personal Data Protection Act, 2023 is the principal central legislation governing digital personal data within its scope. Its implementation is supplemented by the notified Digital Personal Data Protection Rules, 2025.

3. Are the DPDP Rules, 2025 already notified?

Yes. The Central Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The Rules contain different commencement dates for different provisions.

4. Does every provision of the DPDP Rules apply immediately?

No. The notification provides for phased commencement. The applicable commencement provision should be checked for the specific rule or obligation.

5. What is a Data Fiduciary?

A Data Fiduciary is the person who determines, alone or together with another person, the purpose and means of processing personal data under the DPDP framework.

6. What is a Data Processor?

A Data Processor processes personal data on behalf of a Data Fiduciary. The relationship and contractual responsibilities depend on the applicable law and actual processing arrangement.

7. Is consent always required to process personal data?

Not every processing activity should be analysed simply by asking whether a consent checkbox exists. The applicable legal basis and statutory requirements must be considered for the particular processing activity.

8. What should a privacy notice contain?

A privacy notice should communicate relevant information about the processing of personal data in the manner required by the applicable law. It should also accurately reflect the organisation’s actual practices.

9. Can employee information be covered by data privacy law?

Employee information can constitute personal data. Organisations should therefore consider applicable privacy requirements when collecting, storing, using and sharing HR information.

10. What should a company do after a data breach?

The organisation should promptly contain the incident, preserve evidence, assess the affected data and systems, document the response and comply with applicable notification and other legal requirements.

11. Can a company keep personal data forever?

Indefinite retention should not be assumed to be appropriate. Retention should be considered against the purpose of processing, applicable legal obligations and legitimate business requirements.

12. Are cloud service providers relevant to data privacy?

Yes. Where a cloud provider processes personal data on behalf of an organisation, the parties should consider their respective roles, contractual obligations, security arrangements and data-handling practices.

13. Does data privacy apply to small businesses?

Privacy obligations depend on the applicable law and the nature of the processing. A small business should not assume that its size alone removes privacy responsibilities.

14. What is privacy by design?

Privacy by design means considering privacy requirements during the development of a product, service or system rather than waiting until after launch.

15. Can a customer complain about misuse of personal data?

Yes. The applicable framework may provide grievance and other mechanisms. The appropriate route depends on the nature of the complaint and the legal provisions applicable to the organisation.

16. Can personal data be transferred outside India?

Cross-border processing is subject to the applicable provisions of the DPDP framework and any restrictions or requirements in force at the relevant time. The specific data flow should be assessed rather than relying on a blanket assumption.

17. What is a personal data breach?

The DPDP Act defines a personal data breach by reference to unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises specified aspects of the data.

18. Should businesses review vendor contracts for privacy issues?

Yes. Contracts should be reviewed according to the data being shared, the parties’ roles, permitted processing, confidentiality, security, incident reporting, retention and termination requirements.

19. Is a privacy policy enough for compliance?

No. A privacy notice is only one part of a privacy programme. Actual compliance can also involve governance, contracts, security safeguards, data mapping, retention, grievance handling and operational controls.

20. When should a business conduct a data privacy review?

A review can be appropriate when launching a new product, changing data practices, onboarding major vendors, expanding internationally, handling children’s data, responding to an incident or preparing for new statutory requirements.

Key takeaways

Data privacy in India is moving from a largely policy-driven subject towards a structured statutory compliance framework. The DPDP Act, 2023 and the notified Rules of 2025 provide an important foundation, but compliance still depends on the organisation’s actual processing activities, contracts, technology systems and governance practices.

Businesses should therefore treat privacy as an ongoing legal and operational responsibility. Mapping data, documenting purposes, maintaining suitable security, reviewing vendors, handling individual requests and preparing for breaches can help an organisation respond more systematically to privacy obligations.

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.