Data Protection Law in India: DPDP Act, Rules, Compliance and Legal Remedies

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.

Data protection has become an important legal and governance issue for businesses, institutions, technology providers and individuals. Organisations may collect personal information through websites, applications, customer databases, employee systems, payment processes, marketing platforms, cloud services and other digital systems. The legal framework therefore needs to be considered together with the organisation’s actual information practices.

What is data protection?

Data protection concerns the lawful and secure processing of information relating to identifiable individuals. It includes questions about collection, purpose, access, use, disclosure, storage, security, retention, deletion and rights of individuals.

For an organisation, data protection is not limited to publishing a privacy policy. A meaningful compliance framework should correspond with the actual movement of personal data through the organisation’s people, software, devices, vendors and business processes.

India’s data protection framework

The principal central statute for digital personal data is the Digital Personal Data Protection Act, 2023. The Act establishes concepts including Data Principal, Data Fiduciary and Data Processor and sets out obligations concerning processing of digital personal data, consent, security, breach response, rights and enforcement.

The framework is supplemented by the Digital Personal Data Protection Rules, 2025. The Central Government notified the Rules on 13 November 2025 and prescribed different commencement dates for different provisions. Rules 1, 2 and 17 to 21 came into force on publication; Rule 4 is scheduled to commence one year after publication; and Rules 3, 5 to 16, 22 and 23 are scheduled to commence eighteen months after publication.

This phased commencement is important for compliance planning. An organisation should identify the particular statutory provision or rule being considered and verify whether it has commenced rather than treating the entire framework as having one commencement date.

Constitutional right to privacy

The Supreme Court’s decision in K.S. Puttaswamy (Retd.) v. Union of India recognised privacy as a constitutionally protected right. The constitutional principles concerning privacy provide an important background to India’s data-protection framework.

Constitutional privacy and statutory data-protection obligations are related but are not identical. The legal analysis in a particular dispute depends on the facts, the applicable statute, the nature of the processing and the remedy being considered.

Who is a Data Principal?

The DPDP Act generally describes the individual to whom personal data relates as the Data Principal. Customers, employees, applicants, users and other individuals may fall within this category when their digital personal data is processed.

The Act also contains special provisions relating to children and persons with lawful guardians. Organisations should therefore identify whether their processing involves such categories before designing collection and consent mechanisms.

Who is a Data Fiduciary?

A Data Fiduciary is the person who, alone or together with another person, determines the purpose and means of processing personal data. A business that decides why customer or employee data is collected and how it will be used may fall within this role.

The role is significant because the Act places specified responsibilities on Data Fiduciaries. Businesses should identify their role for each relevant processing activity rather than assuming that every participant in a data ecosystem has identical obligations.

Who is a Data Processor?

A Data Processor processes personal data on behalf of a Data Fiduciary. Technology vendors, cloud providers, payroll providers, customer-support platforms and other contractors may perform this role depending on the actual arrangement.

Contracts with processors should be reviewed for confidentiality, permitted processing, security, incident reporting, assistance with statutory requirements, subcontracting and deletion or return of information when the relationship ends.

Notice and transparency

Data protection requires an organisation to communicate relevant information about its processing practices in the manner required by law. A privacy notice should be understandable and should correspond to actual operations.

A policy becomes problematic when it describes practices that the organisation does not actually follow. Privacy documentation should therefore be reviewed against application forms, website settings, databases, analytics tools, vendors, retention practices and internal workflows.

Consent under the DPDP framework

Consent is an important mechanism under the DPDP Act, but data protection compliance should not be reduced to adding a checkbox to a website. The organisation must consider the statutory requirements applicable to the particular processing activity.

Where consent is relied upon, the organisation should use an appropriate mechanism and maintain processes for managing consent and related requests. The collection of unnecessary information should also be avoided because unnecessary data increases both privacy and security risks.

Purpose limitation and data minimisation

Organisations should identify the purpose for which personal data is required. Data should not be collected merely because a system allows the organisation to collect it.

A practical review can examine every significant field in a form or application: why is the information required, who uses it, whether it is shared, how long it is retained and what happens when the purpose ends? This approach can identify unnecessary collection at an early stage.

Security safeguards

Security is a central part of data protection. Appropriate safeguards may include access controls, authentication, encryption where suitable, logging, backups, vulnerability management, device controls, employee training and incident-response procedures.

Security should also cover personnel and vendors. Access should generally be limited according to business need, and access belonging to former employees or contractors should be reviewed and removed when no longer necessary.

Personal data breaches

A personal data breach may involve unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data in circumstances covered by the DPDP framework.

When an incident occurs, the organisation should preserve relevant evidence, identify affected systems and information, contain the incident, assess its scope, document the response and follow applicable notification and other statutory requirements.

Incident-response plans should be prepared before a breach occurs. Waiting until an incident happens can make it difficult to identify decision-makers, preserve evidence and meet time-sensitive obligations.

Employee and workplace data

Employers process substantial quantities of personal data, including identity documents, contact information, salary records, attendance records, performance information, recruitment records and other HR information.

Employee data should therefore be included in an organisation’s privacy and security assessment. HR vendors, payroll providers, background-verification agencies and other service providers may also need to be assessed according to their role and access.

Customer and marketing data

Customer databases may contain contact details, transaction information, account information, communications and other personal data. Marketing systems may introduce additional processing through email, messaging, analytics and customer relationship platforms.

Businesses should review the source of customer data, the purpose of processing, communications practices, retention, access and mechanisms for handling applicable requests. Information obtained from a third party should not automatically be assumed to be available for every subsequent use.

Children’s personal data

Organisations likely to process children’s personal data should pay particular attention to the requirements applicable to children under the DPDP framework. Educational services, online platforms, gaming-related services and other child-facing products should consider age-related requirements and parental consent mechanisms where applicable.

The design of a child-facing service should also be reviewed for processing that may be restricted under the statutory framework.

Data retention and deletion

Personal data should not simply be retained indefinitely because storage is inexpensive. Retention should be considered in light of the purpose of processing, applicable legal record-keeping requirements, contractual requirements and legitimate business needs.

Deletion should be assessed across systems. Data may remain in email accounts, backups, spreadsheets, cloud services or vendor platforms even after it has been removed from the main application.

Privacy by design

Privacy should be considered during product and system development. A privacy review can identify what information is collected, whether each field is necessary, who receives access, how data is transferred, how long it is retained and what happens when an account is closed.

For startups and technology businesses, addressing these questions during development may be easier than redesigning a mature system after a privacy issue arises.

Cloud services and third-party vendors

Businesses frequently rely on cloud hosting, customer relationship management platforms, payment providers, payroll services, analytics tools and communication platforms. These arrangements can involve processing of personal data by third parties.

Vendor due diligence should consider the information shared, the parties’ respective roles, security arrangements, access, subcontracting, incident reporting, retention and deletion. Contracts should be consistent with the actual technical relationship.

Cross-border data processing

Digital businesses may process personal data across multiple countries. The DPDP Act contains provisions relevant to processing outside India and provides for restrictions concerning transfers outside India as may be prescribed or notified.

Cross-border arrangements should therefore be assessed against the legal position in force at the relevant time, together with contractual, sector-specific and security requirements that may apply to the particular data flow.

Data protection and commercial contracts

Data protection obligations often appear in technology agreements, employment documents, vendor contracts, confidentiality agreements, outsourcing arrangements and licensing agreements.

Important provisions may address permitted processing, confidentiality, security, breach reporting, audit or verification rights, subcontracting, data return, deletion and obligations after termination. The drafting should correspond with the actual flow of personal data rather than using generic clauses without operational context.

Privacy risk assessment

A structured privacy risk assessment can help an organisation understand where personal data is located and how it is used. The review may identify data categories, purposes, affected individuals, systems, vendors, access rights, retention, security measures and consequences of misuse.

The exact assessment requirements depend on the organisation and the applicable law. A documented risk-based approach can nevertheless assist in identifying gaps and assigning responsibility for remediation.

Data Principal rights and grievance handling

The DPDP framework recognises specified rights of Data Principals, subject to the Act and applicable rules. Organisations should establish a practical mechanism for receiving, verifying, recording and responding to requests in accordance with the applicable requirements.

A grievance mechanism should be operational rather than merely included in a privacy notice. Requests should be assigned to responsible personnel and tracked so that the organisation can demonstrate how the request was considered and resolved.

Data Protection Board of India

The DPDP Act provides for the Data Protection Board of India as the statutory body responsible for specified enforcement functions. The Government notified that the Board would consist of four members in November 2025.

In May 2026, the Ministry of Electronics and Information Technology issued a notification concerning appointment to the offices of Chairperson and Members of the Data Protection Board. The notification describes the Board as an independent adjudicatory authority and states that it is empowered to inquire into personal data breaches and instances of non-compliance and to impose monetary penalties in accordance with the Act and Rules.

Penalties and enforcement

The DPDP Act provides for monetary penalties for specified contraventions. The amount and applicable provision depend on the nature of the contravention and the circumstances prescribed by the statute.

Organisations should therefore not treat data protection merely as a reputational issue. Statutory enforcement can have financial consequences as well as operational and contractual implications.

Recent legal development: implementation of India’s DPDP framework

The notification of the Digital Personal Data Protection Rules, 2025 represents a major implementation step. The Rules contain detailed provisions concerning notice, consent mechanisms, security safeguards, breach-related requirements, children’s data, rights-related processes and other aspects of the statutory framework, with different commencement dates.

The establishment of the Data Protection Board and subsequent steps concerning its composition also indicate that the enforcement architecture contemplated by the Act is being operationalised. Businesses should therefore review their privacy governance against the provisions that have commenced and prepare for provisions scheduled to commence later.

Data protection checklist for businesses

• Map the personal data processed by the organisation.
• Identify the purpose of each significant processing activity.
• Determine the organisation’s role in each data-processing relationship.
• Review privacy notices against actual data flows.
• Review consent mechanisms where consent is relied upon.
• Implement appropriate technical and organisational security safeguards.
• Review employee and contractor access.
• Identify third-party processors and vendors.
• Review contracts dealing with personal data.
• Establish retention and deletion practices.
• Prepare a documented breach-response process.
• Establish a process for Data Principal requests and grievances.
• Review child-related processing where applicable.
• Identify cross-border data flows.
• Train personnel who handle personal data.
• Periodically review compliance as the legal framework develops.

Common data protection mistakes

• Using a generic privacy policy that does not match actual processing.
• Collecting information that is not necessary for the stated purpose.
• Allowing excessive access to customer or employee data.
• Failing to review vendor access.
• Keeping personal data indefinitely without a documented reason.
• Ignoring personal data stored in spreadsheets and email systems.
• Failing to test the breach-response procedure.
• Assuming that a privacy policy alone establishes compliance.
• Using contractual clauses that do not reflect actual data flows.
• Failing to distinguish provisions already in force from provisions subject to later commencement.

Data protection disputes and legal remedies

A dispute may arise from unauthorised disclosure, misuse of personal data, cybersecurity incidents, contractual breaches, misleading privacy representations or other conduct. The appropriate legal route depends on the facts, the parties involved and the statutory framework applicable to the dispute.

Potential legal considerations may include statutory proceedings, contractual claims, regulatory processes, civil remedies or constitutional principles. Evidence such as contracts, access logs, emails, system records, privacy notices, incident reports and communications may be important.

Documents and records that may be relevant

Depending on the organisation, relevant records may include privacy notices, data inventories, vendor agreements, processor arrangements, confidentiality agreements, consent records, security policies, access-control records, retention schedules, incident-response records, grievance records and training materials.

Documentation should accurately describe actual practices. A policy that cannot be implemented operationally may create uncertainty during a dispute or regulatory review.

Data protection for Pune businesses

Businesses operating in Pune may handle personal data across manufacturing, information technology, education, healthcare, financial services, retail, professional services, logistics and other sectors. The applicable obligations depend on the nature of the processing rather than merely the location of the business.

Businesses should therefore examine their own data flows, contracts, technology systems and statutory obligations rather than assuming that a general industry practice is sufficient.

When should a business review its data protection practices?

A review may be appropriate when launching a new application or website, changing a customer-data process, onboarding a major technology vendor, experiencing a data incident, processing children’s data, expanding cross-border operations, entering into a significant outsourcing arrangement or preparing for new statutory requirements.

Frequently Asked Questions

1. What is data protection law in India?

It is the body of constitutional, statutory, contractual and sector-specific rules governing the handling and protection of personal information. The DPDP Act, 2023 is the principal central statute for digital personal data within its scope.

2. What is the Digital Personal Data Protection Act, 2023?

It is an Indian central statute establishing a framework for processing digital personal data and recognising specified rights and obligations of individuals and organisations.

3. Are the DPDP Rules, 2025 notified?

Yes. The Central Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025.

4. Do all DPDP Rules apply from the same date?

No. The notification establishes different commencement dates for different provisions, including provisions commencing on publication and others commencing after one year or eighteen months.

5. Who is a Data Principal?

A Data Principal is generally the individual to whom personal data relates under the DPDP Act.

6. Who is a Data Fiduciary?

A Data Fiduciary is the person who determines, alone or together with another person, the purpose and means of processing personal data.

7. Who is a Data Processor?

A Data Processor processes personal data on behalf of a Data Fiduciary.

8. Is consent always necessary?

The legal requirements depend on the particular processing activity and the applicable provisions. Businesses should not treat a checkbox as a substitute for analysing the statutory framework.

9. Can employee data be personal data?

Yes. Employee information can constitute personal data and may need to be considered in an organisation’s privacy and security programme.

10. What should a business do after a data breach?

The organisation should contain the incident, preserve relevant evidence, identify affected systems and data, assess the incident, document the response and comply with applicable notification and other legal requirements.

11. Can personal data be retained indefinitely?

Indefinite retention should not be assumed to be appropriate. Retention should be assessed against the purpose of processing and applicable legal, contractual and business requirements.

12. Do cloud vendors have data protection responsibilities?

The responsibilities depend on their role and the applicable legal and contractual framework. Where a vendor processes personal data on behalf of a Data Fiduciary, the relationship should be appropriately documented.

13. What is privacy by design?

Privacy by design means considering privacy requirements while a product, service or system is being developed rather than addressing them only after deployment.

14. Can personal data be processed outside India?

Cross-border processing is subject to the provisions of the DPDP framework and applicable restrictions or requirements in force at the relevant time.

15. What is the Data Protection Board of India?

It is the statutory body established under the DPDP framework for specified enforcement and adjudicatory functions.

16. Can data protection violations lead to monetary penalties?

Yes. The DPDP Act provides for monetary penalties for specified contraventions, subject to the statutory provisions and applicable circumstances.

17. Is a privacy policy enough for compliance?

No. Compliance can also require appropriate security, contracts, governance, retention practices, grievance handling, breach procedures and operational controls.

18. Should a company review its vendor contracts?

Yes. Vendor contracts should be assessed according to the data being processed, the parties’ roles, security, confidentiality, incident reporting, subcontracting and retention or deletion requirements.

19. Does data protection apply only to large companies?

The applicability of particular obligations depends on the law and the nature of processing. Business size alone should not be treated as a complete exemption from privacy responsibilities.

20. What documents can help demonstrate privacy compliance?

Depending on the organisation, records may include privacy notices, data inventories, contracts, security policies, consent records, access logs, retention schedules, incident records and grievance documentation.

Key takeaways

Data protection is an ongoing legal and operational responsibility. The DPDP Act, 2023, the notified Rules of 2025 and the developing enforcement framework provide an increasingly structured basis for handling digital personal data in India.

Businesses should therefore look beyond a website privacy policy and examine their actual data flows, contracts, security safeguards, retention practices, vendor relationships, incident-response procedures and mechanisms for handling individual rights. The applicable requirements should always be assessed according to the facts and the provisions in force at the relevant time.

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.