Data Privacy Law in India: DPDP Act, Rules, Rights, Compliance and Legal Remedies

Introduction

Personal information is routinely collected and processed through websites, mobile applications, financial services, e-commerce platforms, employers, educational institutions, healthcare systems and other digital services. This creates legal questions about what information may be collected, why it is collected, how long it may be retained, who may receive it, how it should be secured and what rights individuals have.

India’s data-protection framework has developed significantly with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules). The framework operates alongside the Information Technology Act, 2000, contractual obligations, sector-specific requirements and other applicable laws.

What is data privacy?

Data privacy concerns the lawful and appropriate handling of information relating to identifiable individuals. It is not limited to keeping information secret. It also concerns transparency, purpose, lawful processing, consent where required, security, retention, access and mechanisms through which individuals can exercise statutory rights.

Data protection is closely related but focuses particularly on the rules and safeguards governing the processing of personal data. A business can therefore have a data-protection obligation even when the information is being processed for an ordinary commercial activity.

India’s data-protection framework

The DPDP Act, 2023 establishes a statutory framework for processing digital personal data in India and provides rights and obligations for Data Principals and Data Fiduciaries. The DPDP Rules, 2025 provide additional operational requirements.

Other legal provisions may remain relevant. The Information Technology Act and rules made under it can address information-security and intermediary-related matters. Contracts can regulate confidentiality and data handling between businesses. Sectoral regulators may impose additional requirements on entities operating in banking, insurance, telecommunications, healthcare, securities and other regulated fields.

DPDP Act 2023: key concepts

The DPDP Act uses specific terminology. A Data Principal is the individual to whom the personal data relates. A Data Fiduciary determines the purpose and means of processing personal data. A Data Processor processes personal data on behalf of a Data Fiduciary.

These roles matter because responsibility can depend on who determines the purpose and means of processing and on the contractual and statutory relationship between the parties.

What is digital personal data?

The Act is concerned with digital personal data. Information may become relevant to the framework when it relates to an identifiable individual and is processed in digital form or is converted into digital form as contemplated by the statute.

Businesses should therefore identify the categories of personal data they collect rather than assuming that only highly sensitive information creates legal obligations.

Notice and transparency

Transparency is an important part of data protection. Individuals should be able to understand what personal data is being collected and the purpose for which it is processed in circumstances where the statutory framework requires notice.

The DPDP Rules, 2025 prescribe requirements concerning notice, including clear and understandable information and an itemised description of personal data and the purposes for which it is processed. The Rules were notified in November 2025 and contain a phased commencement structure.

Consent under the DPDP framework

Where consent is the applicable basis for processing, it should be capable of being understood and given in accordance with the statutory requirements. The DPDP framework also addresses withdrawal of consent.

A consent mechanism should not be designed so that withdrawal is practically impossible while obtaining consent is effortless. Businesses should review the technical and legal design of consent flows, including records showing when and how consent was obtained or withdrawn.

Consent Managers

The DPDP Rules provide a framework for Consent Managers. These entities are intended to provide mechanisms through which Data Principals can give, manage, review and withdraw consent in accordance with the applicable requirements.

The Rules also prescribe requirements concerning registration, financial and operational capacity, interoperability, records, security and conflict-of-interest safeguards. The exact obligations should be assessed from the notified Rules and their applicable commencement dates.

Purpose limitation and data minimisation

Organisations should examine whether the personal data they collect is connected with the purpose for which it is processed. Collecting information merely because it might be useful in the future can create governance and compliance concerns.

A practical data inventory can identify what information is collected, the purpose of collection, the system in which it is stored, the persons who can access it, the vendors who receive it and the applicable retention period.

Security safeguards

Data protection requires appropriate technical and organisational safeguards. Depending on the nature and scale of processing, measures may include access controls, authentication, encryption where appropriate, logging, backups, vulnerability management, employee training, incident-response procedures and vendor controls.

Security should be proportionate to the risks associated with the data and processing activity. A written policy alone is unlikely to be sufficient if operational practices do not implement the stated controls.

Personal data breaches

A personal data breach can involve unauthorised processing, accidental disclosure, loss, alteration, destruction or compromise of personal data. Organisations should have an incident-response process capable of identifying the affected systems and information, containing the incident, preserving evidence and assessing applicable notification and remedial obligations.

The legal response should not be based solely on the number of records involved. The type of personal data, circumstances of the incident, potential impact, security controls and statutory requirements may all be relevant.

Data protection and cyber security

Data privacy and cyber security overlap but are not identical. Cyber security focuses substantially on protecting information systems and digital resources from unauthorised access, disruption or misuse. Data protection additionally considers whether personal data is processed lawfully and appropriately throughout its lifecycle.

A company may therefore have a privacy issue even without a cyberattack, such as collecting more personal data than necessary or using it for a purpose that is not supported by the applicable legal framework.

Employee personal data

Employers routinely process names, contact details, identity information, payroll information, attendance records, performance records and other employee-related information. The fact that data is processed in an employment context does not mean that data-governance questions disappear.

Employment documents and internal policies should identify appropriate purposes, access restrictions, confidentiality obligations and data-handling practices. HR, payroll and technology vendors may also need contractual controls governing access to employee information.

Customer and marketing data

Businesses commonly collect customer contact details for account creation, transactions, support and marketing. These purposes should be distinguished where the legal basis and notice requirements differ.

Marketing databases should be reviewed for the source of the information, consent or other applicable legal basis, opt-out mechanisms, retention practices and sharing with advertising or technology vendors.

Children’s personal data

The DPDP Act contains specific provisions concerning processing of children’s personal data. Businesses whose services are directed towards or used by children should therefore assess age-related requirements, parental consent mechanisms where applicable and restrictions concerning targeted advertising and other specified processing activities.

Age verification and consent mechanisms should be designed with both legal requirements and data-minimisation principles in mind.

Rights of Data Principals

The DPDP framework provides specified rights to Data Principals. Depending on the applicable provisions and commencement dates, these include rights concerning access to information about personal data, correction and erasure, grievance redressal and nomination.

Businesses should establish an internal process for receiving, verifying and responding to rights requests. A request should be assessed against the statutory framework rather than handled through an informal or inconsistent process.

Grievance redressal

A Data Fiduciary is expected to provide a mechanism through which Data Principals can raise grievances in accordance with the Act and Rules. Businesses should maintain a defined process, identify responsible personnel and keep appropriate records of complaints and responses.

Where a grievance cannot be resolved through the applicable internal mechanism, the statutory framework provides for further recourse in appropriate circumstances.

Data Protection Board of India

The DPDP Act establishes the Data Protection Board of India as the statutory body for the functions assigned to it under the Act. MeitY’s published material records the establishment and operational framework of the Board and the notified rules provide for its functioning.

The Board’s role should be understood from the statutory provisions and notified rules rather than from general assumptions about a data regulator. Its jurisdiction, powers and procedures are governed by the applicable legal framework.

Important development: DPDP Rules 2025

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The notification created a phased commencement structure rather than bringing every operational obligation into force on the same day.

Under the notified commencement provision, Rules 1, 2 and 17 to 21 came into force on publication. Rule 4 is scheduled to come into force one year after publication, while Rules 3, 5 to 16, 22 and 23 are scheduled to come into force eighteen months after publication. The corresponding commencement notification for the DPDP Act also establishes a phased timeline for different provisions.

This means that organisations should distinguish between provisions already in force and provisions scheduled to commence later. Compliance planning should nevertheless begin before an obligation becomes operational so that contracts, notices, systems and internal procedures can be updated in time.

What should businesses do before full implementation?

1. prepare a personal-data inventory;
2. identify the purposes for which each category is processed;
3. map internal and external data flows;
4. identify Data Fiduciaries, Data Processors and other relevant parties;
5. review privacy notices and consent mechanisms;
6. review retention and deletion practices;
7. assess security controls;
8. review contracts with vendors and processors;
9. establish a breach-response process;
10. create a rights-request and grievance procedure;
11. review employee and customer data practices; and
12. monitor the commencement of provisions and subsequent legal developments.

Data processors and vendor contracts

Many organisations rely on cloud providers, payroll processors, customer relationship platforms, analytics providers, communication tools and other technology vendors. The legal and operational relationship with these vendors should be documented appropriately.

Depending on the processing activity, contracts may address the purpose of processing, categories of data, security safeguards, confidentiality, access restrictions, subcontracting, incident reporting, cooperation, deletion or return of data and audit or compliance assistance.

Cloud computing and cross-border processing

Cloud storage can result in personal data being processed across multiple systems and locations. Businesses should understand where relevant information is stored, which vendors can access it and what contractual and regulatory requirements apply.

Cross-border processing should be assessed against the DPDP Act, Rules, applicable government restrictions and sector-specific requirements in force at the relevant time. A generic statement that data is stored “in the cloud” does not by itself answer the legal or compliance questions.

Data retention and deletion

Personal data should not be retained indefinitely without a lawful and operational reason. Retention periods can be affected by the purpose of processing, contractual obligations, tax or accounting requirements, litigation holds, regulatory requirements and the applicable data-protection framework.

Organisations should maintain a retention schedule identifying what information is retained, why it is retained, where it is stored and when it should be securely deleted or anonymised where legally appropriate.

Privacy by design

Privacy should be considered when a product or service is designed rather than added after deployment. Product teams can assess what information is genuinely necessary, which users need access, what default settings are appropriate and how consent or other legal requirements will operate.

A privacy-by-design approach can also reduce the cost of later compliance changes because data flows, retention rules and access controls are considered before systems become difficult to modify.

Data privacy in mobile applications and websites

Websites and mobile applications can collect account information, device identifiers, location information, usage data, cookies and other information. Organisations should map these collection points and explain relevant processing through appropriate notices and controls.

Privacy policies should accurately describe actual practices. A policy that promises practices that the technology does not implement can create avoidable legal and compliance problems.

Artificial intelligence and personal data

AI systems may process personal data during training, testing, deployment, monitoring or customer interactions. Businesses should identify the source and category of information used by the system, the purpose of processing, retention, access and any transfer to third-party technology providers.

Where an AI tool is supplied by a third party, the contractual terms should be examined for data use, security, confidentiality, retention and secondary use. The legal position depends on the system, data and purpose involved.

Data privacy and intellectual property

Personal data and intellectual property are different legal categories, although they can arise together. A customer database may contain personal data while also constituting a valuable commercial asset. Source code may contain confidential information while logs generated by the software may contain personal data.

Businesses should therefore avoid assuming that one legal regime resolves every issue concerning a database, software system or digital product.

Data privacy and employment contracts

Employment agreements and workplace policies can address confidentiality, company-device use, information security, acceptable use and handling of personal or business information. Employers should distinguish business confidential information from employees’ personal data and apply appropriate access controls.

Exit procedures are particularly important. Access to email, cloud systems, HR platforms and internal applications should be reviewed when employment ends, while records that must legally be retained should be handled according to the applicable retention policy.

Data privacy in banking and financial services

Financial institutions process substantial quantities of personal and financial information and are subject to additional sectoral requirements. Customer information may also move between banks, payment systems, technology providers and regulated service providers.

Data-protection compliance in a regulated financial business should therefore be assessed together with the applicable directions and contractual arrangements governing the institution’s activities.

Data privacy in healthcare

Healthcare information can contain highly personal details. Hospitals, clinics, diagnostic providers, insurers and technology platforms should consider access controls, confidentiality, retention, authorised disclosures and security when processing patient information.

The exact legal requirements depend on the service, the parties involved, the nature of the data and the laws and sectoral rules applicable to the activity.

Data privacy breach response checklist

1. identify the incident and affected systems;
2. contain unauthorised access where possible;
3. preserve relevant logs and electronic evidence;
4. identify the categories of personal data affected;
5. assess the likely consequences of the incident;
6. identify affected Data Principals where practicable;
7. review contractual and statutory reporting obligations;
8. document the investigation and response;
9. remediate the vulnerability; and
10. review the incident to reduce the risk of recurrence.

Common data privacy mistakes

• Collecting personal information without identifying a clear purpose.
• Using one generic privacy notice for materially different processing activities.
• Keeping customer data indefinitely.
• Giving excessive employees access to personal information.
• Using vendors without reviewing their data-handling practices.
• Failing to maintain records of consent where consent is relied upon.
• Making it difficult to withdraw consent where withdrawal is applicable.
• Ignoring privacy issues when introducing AI or analytics tools.
• Failing to test data-breach response procedures.
• Assuming that cyber-security compliance and privacy compliance are identical.

Documents that may be relevant

Depending on the organisation and issue, relevant documents may include privacy notices, consent records, data inventories, processing maps, information-security policies, vendor agreements, employment agreements, incident reports, access-control records, retention schedules, grievance records and correspondence concerning data requests.

Data privacy issues for startups and small businesses

Smaller businesses often use third-party platforms for payments, marketing, customer support, cloud storage and communication. Even when technology is outsourced, the business should understand what personal data is being collected and which service providers receive access to it.

A practical compliance exercise can begin with a simple data map: identify the source of the data, the purpose, the system where it is stored, the persons who can access it, third-party recipients and the retention period. The organisation can then prioritise higher-risk processing activities.

Data privacy audit: practical approach

A privacy audit can be conducted by examining data collection, processing purposes, notices, consent, access controls, vendor arrangements, retention, deletion, rights requests and incident response. The audit should compare written policies with actual system behaviour.

Where a gap is identified, the organisation should document the issue, assess its significance and determine an appropriate remediation plan. Records of the review can also assist in demonstrating an organised compliance process.

What happens when a privacy dispute arises?

A privacy dispute should first be classified. It may concern unauthorised disclosure, excessive collection, refusal to correct information, failure to respond to a grievance, contractual misuse, a security incident or another issue. Different facts can lead to different statutory or contractual remedies.

Relevant evidence should be preserved, including notices, consent records, account information, communications, access logs and relevant contracts. The applicable law and commencement status should then be checked before selecting a remedy.

Data privacy and legal remedies

Depending on the facts and applicable provisions, remedies may arise through the statutory data-protection framework, contractual rights, civil proceedings, sectoral regulatory mechanisms or other applicable law. The nature of the remedy depends upon the legal right affected and the provision in force at the relevant time.

Frequently Asked Questions

1. What is data privacy law in India?

It is the legal framework governing the collection, use, storage, sharing, security and other processing of personal data. The DPDP Act and Rules are central components of the current framework, alongside other applicable laws.

2. What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s principal general statute governing the processing of digital personal data and defining rights and obligations for Data Principals and Data Fiduciaries.

3. Are the DPDP Rules 2025 in force?

The Rules were notified on 13 November 2025 with phased commencement. Different rules become operative at different times, so the applicable commencement provision should be checked for the specific obligation.

4. Who is a Data Principal?

A Data Principal is the individual to whom the personal data relates under the DPDP Act.

5. Who is a Data Fiduciary?

A Data Fiduciary is the person who, alone or in conjunction with others, determines the purpose and means of processing personal data.

6. What is a Data Processor?

A Data Processor processes personal data on behalf of a Data Fiduciary.

7. Is consent always required to process personal data?

Not necessarily. The DPDP Act provides specified grounds for processing, including consent and certain legitimate uses recognised by the statute. The appropriate basis depends on the circumstances.

8. Can a person withdraw consent?

Where processing is based on consent, the DPDP framework provides for withdrawal of consent. Organisations should have an appropriate mechanism for handling such requests.

9. What rights does a Data Principal have?

The Act provides specified rights, including rights relating to information, correction and erasure, grievance redressal and nomination, subject to the statutory conditions and commencement of the relevant provisions.

10. What is a personal data breach?

It generally refers to unauthorised processing or accidental or unlawful loss, destruction, alteration or disclosure of personal data, depending on the applicable statutory definition.

11. What should a company do after a data breach?

The company should contain the incident, preserve evidence, identify the affected information, assess the legal and contractual obligations and take the required remedial or notification steps.

12. Can an employee’s personal data be processed by an employer?

Yes, subject to the applicable legal framework and the purpose and manner of processing. Employers should implement appropriate notices, controls and safeguards.

13. Does a privacy policy alone ensure compliance?

No. A privacy policy should accurately reflect actual practices. Compliance also involves governance, security, contracts, retention, rights handling and operational controls.

14. Does data privacy apply to small businesses?

The applicability and specific obligations depend on the nature of the processing and the statutory framework. Small businesses should not assume that their size alone eliminates data-protection responsibilities.

15. Can cloud providers process personal data?

Yes, where legally and contractually permitted. Businesses should assess the provider’s role, security measures, access, location, retention, subcontracting and applicable legal requirements.

16. What is privacy by design?

Privacy by design means considering data-protection requirements while designing a product, service or system, including data minimisation, access control, transparency and appropriate retention.

17. Does cyber security compliance equal data privacy compliance?

No. Cyber security is an important part of data protection, but privacy compliance also concerns lawful processing, purpose, transparency, rights, retention and governance.

18. What records should a business maintain?

Depending on its activities, a business may maintain data inventories, notices, consent records, contracts, security records, retention schedules, rights-request records and incident-response documentation.

19. Does the DPDP Act apply to children’s data?

Yes. The Act contains specific requirements concerning children’s personal data, including provisions relating to consent and specified processing activities.

20. What is the Data Protection Board of India?

It is the statutory body established under the DPDP Act to perform the functions and exercise the powers assigned to it by the Act and applicable rules.

21. Can a person complain about misuse of personal data?

Yes, subject to the applicable statutory process. The DPDP framework provides a grievance mechanism and further statutory recourse in appropriate circumstances.

22. Can personal data be transferred outside India?

Cross-border processing is subject to the DPDP framework and any applicable restrictions or requirements in force at the relevant time. Sector-specific rules may also apply.

23. How long can personal data be retained?

Retention depends on the purpose, applicable law, contractual requirements and the relevant data-protection provisions. Organisations should maintain appropriate retention and deletion policies.

24. Can AI systems create privacy risks?

Yes. AI systems may process personal data during training, testing or operation. The source, purpose, access, retention, vendor arrangements and applicable legal basis should be assessed.

25. What is the first step in a data privacy compliance review?

A practical starting point is to identify what personal data the organisation collects, why it collects it, where it is stored, who can access it, which vendors receive it and how long it is retained.

Key takeaways

Data privacy is an ongoing legal and operational responsibility. The DPDP Act, 2023 and DPDP Rules, 2025 provide the central framework for digital personal data protection in India, while other statutes, contracts and sector-specific requirements may also apply. Organisations should map personal data, establish appropriate purposes and notices, maintain suitable security, control vendors and retention, provide mechanisms for rights and grievances, and prepare for data-breach response. Individuals should understand how their personal data is processed and use the statutory mechanisms available to them when appropriate.

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.