- in United States
- within Insurance, Family and Matrimonial and Technology topic(s)
- with readers working within the Accounting & Consultancy, Chemicals and Law Firm industries
Data has become the currency of the digital economy, but with great value comes great vulnerability. The European Union’s General Data Protection Regulation (GDPR) set the global benchmark in 2018, underscoring that privacy is not merely a regulatory concern but a fundamental right in the age of information. India followed suit in 2023, passing the Digital Personal Data Protection Act (DPDP Act), which was inspired by global standards but tailored to India’s unique digital ecosystem. The Act marks a decisive shift from the limited scope of the Information Technology Act (IT Act), 2000, towards a comprehensive privacy framework built for an era of data generation, cross-border transfers, and rising cybercrime.
The foundations of this act were laid by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India1, where a nine-judge bench unanimously affirmed the right to privacy intrinsic to Article 21 of the Constitution. This recognition elevated privacy to the level of constitutional protection, creating the normative force behind the new law.2
The DPDP Act is a forward-facing statute designed to transform corporate governance and digital strategy in India. Its core architecture introduces strict obligations for ‘Data Fiduciaries’, enhanced rights for individuals, elevated responsibilities for Significant Data Fiduciaries, and heavy penalties for non-compliance. For businesses, this is not just a legal compliance exercise but a recalibration of strategy.
This article examines how the DPDP Act rewires Indian IT law, from consent and cross-border transfers to children’s data and enforcement. It then turns to what companies can do to prepare for embedding compliance not as a box-ticking exercise, but as a cornerstone of resilience, trust, and competitiveness in India’s digital future.
Core Elements of the DPDP Act:
The DPDP Act is structured around a clear set of roles, rights, and responsibilities designed to bring predictability and accountability into India’s data ecosystem. At its core, it defines the Data Principal 3 as ‘the individual to whom the data relates’ and the Data Fiduciary4 as ‘the entity that determines how and why the data is processed.’ Supporting them are Data Processors,5 who act strictly under the Fiduciary’s instructions, but for whom the Fiduciary remains ultimately accountable.
The Act mandates that all processing of personal data must be grounded in either valid consent, i.e., informed, specific, and easily revocable, or in limited “legitimate uses” expressly provided by law. To ensure this is meaningful, Fiduciaries must provide Data Principals with concise and plain-language notices, and they bear the burden of proving that consent was lawfully obtained.
For individuals, the law enshrines enforceable rights: the ability to access information about their data, to correct or erase inaccuracies, to seek grievance redressal, and to nominate representatives to exercise these rights if they are incapacitated or deceased.
Certain categories of data attract stricter safeguards. Children’s data, defined as that of anyone under 9, requires verifiable parental consent and cannot be processed for tracking, behavioural monitoring, or targeted advertising.6 In parallel, organisations handling large-scale or sensitive data may be classified as Significant Data Fiduciaries (SDFs).7 These entities face elevated duties, including appointing a Data Protection Officer in India, conducting Data Protection Impact Assessments, and undergoing regular independent audits.
Finally, recognising India’s role in the global digital economy, the Act adopts a blacklist model for cross-border transfers: data can flow freely unless the Central Government restricts transfers to specified countries. This balances business continuity with sovereign control, and more importantly, signals a paradigm shift where privacy and accountability are core elements of how Indian businesses must operate.
The Big Divergence from IT Rules to Data Privacy Laws
The DPDP Act represents a clean break from the limited protections offered under the IT Act (200) and its Sensitive Personal Data Rules (SPDI Rules), 2011. Under the IT Act, “sensitive personal data”8 was narrowly defined, and the obligations on companies were mostly contractual, namely, to obtain consent, publish a privacy policy, and implement “reasonable security practices.” Enforcement was sporadic, and penalties were capped at damages under Section 43A IT Act, which depended on proof of wrongful loss or gain.
By contrast, the DPDP Act creates a comprehensive framework that applies to all digital personal data, not just “sensitive” categories. The requirement of ‘lawful processing’ (Sections 4–7) grounds all activity either in valid, revocable consent or in specific “legitimate uses.” Unlike the IT Act, the burden of proof now falls squarely on the Data Fiduciary to demonstrate compliance. This shift is more than procedural and marks a shift to hold Data Fiduciaries accountable.
Cross-border data transfers, once dependent on sectoral regulators or contractual clauses allow free flow unless the Government blacklists specific jurisdictions.9 This reverses the older “whitelist” style of approvals and gives businesses clarity while still preserving sovereign control.
With respect to Children’s data, the IT Act was silent, but the DPDP Act mandates verifiable parental consent for all processing of under-18 data and prohibits targeted advertising and tracking of minors.10
Most striking are the penalties. Instead of vague damages under Section 43A, the DPDP Act empowers the Data Protection Board to levy fines up to ₹250 crore per breach (Schedule of Penalties). In practice, this moves data protection from a compliance footnote to a boardroom priority where no company can afford to ignore it.
Significant Data Fiduciary: A Higher Bar
One of the most consequential innovations of the DPDP Act is the creation of the category of the Significant Data Fiduciary (SDF) under Section 10. Unlike the IT Act, which imposed uniform obligations regardless of scale or sensitivity, the DPDP Act introduces a risk-based tiering system. The Central Government may classify an entity as an SDF based on factors such as the volume and sensitivity of data processed, potential risks to the rights of Data Principals, or considerations of sovereignty and national security.
Once designated, an SDF must go well beyond baseline compliance. Key obligations include appointing a Data Protection Officer (DPO)11 based in India who reports directly to the board, conducting Data Protection Impact Assessments (DPIAs) for high-risk processing, and submitting to independent data audits. These requirements embed data governance into senior decision-making and create a chain of accountability that cannot be outsourced.
The DPDP Act, through this section, makes it clear that large or sensitive data handlers are treated as systemically important, much like banks in financial regulation. For companies likely to fall within this category, i.e., large tech platforms, financial institutions, or digital healthcare providers, the SDF regime signals that compliance is not just about risk mitigation, but about demonstrating corporate responsibility and resilience to regulators, investors, and the public.
Enforcement & Penalties: Addressing Non-Compliance
The DPDP Act also transforms the enforcement landscape. Under the IT Act’s Section 43A, penalties were limited to compensation for “wrongful loss or gain,” a standard that was vague and difficult to enforce. The DPDP Act replaces this with a deterrence model enforced by the newly established Data Protection Board of India.12
The Board functions as a digital-first regulator, with powers to conduct inquiries, summon evidence, and impose penalties on a per-contravention basis. The Schedule of Penalties allows fines of up to ₹250 crore for failing to prevent a data breach and up to ₹200 crore for failure to notify affected individuals. Other high tiers apply to violations involving children’s data or non-compliance by SDFs.
What makes this regime transformative is not only the scale of fines but their structure. Unlike the IT Act, penalties are no longer contingent on proving damages; liability arises simply from non-compliance.
In effect, the Act shifts data protection from being a legal afterthought to a core economic variable. Boards must now weigh data governance alongside capital allocation and audit, because these risks are pragmatic and forthcoming.
The Cross-Border Operating Model: Advantages and Restrictions
Under Section 16(1) of the DPDP Act, the default position is that a Data Fiduciary may transfer personal data outside India. However, this is subject to restrictions by the Central Government via notification of “blacklisted” jurisdictions, often called a blacklist or negative list approach.13
Where the old regime (SPDI Rules) required that transfers of “sensitive personal data” comply with certain contractual safeguards or jurisdictional adequacy, the DPDP Act goes further: all personal data is in scope and transfers are legally permitted unless curtailed by the notified restriction.14
In practice, the government’s discretion introduces uncertainty. As one policy analysis notes, India’s framework may disadvantage companies that rely on global platforms, because there is no requirement in the Act for adequacy determinations, standard contractual clauses, or binding corporate rules—mechanisms common in GDPR regimes.15
An illustrative note: The Data Security Council of India (DSCI) guidance articulates that crossborder transfer rules under the DPDP Act will apply to all fiduciaries and that transfers must comply with government-notified conditions.16
Thus, while the black-list model is more permissive than a hard localisation mandate, it raises two practical challenges: boards must monitor domicile country lists, and data architectures must support flexible routing should jurisdictions be blacklisted. More than ever, cross-border operations will need future-proof guardrails to preserve continuity.
Next Steps for Companies: Boardroom Planning
With the legal blueprint set, the next step before the act comes into force should be about execution at the board level. Prioritising the controls that map today’s most common breach paths: stolen credentials and vulnerability exploitation. Mandate phishing-resistant technologies, focusing on privilege/privileged-access management, and rapid patching of internet-facing/edge systems; Verizon’s 2025 DBIR shows basic web-app breaches overwhelmingly involve stolen creds, and a large share of intrusions still hinge on unpatched flaws.17 Companies need to continuously monitor and automate detection/response as an IBM report finds organisations that accelerate identification/containment (often via security AI) materially cut breach costs, helping drive the 2025 global average down to USD 4.44m.18
Operationalise DPDP fundamentals: refresh plain-language notices/consent, build revocation and grievance flows, and procure airtight legal advice. For firms likely to be designated Significant Data Fiduciaries (SDFs), pre-build the higher bar: appoint an Indiabased DPO, schedule independent data audits, and scope DPIAs for high-risk processing so you’re ready the moment designation lands.19 This moves accountability into senior governance, which is exactly what the Act intends.
Compliance with Cross-Border Operating Model
DPDPA adopts a negative-list rule for transfers: cross-border flows are permitted except to jurisdictions that the Central Government notifies as restricted.20 Companies should focus on a practical operating plan around that: maintain a transfer register (who/what/where/lawful basis), monitor government notifications, and prepare hosting/processor fallbacks so data can be rerouted if a region is blacklisted. Because the Act doesn’t require EU-style adequacy or standard contractual clauses. Companies should treat contractual safeguards as best practice, not optional.21 In short: keep global operations viable but assume geopolitical change and gear for change so a policy shift doesn’t become a business outage.
Conclusion
The Digital Personal Data Protection Act is more than a legal milestone; it is India’s declaration that the digital economy cannot thrive without trust. By moving from the IT Act’s narrow, reactive framework to a rights-based, accountability-driven regime, the law closes longstanding gaps in consent, children’s data, cross-border transfers, and corporate liability. At the same time, its creation of risk-based categories like Significant Data Fiduciaries and its deterrence-heavy enforcement model make it clear that boards, not just compliance teams, will be held answerable.
For businesses, the message is unambiguous: cybersecurity and privacy are not operational but strategic imperatives. The companies that act now by embedding governance structures, stress-testing breach response, and future-proofing cross-border operations will set themselves apart in resilience and trust. In a world where data is both currency and target, the DPDP Act transforms vigilance into the foundation of India’s digital future.
Footnotes
1. Justice K.S. Puttaswamy (Retd.) & Another v. Union of India & Others (Writ Petition (Civil) No. 494 of 2012)
2. DLA Piper, ‘Data protection laws in India’ DLA Piper Data Protection Laws of the World (6 January 2025)
3. Section 2(j) of the Digital Personal Data Protection Act 2023
4. Section 2(i) of the Digital Personal Data Protection Act 2023
5. Section 2(k) of the Digital Personal Data Protection Act 2023
6. Section 9 of the Digital Personal Data Protection Act 2023
7. Section 2(l) of the Digital Personal Data Protection Act 2023
8. Rule 3 Sensitive Personal Data Rules (SPDI Rules) 2011
9. Section 16 of the Digital Personal Data Protection Act 2023
10. Section 9 of the Digital Personal Data Protection Act 2023
11. Section 6(3) of the Digital Personal Data Protection Act 2023
12. Section 18-29 of the Digital Personal Data Protection Act 2023
13. Taxmann, ‘Cross-Border Data Transfers under the DPDP Act 2023’ Taxmann Blog (4 May 2025)
14. ibid
15. Information Technology and Innovation Foundation, ‘India Cross-Border Data Transfer Regulation’ ITIF (9 June 2025
16. Securiti.ai, ‘Cross-Border Data Transfer Requirements Under India’s DPDPA’ Securiti (28th October 2024)
17. Verizon, 2025 Data Breach Investigations Report (DBIR) (Verizon, no date)
18. IBM, Cost of a Data Breach Report 2025 (IBM, no date)
19. Section 10 of the Digital Personal Data Protection Act 2023
20. Section 16 of the Digital Personal Data Protection Act 2023
21. IAPP, ‘Operational Impacts of India’s DPDP Act: Part 5’ IAPP (October 2023)
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
