India: Data Protection

India's digital payments ecosystem has transformed financial accessibility, but it has also created new vulnerabilities through SIM swap fraud, phishing, and social engineering attacks. Recent High Court decisions are reshaping how liability is allocated among banks, telecom providers, and customers when unauthorized electronic banking transactions occur, establishing that responsibility increasingly rests with whichever participant first compromised the digital authentication process.

The digital age has transformed how personal information persists online, creating lasting associations between individuals and past events that would have once faded from public memory. When judicial records, news articles, and other content remain permanently searchable, they can continue to affect lives long after cases are resolved or circumstances have changed. This raises fundamental questions about whether Indian constitutional law recognizes a right to be forgotten and how courts should balance indi

Sound recording law is a combination of copyright, contract, privacy and new technology regulation. The law on sound recordings has undergone a major change due to the evolving music market and technological developments that have accelerated over the years. This article discusses the legal framework of IP rights in sound recordings as provided by the Copyright Act, 1957 with a special focus on ownership, assignment, licensing, and commercial exploitation of IP rights in sound recordings.

India's Draft Second Amendment to the IT Rules, 2026 represents a structural shift in digital intermediary regulation, moving beyond the targeted AI-focused First Amendment to establish a comprehensive compliance framework.

By contrast, post 2010, India witnessed explosive digital growth. By the 2014 general elections, political parties were estimated to have spent between Rs. 400 crores and Rs. 500 crores on digital platforms alone, constituting nearly 15% of the total political advertising expenditure.

India is on the verge of implementing the Digital Personal Data Protection Act, 2023 ("DPDPA"). To assist the industry with compliance, the Ministry of Electronics and Information Technology (MeitY"), is exploring a "law-to-code" framework that seeks to build compliance directly into technological infrastructure by converting law into machine-executable rules capable of being automatically implemented within digital systems.

For years, online gaming in India has expanded faster than the law has been able to define it. What began as a loosely regulated digital pastime has now evolved into a structured, high-value industry at the intersection of technology, finance and consumer law. However, the legal framework governing it has remained fragmented, shaped by state gambling laws, IT intermediary rules, tax positions and judicial attempts to distinguish skill from chance.

India’s enactment of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) marks a decisive shift toward a modern data protection regime anchored in accountability, consent, and enforcement. While the statute is primarily directed at “data fiduciaries,” its implications extend well beyond operational compliance. At the boardroom level, the Act has triggered a reassessment of governance responsibilities, risk allocation, and critically Directors and Officers (“D&O”) insurance.

India’s new Digital Personal Data Protection Act, 2023 (DPDP Act) was passed in August 2023 and notified (with its 2025 Rules) on November 13, 2025. Its implementation is phased: initial provisions...