India: Data Protection

Personal data rarely remains within one organisation. Businesses routinely share customer, employee, applicant and user information with cloud providers, SaaS platforms, payroll companies, marketing agencies, logistics providers, analytics platforms and technology vendors. This makes vendor data processing obligations an important part of privacy governance in India.

Businesses increasingly rely on customer information, employee records, analytics, cloud platforms and third party technology. As data use grows, organisations need more than a privacy policy. They need evidence showing how personal data is collected, used, stored, shared and protected.

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.

Businesses collect personal data through websites, mobile applications, customer accounts, marketing forms, financial transactions and digital services. As data use becomes more complex, consent management is no longer simply a matter of adding an “I agree” button to a website.

A privacy policy is more than a page placed in the footer of a website. It explains how a business collects, uses, stores and shares personal information. For organisations operating in India, understanding the privacy policy requirements has become increasingly important following the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

The registration of a criminal case against five daycare workers at a crèche operating within Capgemini Technology Services India Limited’s Brookefield campus in Bengaluru has brought renewed attention to a persistent gap in Indian law: the absence of a uniform, enforceable regulatory framework for workplace and standalone childcare facilities. The allegations — involving toddlers left in the care of employer-provided crèche staff — raise questions spanning criminal law, child protection legislation, employer obligations under labour law, and, increasingly, data protection law given the role that recorded video evidence played in bringing the matter to light.

The Digital Personal Data Protection Act is India's principal legislation governing the processing of digital personal data. For businesses, the law changes how customer, employee, user and other personal information must be collected, used, stored and shared. The framework is built around a balance between individual privacy and lawful use of data.

In parallel, enterprises and professional firms are adopting cloud‑based compliance platforms, AI‑driven regulatory intelligence, workflow automation and real‑time dashboards, heralding a shift from retrospective “tick‑box” compliance to continuous, real‑time and risk‑based governance.

Businesses operating in India increasingly depend on personal data for customer acquisition, employee management, payments, marketing, analytics and digital services. As a result, Data Protection Laws have become an important part of corporate compliance rather than a matter limited to the information technology department.