India: Data Protection

Subscribe
Privacy law and privacy regulation thought leadership, articles, podcasts, videos and webinars from expert sources across the legal world. Explore insights covering topics including GDPR, data protection, data privacy, and privacy protection.
Article
What Are Data Fiduciaries And Data Processors Under Indian Law?
The Digital Personal Data Protection Act, 2023 introduced a new privacy framework for India and established important roles for organisations handling digital personal data. Among the most important concepts are data fiduciaries and data processors. Understanding these roles is essential because the classification determines who decides why and how personal data is processed, who acts on another organisation's instructions and where compliance responsibility sits.
India Privacy
MH
Mansukhlal Hiralal & Co.
Article
Website Data Collection: Legal Compliance For Cookies And Tracking Technologies
Modern websites collect far more information than many businesses realise. A visitor may generate data through cookies, analytics scripts, advertising pixels, session replay tools, device identifiers, contact forms, chat widgets and other tracking technologies. For businesses operating in India, website data collection compliance therefore involves more than publishing a privacy policy. Organisations need to understand what information their website collects, why it is collected, where it goes, who receives it and what legal framework applies.
India Privacy
MH
Mansukhlal Hiralal & Co.
Article
TRAI Tightens The Screws On Spam: New Rules Target Robocalls, Rogue Senders And Weak Enforcement
The Telecom Regulatory Authority of India has published the Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026 in the Gazette of India. The amendment brings tougher rules, a revised tariff and more advanced monitoring to curb unsolicited commercial communications, including spam calls, robocalls and unauthorized messaging across Indian telecom networks.
India Media & IT
IL
IndiaLaw LLP
Article
India’s DPDP Consent Management Architecture Form November 2026
India’s data protection framework has continued to evolve since the enactment of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the subsequent introduction of the Digital Personal Data Protection Rules (the “Rules”) (together, the “DPDP regime”). The broader framework, including the applicability and commencement timeline, processing of personal data based on consent, recognition of consent managers and obligations of data fiduciaries, has already been discussed in our earlier article.
India Privacy
C
Clasis Law
Article
Digital Personal Data Protection And Residents’ Welfare Associations: What RWAs Need To Do Now
India’s data protection regime has moved from legislation to implementation. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) was enacted on 11 August 2023. The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified on 13 November 2025, together with a phased commencement framework. The result is a staggered implementation regime, with different provisions becoming operative on different dates.
India Privacy
KS
King, Stubb & Kasiva
Article
DPDP Data Breach Notification In India: Timelines, Requirements And Key Compliance Considerations
A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.
India Privacy
KS
King, Stubb & Kasiva
Article
Data Retention And Deletion Under The DPDP Act: How Long Can Businesses Retain Personal Data In India?
India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.
India Privacy
KS
King, Stubb & Kasiva
Article
What Happens To Existing SPDI Rules After Full DPDP Enforcement?
India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.
India Privacy
KS
King, Stubb & Kasiva
Article
Can Employers Monitor Employee Devices, Emails And Communications Under India’s DPDP Act?
The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services, and cybersecurity platforms.
India Privacy
KS
King, Stubb & Kasiva
Article
How Does The DPDP Act Regulate AI Training And Automated Decision-Making In India
The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.
India Privacy
KS
King, Stubb & Kasiva
Article
WhatsApp's Shift To Usernames: Impersonation Risk, Regulatory Pushback And The DPDP Compliance Test
WhatsApp’s proposed move away from phone-number-based identification towards a username-based system has, within days of being reported, triggered two distinct but connected reactions in India: public concern voiced by industry founders and privacy experts over impersonation and data-sharing risk, and a reported regulatory direction to Meta to pause the feature’s India rollout pending consultations.
India Privacy
SR
S.S. Rana & Co. Advocates
See more

Latest Videos

See more