Data Privacy & IT

The penalties under the Digital Personal Data Protection Act, 2023 are not in the body of the Act. They are in the Schedule, and the Schedule can be changed by notification without going back to Parliament first. The power to amend the Schedule is operative now, which makes its two limits worth knowing before the first notification rather than after. Step 1: Note That This Provision Is Operative Under commencement notification G.S.R. 843(E) dated November 13, 2025, section 41

Consent is the default route to processing under the Digital Personal Data Protection Act, 2023, and it is the route least available when something has gone badly wrong. Section 7 answers that with a list of certain legitimate uses, three of which are about emergencies. A medical emergency, a public health threat and a disaster each have their own clause, and the clauses are drafted differently from one another. Step 1: Fix the Commencement Position Section 7 belongs to the g

Most questions about the Digital Personal Data Protection Act, 2023 are asked in the wrong order. Before anything turns on consent, notice or a legitimate use, there is a prior question, and section 3 is the only provision that answers it. The application of the DPDP Act is defined by subject matter and by territory at once, and the section does the work in three short clauses. Step 1: Fix the Commencement Position Section 3 belongs to the group that comes into force eighteen

Winning an appeal is not the same as being paid. Section 30 of the Digital Personal Data Protection Act, 2023 is the provision that turns a Tribunal order into something enforceable, and the choice it offers is the part worth planning. To execute an Appellate Tribunal order there are two routes, and they are not interchangeable. Step 1: Fix the Commencement Position Section 30 belongs to the group that comes into force eighteen months after publication of commencement notific

Section 31 carries the heading alternate dispute resolution, which promises more than the section delivers. A direction to mediate is the only mechanism it provides, the Board decides whether to give one, and the section is silent on almost everything that happens next. Those silences are the practical content of the provision. Step 1: Fix the Commencement Position Section 31 belongs to the group that comes into force eighteen months after publication of commencement notifica

Section 25 of the Digital Personal Data Protection Act, 2023 is one sentence long, it is in force, and it does its work by pointing at a provision of a statute that no longer exists. The public servant deeming is therefore a provision that cannot be read on its own face. It has to be read with the repeal that overtook it. Step 1: Note That This One Is Operative Under commencement notification G.S.R. 843(E) dated November 13, 2025, sections 18 to 26 came into force on publicat

When an undertaking changes hands under a sanctioned scheme, the personal data in it moves too, and nobody asks the data principals first. The Act provides for that, but more narrowly than the deal documents usually assume. The scheme and merger exemption in clause (e) of section 17(1) attaches to an approved scheme rather than to a transaction, and it leaves two obligations standing. Step 1: Fix the Commencement Position Section 17 belongs to the group that comes into force

Most DPDP advice to employers starts with consent, which is the wrong starting point for an employment relationship. The Act provides a separate ground, and the employment legitimate use in clause (i) of section 7 carries a different set of consequences from consent: no notice obligation, and, on the text, no access or correction right running against the employer. The savings are real and so are the traps. Step 1: Fix the Commencement Position Section 7 belongs to the group

Almost every account of the Digital Personal Data Protection Act, 2023 is written about obligations that commence in 2027. Two sections are already operating, and they are the two that bear on a court's power to hear anything at all. The bar of jurisdiction in section 39 and the consistency rule in section 38 both came into force on publication of the commencement notification, which puts them in force while the obligations they sit behind are not. Step 1: Fix the Commencemen

Most DPDP advice stops at the ceiling in the Schedule. The number that will actually be imposed is governed by seven matters listed in section 33(2), and an organisation that builds its record against those matters is doing the only useful mitigation work available. The mitigation case is assembled years before it is deployed. Step 1: Fix the Commencement Position Section 33 is in the group that comes into force eighteen months after publication of the commencement notificati

The Digital Personal Data Protection Act, 2023 is usually described as adding obligations. It also takes a remedy away. Section 44(2)(a) omits section 43A of the Information Technology Act, 2000, which is the provision under which a person affected by a data breach has been able to claim compensation from the body corporate that held the data. The replacement regime penalises, but it does not compensate. Step 1: Fix the Commencement Position Section 44(2) is in the group that

Nearly every account of the Digital Personal Data Protection Act, 2023 is written about duties that commence in 2027. One change is operating now. An RTI request for personal information falls to be decided under a clause that section 44(3) rewrote, and the rewrite removed the test that public information officers had been applying for twenty years. Step 1: Fix What Is in Force, Because This Part Is Under the commencement notification G.S.R. 843(E) dated November 13, 2025, se

Almost every account of the Digital Personal Data Protection Act, 2023 is written from the fiduciary's side. Section 15 runs the other way. The duties under section 15 bind the data principal herself, and a breach of them carries the one penalty in the Act aimed at an individual rather than at an organisation. A complaint is therefore not a costless act, and the advice given before one is filed should say so. Step 1: Fix the Commencement Position Section 15 sits within sectio

The sanction practitioners overlook in the Digital Personal Data Protection Act, 2023 is not the penalty. It is the blocking direction under section 37, by which the Central Government may direct that public access to a data fiduciary's offering in India be blocked. It is not a first response to a breach. It is a consequence of a penalty record, which is what makes it a governance problem rather than a litigation one. Step 1: Fix the Commencement Position Section 37 comes int

A voluntary undertaking is the only route in the Digital Personal Data Protection Act, 2023 by which a person under inquiry can close the matter on terms it has helped write. Section 32 lets the Data Protection Board accept one at any stage of a proceeding, and acceptance bars further proceedings on what the undertaking covers. Section 31 offers a different off ramp, mediation, which is the Board's to direct rather than the party's to elect. Step 1: Fix the Commencement Posit