Data Privacy & IT

The Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025, introduce the Consent Manager framework through Rule 4, which is scheduled to come into force on 13 November 2026. A Consent Manager is a registered intermediary that provides Data Principals (individuals whose personal data is processed) with an accessible, transparent, and interoperable platform to give, manage, review, and withdr

India's Digital Personal Data Protection Act, 2023 (DPDP Act) has introduced a regulated intermediary known as the Consent Manager, an entity that acts on behalf of individuals (called Data Principals) to manage, review, and withdraw consent given to organisations that process personal data. With the DPDP Rules, 2025 now providing the detailed operational framework, businesses seeking to operate as Consent Managers or integrate consent management into their operations face a

The Digital Personal Data Protection Act, 2023 (DPDP Act), published on August 11, 2023, has introduced a comprehensive framework for data protection in India. With the DPDP Rules notified on November 13, 2025, and full enforcement expected by mid-2027 under a phased approach, organisations must prepare their contractual frameworks to meet the new statutory requirements. A Data Processing Agreement (DPA) is an essential contract between a Data Fiduciary and a Data Processor,

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first comprehensive data protection legislation, establishing a framework for processing personal data of Indian residents. With the DPDP Rules notified on 13 November 2025, organisations face a definitive compliance deadline of 13 May 2027, when full enforcement powers and penalties take effect. The 18-month window from notification to enforcement gives businesses time to build, test, and operationalise their d

Introduction The Digital Personal Data Protection Act, 2023 (DPDP Act), which received Presidential assent on 11 August 2023, established the Data Protection Board of India (DPBI) as the primary adjudicatory body for data protection disputes in the country. The Government subsequently notified the Digital Personal Data Protection Rules, 2025 (DPDP Rules) on 13 November 2025, bringing into force several key provisions of the Act, including those relating to the establishment a

In a case with major implications for data privacy and cybersecurity in India, the Supreme Court on August 6, 2026, issued notice on a petition filed by Vitraya Technologies Pvt. Ltd. seeking a CBI or court-monitored Special Investigation Team (SIT) probe into the alleged hacking and theft of personal and medical data of approximately 1.5 lakh Indian citizens. The data was allegedly routed to a server located in Singapore, raising serious national security and privacy concern

In a significant ruling reinforcing data privacy protections for students, the Supreme Court of India in Abhishek Baxi v. Union of India (2026 LiveLaw SC 719) directed the Centre and the Central Board of Secondary Education (CBSE) to amend the consent form under the Automated Permanent Academic Account Registry (APAAR) scheme. The Court mandated the inclusion of an explicit opt-out option for parents and guardians, while also barring unauthorised third-party sharing of studen

India's Digital Personal Data Protection Act, 2023 (DPDPA) entered a critical phase when the Digital Personal Data Protection Rules, 2025 were notified on November 13, 2025. With the provisions rolling out in three distinct phases, 2026 is the "build and test" year for businesses across India. Phase 2, which introduces the Consent Manager Framework, takes effect on November 13, 2026. This guide explains each phase, identifies the compliance steps you must take before the dead

In a significant ruling that reinforces the boundaries of privacy within matrimonial relationships, the Telangana High Court has held that secretly recording a spouse's phone conversations constitutes a violation of the right to privacy guaranteed under Article 21 of the Constitution of India. The decision, delivered by Justice Namavarapu Rajeshwar Rao and cited as 2026 LiveLaw (Tel) 104, declares such recordings inadmissible as evidence in divorce proceedings. This judgment

The Digital Personal Data Protection Act, 2023 (DPDPA) requires every Significant Data Fiduciary (SDF) to appoint a Data Protection Officer (DPO). This guide explains who must appoint a DPO, the qualifications and responsibilities involved, and the step-by-step process for compliance under Section 10 of the Act. Who Must Appoint a DPO? Only organisations that have been officially notified as Significant Data Fiduciaries by the Central Government are required to appoint a DPO.

A Landmark Ruling on AI and Judicial Integrity On July 2, 2026, the Supreme Court of India delivered a landmark judgment that sent shockwaves through the legal community. A bench comprising Justice PS Narasimha and Justice Alok Aradhe set aside orders passed by the National Company Law Tribunal (NCLT) and the National Company Law Appellate Tribunal (NCLAT) after discovering that both forums had relied on non-existent, AI-generated "hallucinated" judicial precedents while adju

The Supreme Court of India released Draft Regulations for Artificial Intelligence in Courts on June 3, 2026. Prepared by the Supreme Court's Artificial Intelligence Committee, the draft establishes a governance framework for how AI tools may be used within the Indian judicial system. The regulations apply to all Indian courts, including subordinate courts, district tribunals, and statutory adjudicatory bodies, making this one of the most comprehensive judicial AI governance f

In a landmark ruling on the use of artificial intelligence in courts, the Supreme Court has set aside orders of the National Company Law Tribunal (NCLT) and the National Company Law Appellate Tribunal (NCLAT) after finding that both forums relied on AI generated fake citations, that is, judicial precedents that simply do not exist. The decision came on July 2, 2026 in an appeal arising from insolvency proceedings, in the matter of Pooja Ramesh Singh versus Jammu and Kashmir B

The Delhi High Court on July 1, 2026 ordered the removal of five specific social media posts targeting Rajya Sabha MP Raghav Chadha, while refusing to grant a blanket injunction against all AI-generated deepfake content about him. Justice Subramonium Prasad held that the suit does not involve personality rights, drawing an important distinction between defamatory content that crosses into vulgarity and legitimate political satire that public figures must tolerate. The Dispute

On June 3, 2026, the Supreme Court of India released its Draft Regulations for Use of Artificial Intelligence in Courts, 2026, marking a landmark step in regulating how AI tools interact with the Indian judicial system. The draft, published for public consultation with a deadline of June 20, 2026, establishes a comprehensive framework built on five core principles: human primacy, transparency, accountability, data protection, and judicial independence. For lawyers, litigants,