Data Privacy & IT

An appeal against a Data Protection Board order goes to the Telecom Disputes Settlement and Appellate Tribunal, which section 2(a) of the Digital Personal Data Protection Act, 2023 designates as the Appellate Tribunal for this purpose. Section 29 of the Act and rule 22 of the Digital Personal Data Protection Rules, 2025 govern the route, and both are digital by design. Step 1: Check What Is in Force Before Advising on Remedies By G.S.R. 843(E) dated November 13, 2025, issued

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to protect personal data by taking reasonable security safeguards to prevent a personal data breach. Rule 6 of the Digital Personal Data Protection Rules, 2025 turns that standard into a list of seven minimum measures, which is what makes it drafting work rather than an engineering aspiration. Step 1: Note the Duty, the Reach and the Date The duty in section 8(5) extends to personal data

A DPDP notice is not a privacy policy. It is the specific document that must accompany or precede every request for consent, and rule 3 of the Digital Personal Data Protection Rules, 2025 prescribes what it has to contain. Section 6(10) of the Digital Personal Data Protection Act, 2023 then puts the burden of proving that the notice was given on the data fiduciary, which is why the drafting and the record keeping are one exercise. Step 1: Separate the Notice From the Policy S

A data principal rights request process is the operational answer to sections 11 to 14 of the Digital Personal Data Protection Act, 2023 and to rule 14 of the Digital Personal Data Protection Rules, 2025. The provisions are short, and the work they generate is almost entirely about plumbing: who receives the request, how the person is identified, what has to be returned and within what period. Step 1: Note When the Obligations Commence By G.S.R. 843(E) dated November 13, 2025

A data retention and erasure schedule is the document that decides, for every category of personal data a business holds, when the obligation to erase bites and what displaces it. Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 that question has three distinct answers, and conflating them is where most schedules go wrong. Step 1: Establish What Is in Force and What Is Not By G.S.R. 843(E) dated November 13, 2025, issue

A service that may be used by anyone under eighteen will have to obtain verifiable parental consent before it processes that user's personal data. The obligation sits in section 9(1) of the Digital Personal Data Protection Act, 2023 and the manner of compliance is prescribed by rule 10 of the Digital Personal Data Protection Rules, 2025. Neither is in force yet, which is the first thing to establish before designing anything. Step 1: Fix the Commencement Position Before You D

Background and Facts An order against a platform is easy to obtain in form and hard to obtain in substance, because the width of the direction decides whether it can be obeyed at all. The Bombay High Court has directed the deletion of specifically identified material published in breach of an existing injunction, and has refused the wider relief sought alongside it, declining blanket monitoring of future posts and the suspension or deletion of the accounts the material came f

Background and Facts A single suit can engage three different sets of rights, and the remedy for each runs on a different trigger. The Delhi High Court has directed the removal of deepfake endorsements and other content misusing an educator's identity, and has ordered the intermediaries to disclose who uploaded it. The suit is Dr Vikas Divyakirti v. Meta Platforms Inc and others, before Justice Anup Jairam Bhambhani, reported on September 29, 2026. Three kinds of content were

The Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025, introduce the Consent Manager framework through Rule 4, which is scheduled to come into force on 13 November 2026. A Consent Manager is a registered intermediary that provides Data Principals (individuals whose personal data is processed) with an accessible, transparent, and interoperable platform to give, manage, review, and withdr

India's Digital Personal Data Protection Act, 2023 (DPDP Act) has introduced a regulated intermediary known as the Consent Manager, an entity that acts on behalf of individuals (called Data Principals) to manage, review, and withdraw consent given to organisations that process personal data. With the DPDP Rules, 2025 now providing the detailed operational framework, businesses seeking to operate as Consent Managers or integrate consent management into their operations face a

The Digital Personal Data Protection Act, 2023 (DPDP Act), published on August 11, 2023, has introduced a comprehensive framework for data protection in India. With the DPDP Rules notified on November 13, 2025, and full enforcement expected by mid-2027 under a phased approach, organisations must prepare their contractual frameworks to meet the new statutory requirements. A Data Processing Agreement (DPA) is an essential contract between a Data Fiduciary and a Data Processor,

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first comprehensive data protection legislation, establishing a framework for processing personal data of Indian residents. With the DPDP Rules notified on 13 November 2025, organisations face a definitive compliance deadline of 13 May 2027, when full enforcement powers and penalties take effect. The 18-month window from notification to enforcement gives businesses time to build, test, and operationalise their d

Introduction The Digital Personal Data Protection Act, 2023 (DPDP Act), which received Presidential assent on 11 August 2023, established the Data Protection Board of India (DPBI) as the primary adjudicatory body for data protection disputes in the country. The Government subsequently notified the Digital Personal Data Protection Rules, 2025 (DPDP Rules) on 13 November 2025, bringing into force several key provisions of the Act, including those relating to the establishment a

In a case with major implications for data privacy and cybersecurity in India, the Supreme Court on August 6, 2026, issued notice on a petition filed by Vitraya Technologies Pvt. Ltd. seeking a CBI or court-monitored Special Investigation Team (SIT) probe into the alleged hacking and theft of personal and medical data of approximately 1.5 lakh Indian citizens. The data was allegedly routed to a server located in Singapore, raising serious national security and privacy concern

In a significant ruling reinforcing data privacy protections for students, the Supreme Court of India in Abhishek Baxi v. Union of India (2026 LiveLaw SC 719) directed the Centre and the Central Board of Secondary Education (CBSE) to amend the consent form under the Automated Permanent Academic Account Registry (APAAR) scheme. The Court mandated the inclusion of an explicit opt-out option for parents and guardians, while also barring unauthorised third-party sharing of studen