Data Privacy & IT

The received account of Indian cross border data law is that section 16 of the Digital Personal Data Protection Act, 2023 permits transfer anywhere except to a country the Central Government restricts. That is accurate as far as it goes, and it is not the whole provision set. Rule 15 of the Digital Personal Data Protection Rules, 2025 adds a second and quite different control where a data fiduciary seeks to transfer personal data outside India, one that turns on who receives

Most of the Digital Personal Data Protection Rules, 2025 point at the data principal. Rule 23 points the other way. It authorises a Central Government demand for information addressed to a data fiduciary or an intermediary, for purposes set out in the Seventh Schedule, and in defined circumstances it lets the government forbid the recipient from telling anyone that the demand was answered. A compliance programme built only around consent and rights requests has nothing in it

Every remedy the Digital Personal Data Protection Act, 2023 gives a data principal runs through one body, so the composition and appointment of the Data Protection Board is not an administrative footnote. Sections 18 to 20 of the Act and rules 17 and 18 of the Digital Personal Data Protection Rules, 2025 are the machinery, and unlike most of the framework they are in force. Reading them closely is how an adviser works out what the Board is, who staffs it, and what has to happ

An inquiry by the Data Protection Board is the stage most compliance programmes never plan for. Section 27 of the Digital Personal Data Protection Act, 2023 gives the Board its powers, section 28 sets out the procedure it must follow, and rule 19 of the Digital Personal Data Protection Rules, 2025 puts a six month clock on the inquiry. The asymmetry matters: the procedural rules came into force on publication, while the powers they govern are not yet operative. Step 1: Fix Wh

Processing personal data to deliver a State subsidy or benefit does not run on consent. Section 7(b) of the Digital Personal Data Protection Act, 2023 makes it a legitimate use in its own right, and rule 5 of the Digital Personal Data Protection Rules, 2025 subjects it to the standards in the Second Schedule. The work is therefore not about building a consent flow but about proving that the programme sits inside the provision and meets the standards. Step 1: Note What Commenc

Section 10 of the Digital Personal Data Protection Act, 2023 imposes two separate audit duties on a Significant Data Fiduciary, and the independent data audit is the one most often collapsed into the other. One is the appointment of an independent data auditor. The other is a periodic exercise the entity itself must undertake. Rule 13 of the Digital Personal Data Protection Rules, 2025 puts a twelve month clock on the second and sends its output to the Data Protection Board.

The research and statistical exemption is the widest carve out in the Digital Personal Data Protection framework and the easiest to overstate. Section 17 of the Digital Personal Data Protection Act, 2023 disapplies the Act to processing necessary for research, archiving or statistical purposes, and rule 16 of the Digital Personal Data Protection Rules, 2025 makes that disapplication conditional on the standards in the Second Schedule. The exemption is therefore earned rather

Background and Facts The Central Government has exercised its power to remove difficulties under the Digital Personal Data Protection Act, 2023. The Removal of Difficulties Order, made through the Ministry of Electronics and Information Technology and dated October 5, 2026, corrects two pieces of text in the Act: a missing preposition in the children's consent provision, and the description of the periodic audit a Significant Data Fiduciary must undertake. The Order comes int

An appeal against a Data Protection Board order goes to the Telecom Disputes Settlement and Appellate Tribunal, which section 2(a) of the Digital Personal Data Protection Act, 2023 designates as the Appellate Tribunal for this purpose. Section 29 of the Act and rule 22 of the Digital Personal Data Protection Rules, 2025 govern the route, and both are digital by design. Step 1: Check What Is in Force Before Advising on Remedies By G.S.R. 843(E) dated November 13, 2025, issued

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to protect personal data by taking reasonable security safeguards to prevent a personal data breach. Rule 6 of the Digital Personal Data Protection Rules, 2025 turns that standard into a list of seven minimum measures, which is what makes it drafting work rather than an engineering aspiration. Step 1: Note the Duty, the Reach and the Date The duty in section 8(5) extends to personal data

A DPDP notice is not a privacy policy. It is the specific document that must accompany or precede every request for consent, and rule 3 of the Digital Personal Data Protection Rules, 2025 prescribes what it has to contain. Section 6(10) of the Digital Personal Data Protection Act, 2023 then puts the burden of proving that the notice was given on the data fiduciary, which is why the drafting and the record keeping are one exercise. Step 1: Separate the Notice From the Policy S

A data principal rights request process is the operational answer to sections 11 to 14 of the Digital Personal Data Protection Act, 2023 and to rule 14 of the Digital Personal Data Protection Rules, 2025. The provisions are short, and the work they generate is almost entirely about plumbing: who receives the request, how the person is identified, what has to be returned and within what period. Step 1: Note When the Obligations Commence By G.S.R. 843(E) dated November 13, 2025

A data retention and erasure schedule is the document that decides, for every category of personal data a business holds, when the obligation to erase bites and what displaces it. Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 that question has three distinct answers, and conflating them is where most schedules go wrong. Step 1: Establish What Is in Force and What Is Not By G.S.R. 843(E) dated November 13, 2025, issue

A service that may be used by anyone under eighteen will have to obtain verifiable parental consent before it processes that user's personal data. The obligation sits in section 9(1) of the Digital Personal Data Protection Act, 2023 and the manner of compliance is prescribed by rule 10 of the Digital Personal Data Protection Rules, 2025. Neither is in force yet, which is the first thing to establish before designing anything. Step 1: Fix the Commencement Position Before You D

Background and Facts An order against a platform is easy to obtain in form and hard to obtain in substance, because the width of the direction decides whether it can be obeyed at all. The Bombay High Court has directed the deletion of specifically identified material published in breach of an existing injunction, and has refused the wider relief sought alongside it, declining blanket monitoring of future posts and the suspension or deletion of the accounts the material came f