Data Protection Law: Complete Notes

About this subject

An ordinary day (ordering food through an application, paying through UPI, attending an online class, watching videos, booking a cab, visiting a hospital) creates data about a person: location, payments, interests, health, even screen time. Much of it is collected, stored, analysed and shared by organisations the person never meets.

Data Protection Law answers the questions this raises: who may collect the data, why, and how much; how long it may be kept; whether it can be sold or shared; what happens if it leaks; what rights the individual has over it; and who is responsible when something goes wrong.

The course is organised in six units:

1. Unit 1: Big Data and its effects on society.
2. Unit 2: The right to privacy, from its philosophical roots to its recognition as a fundamental right in India.
3. Unit 3: Key definitions, principles and jurisdictional rules of the Digital Personal Data Protection Act, 2023 (DPDP Act), compared with the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
4. Unit 4: The actors and institutions who carry the law into practice.
5. Unit 5: The rights of individuals.
6. Unit 6: Compliance, breach management, contracts and penalties.

Data and Big Data

Data is simply recorded information: a name on a form, the time an application was opened, the route walked in the morning, the seconds spent paused on a video.

For most of history, recording was slow and costly, so little was kept. Today it is almost free: storage is cheap, sensors are everywhere, and computers analyse huge quantities of information in seconds. This change in cost is the real revolution: when it becomes cheap to record everything, organisations record everything.

Big Data is the name for this situation. There is no single statutory definition of Big Data in any of the laws studied in this subject; it is a descriptive idea. It refers to datasets so large, fast-moving and varied that traditional tools cannot handle them, and to the new methods used to find patterns in them.

The Five Vs of Big Data

In 2001, the industry analyst Doug Laney described data growth in terms of three Vs: Volume, Velocity and Variety. Later writers added Veracity and Value.

V	Meaning and illustration	Legal significance
Volume	Sheer quantity: a national payments system recording crores of transactions daily; a social-media platform storing billions of photographs.	The more data held, the greater the damage if it leaks. Hence the DPDP Act lets the Central Government consider the volume and sensitivity of data when notifying a Significant Data Fiduciary, which carries extra duties.
Velocity	Speed of creation and processing: a ride-hailing application changing prices within minutes as demand rises; a bank's fraud system checking a card payment in a fraction of a second.	Decisions are made in real time, often by machines, before any human can review them.
Variety	Many forms of data: structured (a table of names and phone numbers) and, far more often, unstructured (voice notes, photographs, videos, emails, fitness-band readings).	Combined data reveals far more than any single source: a shopping list, location and music choices together may reveal a health condition or religion.
Veracity	Reliability and accuracy. Data may be wrong, outdated, fake or biased: bot-written reviews; a credit record showing someone else's loan.	Decisions based on bad data harm real people; hence the principle of accuracy (Unit 3).
Value	The usefulness of data: the insight or profit drawn from it. Raw data is like crude oil; it becomes valuable when refined through analysis.	Value for whom? The company may gain from targeted advertising while the person whose data was used gains nothing or is harmed.

How Big Data Changes Society

• Business: personalisation. An online shop recommends products from past purchases; an insurer may want to price policies on driving habits. Convenient, but it can mean different prices for different people based on predictions of how much each is willing to pay.
• Government: targeting welfare, collecting taxes, planning cities, responding to disasters; India's digital identity and payment systems let benefits reach bank accounts directly. But a government that knows a great deal about citizens holds great power over them, raising questions of purpose limitation, security and surveillance.
• Public policy: evidence instead of guesswork (disease patterns guide health spending; traffic data guides road planning). But policy inherits the errors and gaps in the data; communities poorly represented in datasets may be poorly served.
• Technology: data is the raw material of AI; the quality, fairness and lawfulness of an AI system depend heavily on the data used to build it.
• Social relationships: platforms sit between people and record every interaction. A message shared with a few friends can be copied to millions, so information leaves the context in which it was shared and privacy is harder to manage.
• Consumer behaviour: recommendation systems, notifications and endless scrolling are built on behavioural data to keep users engaged. The legal question is when a helpful suggestion becomes unfair manipulation.
• Political communication: micro-targeting means dividing voters into small groups and sending each a different message. It reaches people efficiently but can spread different promises to different audiences, make public debate harder and exploit fears.
• Platform economies: more users produce more data, more data improves the service, and a better service attracts more users. This network effect can make a few platforms extremely powerful, raising competition-law as well as privacy questions.

Legitimacy of Big Data Business Models

Is a business model legitimate simply because it is profitable and not yet prohibited? Legitimacy means more than legality. A business is legitimate when (1) the law permits it, (2) society sees it as fair, and (3) the people whose data it uses can trust it. A model can be legal today and lose legitimacy tomorrow; this is often how new laws are born.

Google

A free search engine financed largely by advertising, which is more valuable when targeted using user data. Despite enormous public benefits, the question is whether users really understand the bargain.

• In January 2019, the French data protection authority fined Google 50 million euros under the GDPR: information about advertising personalisation was not transparent enough and the consent obtained for it was not valid.
• In September 2026, the Irish Data Protection Commission imposed a further fine of 403 million euros concerning Google's processing of location data. Google has said it will appeal.
• The right to be forgotten case (Google Spain) was also against Google.

Facebook (Meta): the Cambridge Analytica affair

Facebook, now operated by Meta, offers free social networking and earns from advertising. Its legitimacy suffered a major blow in the Cambridge Analytica affair, which became public in March 2018.

• A researcher's personality quiz application on Facebook collected users' own data and, because of the platform's settings at the time, data about their friends. The data was passed to a political consulting firm, Cambridge Analytica. Facebook later said data of up to 87 million people may have been improperly shared.
• In 2019, the US Federal Trade Commission imposed a penalty of 5 billion dollars, saying Facebook had deceived users about their control over their data, in breach of a 2012 order.
• The UK Information Commissioner had earlier fined Facebook 500,000 pounds, then the maximum possible.
• In India, the Central Bureau of Investigation registered a case concerning the data of about 5.62 lakh Indian users.

Airbnb

Airbnb connects travellers with people who rent out homes; it depends on trust built through reviews, ratings and identity checks. Two data questions arise:

1. Government demands: cities and governments demand information from short-term rental platforms to enforce housing and tax rules. The European Union adopted a regulation in 2024, applicable from May 2026, requiring such platforms to share activity data with public authorities.
2. Excessive identity checks: in 2023, the Irish Data Protection Commission reprimanded Airbnb for retaining identity documents after verification, finding breaches of data minimisation and storage limitation. A trust-building tool can itself become a privacy problem.

Uber

A ride-hailing service built on real-time location data and algorithms that match riders, set prices and manage drivers. Three episodes match three topics of the course:

Episode	Course topic
In 2016, hackers accessed data of about 57 million riders and drivers. Uber paid the hackers 100,000 dollars and disclosed the breach only a year later, in November 2017, later paying 148 million dollars in a settlement with American states.	Breach notification
In August 2024, the Dutch data protection authority fined Uber 290 million euros for transferring personal data of European drivers to the United States without adequate safeguards.	Cross-border transfers
In August 2026, the same authority fined Uber about 825 million euros for deactivating drivers' accounts through automated systems without meaningful human involvement. Uber has said it will appeal.	Automated decision-making

ChatGPT (OpenAI)

A generative AI service trained on vast amounts of text.

• In March 2023, a software bug briefly let some users see the titles of other users' conversations, and some payment-related information of a small share of subscribers may have been exposed.
• Later that month, Italy's data protection authority temporarily limited processing of Italian users' data, raising concerns about the legal basis for training, transparency and age verification. Access was restored at the end of April 2023 after OpenAI introduced changes.
• A later fine imposed by the same authority was set aside by an Italian court in March 2026.

Surveillance Capitalism

Professor Shoshana Zuboff, in The Age of Surveillance Capitalism (2019), argues that many digital companies treat human experience as free raw material. They collect far more behavioural data than needed to improve their services; this extra data is behavioural surplus. It is analysed to predict what people will do now, soon and later, and these prediction products are sold to businesses that want to influence behaviour. Some scholars disagree with parts of the argument, but it gives the lawyer a useful question.

Harms of Large-Scale Data Collection

Each harm explains a rule of data protection law.

1. Disinformation

False or misleading content spreads quickly on platforms designed to maximise engagement, because shocking content attracts clicks. With micro-targeting, a false message can be shown only to those most likely to believe it, where others cannot see or correct it.

2. Profiling

3. Behavioural targeting and manipulation

A platform that knows a person's weaknesses can time an offer for the moment she is most likely to give in. Dark patterns are interface tricks (a hidden unsubscribe button, a fake countdown timer, a pre-ticked box) that push users into choices they did not intend. In India, the Central Consumer Protection Authority issued guidelines in 2023 to prevent and regulate dark patterns in online commerce, so manipulation is now a concern of consumer law as well as data protection law.

4. Digital labour monitoring (digital Taylorism)

In 1911, Frederick Winslow Taylor published The Principles of Scientific Management, proposing that work be broken into small measured tasks with control in the hands of managers. Digital Taylorism is the modern version: software measures every scan, delivery and minute of a worker's day, and algorithms assign tasks, rate performance and even end contracts, as with a delivery rider whose route, speed and ratings are tracked continuously.

The question is how far an employer may monitor. The DPDP Act lists employment purposes as a legitimate use, so employers may process employee data without consent for those purposes; the limits of employee monitoring are therefore an important area for future interpretation.

5. Algorithmic discrimination

An algorithm learns from past data, which may reflect past prejudice.

• In 2018, it was reported that Amazon had abandoned an experimental recruiting tool that had learnt to penalise job applications mentioning women.
• In the Netherlands, a childcare benefits scandal saw thousands of parents wrongly treated as fraudsters. In 2021, the Dutch data protection authority fined the tax administration 2.75 million euros for unlawfully and discriminatorily processing the dual nationality of applicants.

Discrimination by machine can be harder to detect than discrimination by a person, because it hides inside a technical system.

6. Risk to vulnerable groups

Women: data can become a tool of harassment. Location sharing can enable stalking, leaked photographs can be used for blackmail, and personal details can be posted online to invite abuse (doxxing). United Nations Women reports that, across different studies, between 16 and 58 per cent of women have experienced technology-facilitated violence.

Children: risks include profiling, targeted advertising, contact by strangers and exposure to harmful content. European regulators have imposed large fines on social-media platforms for weak protection of children's data; the Irish Data Protection Commission fined Instagram 405 million euros in 2022, partly because teenage users could run business accounts that displayed their phone numbers and email addresses publicly. Hence the DPDP Act places special duties on those who process children's data (Unit 4).

Dataism

The writer David Brooks used the term "data-ism" in 2013 for a growing belief that everything that can be measured should be measured, and that data can help make better decisions without the distortions of emotion and ideology. The historian Yuval Noah Harari popularised the term in Homo Deus: a worldview in which the universe consists of data flows and the value of anything is decided by its contribution to data processing, so the free flow of information becomes the highest value.

Dataism directly challenges the starting point of data protection law: if information should flow freely and individuals are just data-processing systems, privacy looks like an obstacle. Data protection law rests on the opposite belief.

Dataism	Data protection law
Information should flow freely; individuals are just data-processing systems.	A human being is not merely a set of data points.
Privacy looks like an obstacle.	Dignity and autonomy must limit how information about people flows; the Supreme Court of India grounded privacy in these values.

Data as an Economic and Social Resource

"Data is the new oil" captures one truth: data has enormous economic value, and companies and countries compete to control it. But the comparison misleads:

Oil	Personal data
Used up when burnt.	Can be copied endlessly and used by many at once without being used up.
Not linked to any person.	Connected to a living person who can be harmed by its misuse.

Data is also a social resource: researchers track disease, city planners study traffic, scientists train systems to detect cancer in medical images. Good data policy does not lock all data away; it allows beneficial uses while preventing harm to individuals.

Who owns personal data?

• Property view: individuals should own their data like property and be able to sell it.
• Non-commodity view: personal data is an extension of the person. In the European Union, data protection is a fundamental right, and many scholars argue that a fundamental right cannot simply be traded like goods.

The Indian choice: the DPDP Act does not use the language of ownership. It gives the individual rights over her personal data and places duties on those who process it. The individual is the Data Principal; the organisation is the Data Fiduciary, a word that signals a relationship of trust.

Open Data and Digital Public Infrastructure

Governments are among the largest collectors of data, and they increasingly share it. Open data is data made freely available for anyone to use and reuse. India's National Data Sharing and Accessibility Policy of 2012 encouraged government departments to share non-sensitive data, much of it published on the Open Government Data Platform India. Open data supports research, journalism and innovation, but must not expose personal data: data that looks anonymous can sometimes be linked back to individuals when combined with other datasets, so privacy must be designed in from the start.

Digital Public Infrastructure (DPI) means shared digital systems built for the whole country, on which both government and private services can run:

• Aadhaar: digital identity.
• Unified Payments Interface (UPI), launched in 2016: instant payments.
• DigiLocker: verified digital documents.
• Account Aggregator system, live since 2021: individuals share financial information from one institution with another through a consent-based process.

Writers associated with this approach describe it as a model in which individuals decide what data to share, with whom and for how long, so that people benefit from the value their data creates. DPI shows the promise of data at the scale of a nation. But it also concentrates huge amounts of personal data in a few systems, raising questions of security, function creep (using a system for purposes beyond those originally intended) and exclusion when systems fail. The Supreme Court placed important limits on the use of Aadhaar for such reasons (see the Aadhaar judgment below).

Data in the Age of Generative AI

Generative AI systems, such as large language models, are trained on enormous collections of text, images and code, much of it gathered from the internet. Five distinct legal questions must be kept separate:

1. Data protection: training data may include personal data (names, photographs, posts). Was its collection and processing lawful? Can a person ask for its removal? What if the model produces false statements about a real person?
2. Copyright: training data may include books, news articles and artworks. Copyright protects authors' creative expression, not the privacy of the people described in those works.
3. Contract: many websites' terms of use prohibit automated scraping.
4. Privacy of users: prompts typed into AI tools may reveal intimate details.
5. AI regulation generally: e.g. the European Union's Artificial Intelligence Act of 2024. In India, the government issued AI governance guidelines in November 2025, which do not create a separate AI statute.

The leading example of these collisions is a lawsuit in the United States; India has its own version of the same debate.

The Right to Privacy: Meaning and Foundations

A pattern of purchases can reveal a pregnancy; a pattern of locations can reveal a religion or a relationship. When such data is used to predict, target and decide, power shifts towards those who hold it. The individual's legal claim to control what is known about her is privacy, and in India data protection law ultimately rests on this constitutional right.

Privacy is a word everyone understands and no one finds easy to define. In ordinary language, it means being left alone, keeping certain things to ourselves, and deciding who may enter our lives. Two legal ideas matter:

• The right to be let alone: traced to the article The Right to Privacy in the Harvard Law Review (1890) by two American lawyers, Samuel Warren and Louis Brandeis. Worried about instant photography and sensational newspapers, they argued for protecting "the right to be let alone". A new technology made intrusion easy and the law had to respond; the pattern repeats today with smartphones, social media and AI.
• Privacy as control over information: a later, very influential idea. Privacy is the claim of individuals to decide for themselves when, how and to what extent information about them is communicated to others.

Dimensions of Privacy

Justice D.Y. Chandrachud listed many dimensions of privacy in his opinion in Puttaswamy. Five matter most here:

Dimension	What it protects
Bodily privacy	The body against unwanted intrusion: forced medical tests, compelled collection of blood samples or fingerprints, intrusive body searches.
Spatial privacy	Places, above all the home ("a person's house is her castle").
Decisional privacy	Freedom to make intimate personal choices (whom to marry, whether to have children, what to eat, how to live) without State interference.
Communicational privacy	Letters, phone calls, emails and messages against interception or reading by others.
Informational privacy	The individual's interest in controlling the collection, use and disclosure of information about herself.

These dimensions often overlap.

Informational privacy

This is the most important dimension for the subject, because in the digital world almost every intrusion happens through data. A government need not enter a home, nor a company read a diary, to learn about a person's life; enough data points suffice.

Data protection law is, at its heart, an attempt to put informational privacy into practice through rules about collection, use, sharing, security and deletion.

The Indian Journey: From Denial to Recognition

The Constitution of India does not mention privacy in express words. For decades the question was whether privacy could be read into the fundamental rights it does guarantee.

After these two cases privacy was formally not a fundamental right, but smaller benches began to recognise it anyway.

• Exceptions: (1) matters forming part of public records can be published; (2) public officials cannot claim privacy about acts done in the discharge of their official duties.
• No prior restraint: no law empowers the State or its officials to impose a prior restraint on the press.
• Damages: a public official could claim damages after publication only by showing that the statements were false and made with reckless disregard for the truth.

PUCL safeguards:

1. An interception order could ordinarily be issued only by the Home Secretary of the Central Government or of a State.
2. The authority had to consider whether the information could be obtained by other means.
3. The order would lapse after two months unless renewed, and could not run beyond six months in all.
4. A review committee would examine whether each order was lawful.

These safeguards were later written into the Telegraph Rules. The power of interception is now in Section 20 of the Telecommunications Act, 2023, in force from June 2024, with interception rules under the Act following in December 2024. The PUCL safeguards remain the foundation of Indian law on interception.

By the end of the twentieth century, smaller benches had recognised or assumed a right to privacy, while the larger benches in M.P. Sharma and Kharak Singh had been read as denying it. Only a bench larger than both could resolve the conflict; the opportunity came through the challenge to the Aadhaar scheme.

The Puttaswamy Judgment (2017)

Opinions: Justice D.Y. Chandrachud wrote the lead opinion for himself, Chief Justice J.S. Khehar, Justice R.K. Agrawal and Justice S. Abdul Nazeer. Justices J. Chelameswar, S.A. Bobde, R.F. Nariman, A.M. Sapre and S.K. Kaul wrote separate concurring opinions.

The common order signed by all nine judges has four parts:

1. The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21, and as a part of the freedoms guaranteed by Part III of the Constitution.
2. M.P. Sharma is overruled to the extent that it held that privacy is not protected by the Constitution.
3. Kharak Singh is overruled to the extent that it held the same. Justice Chandrachud added that its striking down of night-time domiciliary visits was correct and implicitly recognised privacy.
4. The later decisions that took the same position (that privacy is constitutionally protected) lay down the correct position in law.

Privacy and the golden triangle

Privacy is not a separate island. It arises primarily from Article 21 but is connected with all three Articles of the golden triangle (Articles 14, 19 and 21):

• Article 21 protects life and personal liberty; privacy is part of a dignified life.
• Article 19 protects freedoms such as speech, association and movement, which need privacy to flourish. A person who knows she is constantly watched may hesitate to speak freely, meet certain people or join an association.
• Article 14 protects against arbitrary State action, relevant when privacy is invaded unreasonably.

Dignity and autonomy

Justice Chandrachud described privacy as the constitutional core of human dignity. Dignity means every individual has worth simply as a human being; autonomy means the ability to make one's own choices about one's own life. Privacy protects both: the intimate sphere of family, marriage, procreation, the home and sexual orientation, and the right to make choices about these matters without interference.

The Court rejected the argument that privacy is an elitist concern of the rich. To the Attorney General's argument that privacy must give way to the welfare benefits the State provides, it answered that civil and political rights and socio-economic rights go together, and that the claim that the poor need no civil and political rights has been used throughout history to justify serious violations of human rights.

Informational privacy in Puttaswamy

Justice Chandrachud recognised that in the digital age every activity leaves an electronic trail, and that data mining and aggregation can reveal a great deal about a person. He:

• held that informational privacy is a facet of the right to privacy;
• recognised that dangers arise not only from the State but also from non-State actors, including companies that hold data;
• noted that the Union had set up a committee of experts chaired by Justice B.N. Srikrishna; and
• commended to the Union the need for a robust regime for data protection, balancing individual interests with legitimate State concerns such as national security, preventing crime, encouraging innovation and preventing the dissipation of welfare benefits.

Restrictions on Privacy: Legality, Need and Proportionality

Like most fundamental rights, privacy is not absolute; the question is how a restriction is tested.

Four-step proportionality test (Sikri J):

1. Is there a legitimate goal?
2. Is the measure suitable to achieve it?
3. Is there no less restrictive but equally effective alternative?
4. Is there a proper balance between the benefit and the harm to the right?

Limits drawn by Justice Sikri's opinion:

• Struck down the part of Section 57 that allowed private companies to seek Aadhaar authentication on the basis of a contract.
• Authentication records could not be kept for more than six months.
• Quashed the direction to link mobile numbers with Aadhaar; held compulsory linking of bank accounts disproportionate.
• Struck down, in its existing form, a provision allowing disclosure of information in the interest of national security.

In 2019, Parliament amended the law, deleting Section 57 and allowing private entities to use Aadhaar authentication only where another law or the government permits it.

Privacy and Competing Interests

1. National security and surveillance: a State must protect itself against terrorism and serious crime, and surveillance is one of its tools; but unlimited surveillance can silence dissent and destroy trust. The constitutional answer is not to forbid surveillance but to require a clear legal basis, a legitimate aim, proportionality and real safeguards against abuse, such as independent authorisation and oversight. This balance is also seen in the European mass surveillance case, considered later in the subject.
2. Freedom of speech: a newspaper may want to publish facts about a person's life that the person wants kept private. R. Rajagopal shows the balance: private life is protected, but public records and the official conduct of public servants are open to publication. The right to be forgotten is another meeting point of privacy and speech.
3. Business interests and freedom of trade: businesses have a fundamental right under Article 19(1)(g) to carry on trade, and data is central to many businesses; but that freedom is subject to reasonable restrictions in the interests of the general public.
4. Technology and the public interest: public health systems, welfare schemes and research depend on data, and during a disease outbreak contact tracing can save lives. Each use must still meet the tests of legality, necessity and proportionality, with limits on purpose and retention.

The Right to Be Forgotten

Concept	Meaning
Privacy	The broad interest in controlling information about oneself.
Erasure	Deleting personal data held by an organisation, such as an online shop deleting a customer's account.
Delisting (de-referencing)	A search engine removes a link from the results shown when someone searches a person's name. The original article remains on the newspaper's website; it simply becomes harder to find.
Right to be forgotten	The broader idea that a person should be able to move on from old information that is no longer relevant; it may be achieved through erasure, delisting or other means.

The Right to be Forgotten: Google Spain and After

The GDPR later wrote a right to erasure into Article 17, whose title adds the words "right to be forgotten".

Territorial Reach of Delisting

The Position in India

The DPDP Act gives a statutory right to erasure, in force from 13 May 2027. It does not expressly create a delisting right against search engines.

Mass Surveillance

Mass surveillance is the most serious form of privacy intrusion. Modern technology makes bulk collection easy; the question is whether it can ever be lawful.

Targeted surveillance	Mass or bulk surveillance
Watching a particular suspect, such as tapping the phone of a person suspected of planning a crime	Collecting large volumes of communications of many people, most of whom are suspected of nothing, and then searching through them

End-to-End Safeguards

• Necessity and proportionality assessed at every stage, from interception to the selection, examination and use of the material.
• Authorisation at the outset by a body independent of the executive.
• Independent supervision during the operation and an independent review afterwards.

British practice	Result and reason
Bulk interception	Violated Article 8: authorisation came from a government minister rather than an independent body; the categories of search terms were not included in the warrant application; search terms linked to specific individuals did not need prior internal authorisation. Violated Article 10: no adequate safeguards for confidential journalistic material.
Obtaining communications data from service providers	Violated Articles 8 and 10: not in accordance with the law.
Receiving intelligence from foreign governments	No violation.

The British law at issue has since been replaced by the Investigatory Powers Act, 2016.

Significance for Data Protection

The case turns privacy into concrete design requirements for any surveillance system: a clear legal basis, independent authorisation, limits on what is searched and stored, continuous oversight and an effective remedy. These are the ideas of legality, necessity and proportionality that Puttaswamy requires in India.

The Lesson for India

Surveillance in India is authorised mainly by the executive, under the telecommunications and information technology laws, with review by committees of executive officers, following the safeguards developed after the telephone tapping case. It is often argued that, after Puttaswamy, independent or judicial oversight is needed to satisfy proportionality. The power in Section 17 of the DPDP Act to exempt notified government agencies from the whole Act has renewed that debate.

Unit Three: Key Definitions, Principles and Jurisdiction

Three Laws, Three Models

Three laws are studied side by side: India's Digital Personal Data Protection Act, 2023 (DPDP Act), the main focus; the European Union's General Data Protection Regulation (GDPR); and the California Consumer Privacy Act (CCPA). The other two help explain the choices India made. They are not copies of each other.

Point	GDPR	CCPA	DPDP Act
Foundation	Data protection as a fundamental right of every person in the EU	Grew out of consumer protection	A third path, built mainly around consent, with a list of situations where data may be used without consent
Coverage	Comprehensive; almost every organisation; a legal basis for every act of processing	Only businesses crossing certain size or data thresholds; best known for the right to say no to sale or sharing of personal information	Shorter and simpler; only digital personal data
Vocabulary	Data subject, controller, processor	Consumer, business, service provider	Data Principal, Data Fiduciary, Data Processor

How India Reached the DPDP Act

The Information Technology Act Framework

India long had no general data protection law. The Information Technology Act, 2000, was mainly about electronic commerce and cyber offences. A 2008 amendment, in force from 2009, added:

Section 43A	Section 72A
A body corporate is liable to pay compensation if it was negligent in maintaining reasonable security practices for sensitive personal data, and the negligence caused wrongful loss or wrongful gain.	An offence for a person providing services under a lawful contract to disclose personal information obtained through that work, without consent or in breach of the contract, intending or knowing that it will cause wrongful loss or gain.

The 2011 rules under Section 43A, commonly called the Sensitive Personal Data or Information Rules, required privacy policies, consent for collecting sensitive data, and reasonable security practices. The framework was thin: it applied only to body corporates, not the government; it covered a narrow list of sensitive data; and there was no dedicated regulator.

The Road to the Act

• 2012: a Group of Experts chaired by Justice A.P. Shah, former Chief Justice of the Delhi High Court, recommended a privacy law built on national privacy principles.
• 2017 (the real turning point): the Supreme Court declared privacy a fundamental right in Puttaswamy; the government set up a committee of experts chaired by Justice B.N. Srikrishna.
• 2018: the committee submitted its report with a draft Personal Data Protection Bill.
• 2019: the Personal Data Protection Bill, 2019, was introduced in the Lok Sabha and sent to a Joint Parliamentary Committee.
• December 2021: the Committee recommended many changes, including bringing non-personal data within the law.
• August 2022: the government withdrew the Bill.
• November 2022: a fresh, much shorter draft was released for public comment.
• August 2023: the Digital Personal Data Protection Bill, 2023, was introduced and passed by both Houses within a week; it received the President's assent on 11 August 2023.

Phased Commencement

The Act is only partly in force, as it allows different provisions to commence on different dates. After draft Rules in January 2025, the government notified the final Digital Personal Data Protection Rules, 2025, on 13 November 2025, with a phased commencement:

Date	Provisions in force
13 November 2025 (immediately)	Definitions; provisions establishing the Data Protection Board; certain general provisions; the amendment to the Right to Information Act
13 November 2026 (one year)	Registration of Consent Managers
13 May 2027 (18 months)	The heart of the law: duties of Data Fiduciaries, rights of Data Principals, exemptions, and the Board's power to inquire and impose penalties

The Amendment to the Right to Information Act

Section 8(1)(j) of the Right to Information Act, 2005, earlier let a public authority refuse personal information that had no relationship to any public activity or interest, or that would cause an unwarranted invasion of privacy, unless a larger public interest justified disclosure. Section 44(3) of the DPDP Act, already in force, replaced this with a much shorter exemption for information which relates to personal information.

• Critics: this weakens transparency and accountability.
• Government: the general public interest override in Section 8(2) of the Right to Information Act still applies.

Petitions challenging this amendment and some other provisions of the Act are pending before the Supreme Court, which issued notice in February 2026 but refused to stay the amendment.

The Meaning of Personal Data

Data is very wide: a photograph, even an opinion written about a person in a file, is data. Personal data has two features:

1. About an individual, that is, a human being. A company is not an individual, so a company's turnover is not personal data, although the salary of a named employee is.
2. Identifiability is the test. The data need not carry a name. If a person can be identified by the data, or by combining it with other information, it is personal data.

Digital Personal Data

The Act protects only digital personal data, defined in Section 2(n) as personal data in digital form. Under Section 3, it applies where personal data is collected in digital form, or collected on paper and then digitised.

Anonymous and Pseudonymised Data

Point	Anonymous data	Pseudonymised data
Meaning	No individual can be identified at all, such as properly aggregated statistics	Names replaced by codes, but the key to reverse the codes still exists somewhere
GDPR	Expressly outside its scope	Still personal data
DPDP Act	Outside the definition, since not about an identifiable individual	Anonymisation and pseudonymisation are not separately defined; the simple test of identifiability decides

Special Categories of Data

Some data, such as religion, health condition, sexual orientation and biometric data, can expose a person to discrimination or violence if misused. Many laws therefore create a special category for it.

GDPR	CCPA	DPDP Act
Article 9 prohibits processing of special categories unless a specific condition applies, such as explicit consent: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data used to identify a person; health data; data about sex life or sexual orientation. Criminal convictions are dealt with separately in Article 10.	"Sensitive personal information": government identity numbers, account log-in details, precise geolocation, racial or ethnic origin, religious beliefs, health information and the contents of private messages. A consumer can ask a business to limit its use.	No separate category of sensitive personal data. All personal data receives the same basic protection.

The Indian choice was deliberate: the 2011 Rules had a category of sensitive personal data, and the 2018 and 2019 Bills had both sensitive and critical personal data. Sensitivity still matters in other ways:

• Section 10: the government must consider the volume and sensitivity of data when notifying a Significant Data Fiduciary.
• Section 33: the Board must consider the type and nature of the data affected when deciding a penalty.
• Section 9: children receive extra protection.

The Other Key Definitions

• Data Principal, Section 2(j): the individual to whom the personal data relates. For a child, it includes the parents or lawful guardian; for a person with disability, the lawful guardian acting on her behalf.
• Data Fiduciary, Section 2(i): any person who, alone or together with others, decides the purpose and means of processing personal data.
• Data Processor, Section 2(k): any person who processes personal data on behalf of a Data Fiduciary.
• Person, Section 2(s): very wide; includes an individual, a company, a firm, a Hindu undivided family, an association, and the State.

Child: Section 2(f)

DPDP Act	GDPR	CCPA
A child is an individual who has not completed 18 years of age	Age for a child's own consent to online services is 16; member states may lower it, but not below 13	Opt-in permission needed before selling or sharing the personal information of a consumer under 16

India has chosen the highest age of the three.

Processing and Breach

Processing, Section 2(x): a wholly or partly automated operation, or set of operations, performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure, dissemination, restriction, erasure and destruction.

Personal data breach, Section 2(u): any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of the data.

Other Terms

• Specified purpose, Section 2(za): the purpose mentioned in the notice given to the Data Principal.
• Consent Manager, Section 2(g): a person registered with the Board, acting as a single point of contact through which a Data Principal can give, manage, review and withdraw consent on an accessible, transparent and interoperable platform.
• Appellate Tribunal, Section 2(a): the Telecom Disputes Settlement and Appellate Tribunal, which hears appeals against the Board.
• "She", Section 2(y): the Act uses "she" for every individual, and clause (y) says this covers any gender.

The Established Principles of Data Protection

The basic principles are older than all three laws. They grew from international work in the 1970s and 1980s, especially the Privacy Guidelines adopted by the Organisation for Economic Co-operation and Development in 1980.

GDPR, Article 5

1. Lawfulness, fairness and transparency.
2. Purpose limitation: collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with them.
3. Data minimisation: adequate, relevant and limited to what is necessary.
4. Accuracy: accurate and kept up to date.
5. Storage limitation: kept in identifiable form no longer than necessary.
6. Integrity and confidentiality: kept secure.
7. Accountability, Article 5(2): the controller is responsible for all of this and must be able to demonstrate compliance.

The DPDP Approach

The DPDP Act has no single section listing principles like Article 5. In its press release on the Rules, the government described the Act as resting on seven principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. In the text, they are built into specific duties spread across several sections.

Lawfulness and the Two Grounds of Processing

Under Section 4, a person may process personal data only in accordance with the Act and for a lawful purpose, meaning any purpose not expressly forbidden by law. There are only two grounds: the Data Principal's consent, or certain legitimate uses listed in Section 7.

GDPR, Article 6: six lawful bases	DPDP Act, Section 4: two grounds
Consent; performance of a contract; compliance with a legal obligation; protection of vital interests; a task in the public interest or in the exercise of official authority; legitimate interests of the controller or a third party	Consent; certain legitimate uses under Section 7

Transparency and the Notice

Consent is meaningless if the person does not know what she is agreeing to. Under Section 5, every request for consent must be accompanied or preceded by a notice from the Data Fiduciary, telling the Data Principal:

1. the personal data and the purpose of processing;
2. how she can withdraw consent and seek grievance redressal; and
3. how she can complain to the Board.

The notice must be available, if the Data Principal so chooses, in English or in any of the languages listed in the Eighth Schedule to the Constitution.

Rule 3 adds that the notice must:

• stand on its own, independent of other information;
• be in clear and plain language;
• give an itemised description of the personal data and the specific purposes, with a description of the goods, services or uses to be enabled; and
• give a communication link and other means to withdraw consent, exercise rights and complain to the Board.

Transition, Section 5(2): where consent was given before the Act, the Data Fiduciary must give a notice as soon as reasonably practicable, and may continue processing until the Data Principal withdraws consent.

Consent in Detail

Under Section 6(1), consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action. It must signify agreement to processing for the specified purpose and be limited to the personal data necessary for that purpose.

Element	Meaning
Free	Without pressure
Specific	Tied to a particular purpose
Informed	Given after a proper notice
Unconditional	The service is not made conditional on agreeing to unrelated processing
Unambiguous, with clear affirmative action	Generally understood to rule out silence, inactivity and pre-ticked boxes; the person must act, such as clicking an unticked box or tapping an agree button

Section 6(2): any part of a consent that infringes the Act or any other law is invalid to that extent.

Withdrawal and Burden of Proof

• Section 6(4): consent may be withdrawn at any time, and withdrawal must be comparable in ease to giving consent. If consent took one tap, withdrawal should not need a letter by registered post.
• The consequences of withdrawal are borne by the Data Principal, and withdrawal does not make earlier processing illegal.
• After withdrawal, the Data Fiduciary must stop processing within a reasonable time and make its Data Processors stop, unless the law requires or authorises continued processing.
• Section 6(10): in a dispute, the burden is on the Data Fiduciary to prove that it gave a proper notice and obtained valid consent.

The GDPR has a similar idea in Article 7: the controller must be able to demonstrate consent, and withdrawal must be as easy as giving consent.

Certain Legitimate Uses

Section 7 lists uses where personal data may be processed without fresh consent:

1. Voluntary provision: where a person voluntarily gives her data for a specified purpose and has not objected to its use, the Data Fiduciary may use it for that purpose. This is the most practical use.
2. State benefits: the State and its instrumentalities may provide prescribed subsidies, benefits, services, certificates, licences or permits, using data already given for another benefit or data in notified government databases.
3. State functions: performance of any function of the State under law, or in the interest of the sovereignty and integrity of India or the security of the State.
4. Legal obligation: a legal obligation on any person to disclose information to the State.
5. Court orders: compliance with a judgment, decree or order under Indian law, and judgments or orders of a contractual or civil nature under foreign law.
6. Medical emergency: a medical emergency involving a threat to life or an immediate threat to health.
7. Epidemic: medical treatment or health services during an epidemic or other threat to public health.
8. Disaster: safety measures or assistance during a disaster or a breakdown of public order.
9. Employment: processing for the purposes of employment, or to protect the employer from loss or liability, such as preventing corporate espionage, protecting trade secrets, or providing a benefit the employee has asked for.

Items 6 to 8 are the three emergency uses.

Debate: critics argue that the use for any function of the State under any law gives the government a very broad ground of processing. Supporters respond that governments must run welfare schemes and public services without asking every citizen for fresh consent.

Purpose Limitation and Data Minimisation

Purpose limitation means data collected for one purpose should not be quietly used for another. In the DPDP Act, it works through the specified purpose: consent is given for the purpose in the notice, and Section 6(1) limits consent to the data necessary for that purpose. A genuinely new purpose generally needs a fresh notice and fresh consent, unless a legitimate use applies.

GDPR	DPDP Act
More flexible: further processing allowed if the new purpose is compatible with the original one	No compatibility test

Data minimisation means collecting only what is necessary. The telemedicine illustration shows it in action.

Accuracy

Under Section 8(3), where personal data is likely to be used for a decision that affects the Data Principal, or to be disclosed to another Data Fiduciary, the Data Fiduciary must ensure that it is complete, accurate and consistent.

Storage Limitation

Data should not be kept forever. Under Section 8(7), a Data Fiduciary must erase personal data when the Data Principal withdraws consent, or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier. It must also make its Data Processor erase the data. The exception is where retention is necessary to comply with law.

Deemed End of Purpose: Section 8(8) and Rule 8

The purpose is deemed over if the Data Principal neither approaches the Data Fiduciary nor exercises her rights for a prescribed period. Rule 8 and the Third Schedule prescribe it for three classes:

• e-commerce entities with at least 2 crore registered users in India;
• online gaming intermediaries with at least 50 lakh registered users; and
• social media intermediaries with at least 2 crore registered users.

The period is three years from the date the Data Principal last approached them or exercised her rights, or from the commencement of the Rules, whichever is latest. It applies to all purposes except letting the Data Principal access her user account or a stored virtual token usable to get money, goods or services. At least 48 hours before erasure, the Data Fiduciary must warn her that her data will be erased unless she logs in or makes contact.

Minimum Retention: Rule 8(3)

As a counterweight, every Data Fiduciary must retain personal data, associated traffic data and logs of processing for at least one year from the date of processing, for the purposes in the Seventh Schedule, such as the State's use of data for security or for functions under law.

Security and Accountability

Security, Section 8(5): a Data Fiduciary must protect personal data in its possession or control, including data processed by its Data Processors, by taking reasonable security safeguards to prevent a personal data breach. Rule 6 lists the minimum safeguards.

Accountability, Section 8(1): the Data Fiduciary is responsible for complying with the Act for all processing done by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary, and even if the Data Principal fails to perform her own duties. Under Section 8(4), it must implement appropriate technical and organisational measures to ensure effective observance of the Act.

Jurisdiction: How Far the Law Reaches

Data does not stop at borders: an Indian student may use a Singapore company's application that stores data in Ireland. Every data protection law must say how far it reaches. Section 3 of the DPDP Act answers in two parts:

1. Territorial: the Act applies to processing of digital personal data within India, whether collected in digital form or digitised later, whoever carries it out.
2. Extra-territorial: it also applies to processing outside India in connection with any activity related to offering goods or services to Data Principals within India.

DPDP Act, Section 3	GDPR, Article 3	CCPA
Processing in India; or processing abroad connected with offering goods or services to Data Principals in India. No separate monitoring trigger.	Controllers or processors established in the EU, wherever processing takes place; and those outside the EU who offer goods or services to people in the EU or monitor their behaviour within the EU. The monitoring trigger catches tracking and profiling even where nothing is sold.	Does not ask where processing happens. Applies to for-profit businesses that do business in California and cross certain thresholds; protects consumers resident in California.

The same company can fall under all three laws at once, for different users.

Where the Act Does Not Apply

• Personal or domestic purpose: if Farhan keeps his friends' birthdays in his phone, he is not a Data Fiduciary.
• Publicly available data: personal data made publicly available by the Data Principal herself, or by someone legally obliged to publish it. The Act's illustration is a blogger who shares her views and personal details on social media; the Act does not apply to that data.

This exclusion matters for artificial intelligence, since many AI developers collect large amounts of publicly available text and images from the internet. On a plain reading of Section 3, such data is outside the Act only if the Data Principal herself made it public, or a legal obligation required its publication. Data that someone else leaked or posted about her does not fall within the exclusion. No court has yet settled the precise limits of this exclusion; it remains an open and important debate.

The Brussels Effect

Professor Anu Bradford popularised the phrase, first in a law review article in 2012 and then in her book, The Brussels Effect: How the European Union Rules the World (2020). Brussels stands for the European Union, a huge and wealthy market. Companies that want to sell there must follow its strict rules, and once their systems meet European rules, it is often cheaper to follow the same rules everywhere than to keep separate systems for each country. European law therefore spreads in two ways, which Bradford calls the de facto and the de jure Brussels Effect:

De facto Brussels Effect	De jure Brussels Effect
Companies voluntarily apply European standards worldwide	Other countries copy European rules into their own laws, as many did after the GDPR

The effect explains Indian law only partly. India borrowed some vocabulary and ideas, such as purpose limitation, breach intimation and impact assessments. But it deliberately chose its own path: no legitimate interests ground, no separate category of sensitive data, no general right to data portability and no right to object.

Cross-Border Processing, Transfer and Localisation

These terms are often confused and must be kept separate:

Term	Meaning
Cross-border processing	Data about people in one country is processed in another country
Cross-border transfer	Data is sent from one country to another
Data localisation	A legal requirement that certain data be stored, or processed, only within a country
Mirroring	A softer version: a copy must be kept within the country, while processing abroad is allowed

Countries care because data sent abroad may lose the protection of domestic law; because investigators want quick access to data for law enforcement and national security; and for economic reasons, to grow data centres and digital industries at home. Businesses argue that free data flows lower costs and drive innovation.

The European Permission Model

Under Chapter V of the GDPR, personal data may leave the EU only through one of these mechanisms:

1. Adequacy decision, Article 45: the European Commission decides that a country offers an essentially equivalent level of protection.
2. Appropriate safeguards, Article 46: without adequacy, standard contractual clauses approved by the Commission, or binding corporate rules for transfers within a corporate group.
3. Derogations, Article 49: only in limited cases, such as the person's explicit consent.

• In July 2023, the European Commission adopted a new adequacy decision for the United States, the Data Privacy Framework. The General Court of the European Union upheld it in September 2025, though an appeal to the Court of Justice is pending.
• In May 2023, the Irish Data Protection Commission fined Meta 1.2 billion euros for transferring European users' data to the United States without adequate protection; Meta is challenging the decision.
• India has no EU adequacy decision, so European data sent to India must rely on tools such as standard contractual clauses.

The Indian Negative-List Model

Under Section 16(1), the Central Government may, by notification, restrict transfers of personal data to notified countries or territories outside India. This negative list or blacklist approach allows transfers by default, except to blocked countries. It is a major shift from the earlier Bills, which proposed local storage of certain categories of data. Three qualifications apply:

1. Section 16(2): any other Indian law giving a higher degree of protection or a stricter restriction on transfer continues to apply, for example the Reserve Bank of India's direction of April 2018 requiring payment system providers to store the entire data relating to payment systems only in India.
2. Rule 15: a Data Fiduciary transferring data abroad must meet any requirements the Central Government specifies, by general or special order, about making such data available to a foreign State or any person or agency under its control.
3. Rule 13(4): a Significant Data Fiduciary must ensure that personal data specified by the Central Government, on a committee's recommendation, is not transferred outside India, along with the traffic data about its flow.

Section 16 and Rule 15 come into force only with the core provisions in May 2027, and no country has been notified so far. Until then, sector-specific rules continue to govern.

Exemptions under Data Protection Laws

No data protection law applies in full to every situation; courts, police and researchers all need to process personal data.

Section 17(1): Partial Exemptions

Most of the Data Fiduciary's obligations in Chapter II, all the rights in Chapter III, and the transfer rule in Section 16 do not apply. Two duties still apply: the general responsibility under Section 8(1) and reasonable security safeguards under Section 8(5). The situations are processing:

1. necessary for enforcing a legal right or claim;
2. by a court, tribunal or other body performing judicial, quasi-judicial, regulatory or supervisory functions;
3. in the interest of prevention, detection, investigation or prosecution of any offence or contravention of law;
4. in India, of the personal data of persons outside India under a contract with a foreign person, which protects India's outsourcing industry;
5. necessary for a court or tribunal approved scheme of merger, amalgamation, compromise or arrangement of companies; and
6. to ascertain the financial information, assets and liabilities of a person who has defaulted on a loan from a financial institution.

Section 17(2): Act Not Applicable at All

1. Processing by any State instrumentality notified by the Central Government in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to any cognizable offence relating to these.
2. Processing necessary for research, archiving or statistical purposes, if the data is not used for any decision specific to a Data Principal and the processing follows prescribed standards. Rule 16 and the Second Schedule set these out, such as lawful processing, data minimisation, accuracy, security and accountability.

Section 17(3), (4) and (5)

• Section 17(3): for Data Fiduciaries or classes notified by the Central Government, including startups, the duty to give notice, the accuracy duty, the erasure duty, the Significant Data Fiduciary obligations and the right of access to information do not apply.
• Section 17(4): for processing by the State or its instrumentality, the erasure duty and the right to erasure do not apply; where the processing involves no decision affecting the Data Principal, the right to correction, completion and updating also does not apply.
• Section 17(5): within five years of commencement, the Central Government may declare that any provision shall not apply to certain Data Fiduciaries for a specified period.

Comparison of Exemptions

GDPR	CCPA	DPDP Act
Does not apply to purely personal or household activity, or to matters outside EU law such as national security. Criminal law enforcement is governed by the separate Law Enforcement Directive. Article 23 allows restriction of rights only by legislative measures that respect the essence of fundamental rights and are necessary and proportionate. Article 85 requires member states to reconcile data protection with freedom of expression, including journalism.	Exempts certain data already covered by other laws, such as some health and financial data.	No specific exemption for journalism, which matters for journalists, whose investigations inevitably process personal data.

Actors in Data Protection Law: Who Does What

Every data protection law has five kinds of characters: someone gives the data, someone decides what to do with it, someone does the technical work, someone watches over the system, and someone settles disputes. Identifying them correctly solves half of any problem.

Actor	Role under the DPDP Act	Reason
Prince	Data Principal	The data relates to him.
Food-delivery company	Data Fiduciary	It decides why the data is collected and how it is used.
Cloud company and messaging company	Data Processors	Only if they act solely on the delivery company's instructions.
Payment company	May be a Data Fiduciary in its own right	It often has its own legal duties (know-your-customer rules, fraud monitoring) and decides some purposes for itself.
Restaurant	May also be a Data Fiduciary	It may decide some things for itself.

The Data Principal

The most important person in the law is the individual. Under the DPDP Act she is called the Data Principal. The term comes from the Justice B.N. Srikrishna Committee, which saw the individual as the focal actor in the digital economy.

Definition: Section 2(j)

The definition contains two extensions:

• Where the individual is a child, the term Data Principal includes the parents or lawful guardian.
• Where the individual is a person with disability, it includes her lawful guardian acting on her behalf.

Rule 11 adds a safeguard: a Data Fiduciary must observe due diligence to verify that such a guardian has been appointed by a court, a designated authority or a local level committee under the applicable guardianship law.

The Data Principal has rights (discussed below under Rights of Individuals) and duties, which the Act sets out in Section 15.

In the GDPR the equivalent person is the data subject; in the CCPA the protected person is the consumer, meaning a natural person who is a resident of California.

The Data Fiduciary

The Data Fiduciary is the central figure of the Act.

Why the word "fiduciary"?

A fiduciary holds something in trust for another and must act in good faith for that person, like a trustee or a guardian. Both terms, Data Principal and Data Fiduciary, were introduced in the draft Bill prepared by the Justice B.N. Srikrishna Committee. The message: an organisation holding a person's data is not simply its owner; it holds that data in a relationship of trust.

Joint determination

The words "in conjunction with other persons" mean that two organisations can jointly decide purposes and means.

The GDPR has an express provision for joint controllers in Article 26, which requires them to set out their respective responsibilities in an arrangement. The DPDP Act recognises joint determination in its definition but has no separate provision on joint fiduciaries.

Equivalent terms in other laws

DPDP Act (India)	GDPR (European Union)	CCPA (California)
Data Principal	Data subject	Consumer (natural person resident in California)
Data Fiduciary	Controller	Business: a for-profit entity that determines the purposes and means of processing and crosses the statutory thresholds
Data Processor	Processor	Service provider and contractor

General Obligations of a Data Fiduciary

This list of duties is the backbone of compliance.

No.	Obligation	Provision
1	Process personal data only for a lawful purpose, on the basis of consent or a legitimate use	Section 4
2	Give a proper notice before or with every request for consent	Section 5 and Rule 3
3	Obtain consent of the required quality, allow easy withdrawal and stop processing after withdrawal	Section 6
4	Remain responsible for all processing done by it or on its behalf, even if a contract says otherwise	Section 8(1)
5	Engage a Data Processor only under a valid contract	Section 8(2)
6	Ensure accuracy, completeness and consistency where data is used for decisions or disclosed to another Data Fiduciary	Section 8(3)
7	Adopt appropriate technical and organisational measures	Section 8(4)
8	Take reasonable security safeguards	Section 8(5) and Rule 6
9	Intimate a personal data breach to the Board and to each affected Data Principal	Section 8(6) and Rule 7
10	Erase data when consent is withdrawn or the purpose is over, and make its processors do the same	Section 8(7) and 8(8), and Rule 8
11	Publish the business contact information of a Data Protection Officer, if it has one, or of a person who can answer questions about processing	Section 8(9) and Rule 9
12	Set up an effective grievance redressal mechanism	Section 8(10)
13	Follow special rules for children and persons with disability	Section 9

Special Duties towards Children

The three rules in Section 9

• Section 9(1): the Data Fiduciary must obtain the verifiable consent of the parent before processing any personal data of a child, that is, anyone under 18. The same applies to a person with disability who has a lawful guardian.
• Section 9(2): processing that is likely to cause any detrimental effect on the well-being of a child is prohibited.
• Section 9(3): tracking or behavioural monitoring of children and targeted advertising directed at children are prohibited.

Verifying the parent: Rule 10

The Data Fiduciary must adopt appropriate technical and organisational measures and observe due diligence to check that the person claiming to be the parent is an identifiable adult. It may rely on:

• reliable identity and age details already available with it; or
• details provided voluntarily, including through a virtual token issued by an authorised entity, such as a DigiLocker service.

Exemptions: Section 9(4), Rule 12 and the Fourth Schedule

Section 9(4) permits exemptions from the consent and tracking rules for prescribed classes and purposes, which are listed in Rule 12 and the Fourth Schedule.

Exempt classes

• Clinical establishments and healthcare professionals providing health services to the child.
• Educational institutions tracking and monitoring for educational activities or for the safety of their students.
• Creches and day-care centres.
• Transport providers tracking a child's location during travel to and from school.

Exempt purposes

• Creating an email account limited to communication by email.
• Determining a child's real-time location for her safety.
• Blocking harmful content and advertisements from reaching a child.
• Confirming that a user is not a child.

Each exemption is limited to what is necessary for that purpose.

Age-based exemption: Section 9(5)

The government may notify an age above which a particular Data Fiduciary is exempt from the consent and tracking obligations. It may do so only if it is satisfied that the Data Fiduciary processes children's data in a verifiably safe manner.

The Data Processor

Section 2(k) defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary. Cloud storage providers, payroll companies, call centres, email delivery services and analytics vendors often act as Data Processors.

The Indian choice: duties fall on the fiduciary

Almost all statutory duties fall on the Data Fiduciary, not on the Data Processor. The Data Fiduciary:

• may engage a Data Processor only under a valid contract;
• must ensure security safeguards for the processor's processing, and Rule 6 requires the contract to contain provisions for reasonable security safeguards;
• must make the processor stop processing after consent is withdrawn and erase data when the purpose is over.

The Act does not impose a separate list of duties or penalties on the Data Processor itself. The Data Fiduciary remains responsible to the Data Principal and to the Board.

Processors under the GDPR and the CCPA

Under Article 28 GDPR, a processor must:

• act only on documented instructions;
• ensure confidentiality;
• maintain security;
• use sub-processors only with authorisation;
• assist the controller; and
• delete or return data at the end.

GDPR processors also have direct duties, such as keeping records and notifying the controller of breaches. They can be fined directly and can be liable to pay compensation.

The CCPA uses the terms service provider and contractor. They must be bound by a written contract that limits their use of the data to the business purposes specified in it. They may not sell or share the data, or use it for their own commercial purposes outside that contract.

The Significant Data Fiduciary

Not all Data Fiduciaries pose the same risk. A neighbourhood tuition centre with 50 students is very different from a social-media platform with crores of users. So the Act creates a higher tier: the Significant Data Fiduciary.

Notification: Section 10(1)

A Significant Data Fiduciary is not defined by a fixed number. The Central Government may notify any Data Fiduciary, or class of Data Fiduciaries, as significant after assessing relevant factors:

• the volume and sensitivity of the personal data processed;
• the risk to the rights of Data Principals;
• the potential impact on the sovereignty and integrity of India;
• the risk to electoral democracy;
• the security of the State; and
• public order.

The inclusion of electoral democracy reflects the controversies over political micro-targeting: the law recognises that very large data holders can affect elections.

Additional duties: Section 10(2)

1. Appoint a Data Protection Officer.
2. Appoint an independent data auditor to evaluate its compliance.
3. Undertake other measures, namely a periodic Data Protection Impact Assessment, periodic audits and any other prescribed measures.

Rule 13

• A DPIA and an audit must be carried out once every 12 months; the person conducting them must give the Board a report containing significant observations.
• A Significant Data Fiduciary must observe due diligence to verify that its technical measures, including algorithmic software, are not likely to pose a risk to the rights of Data Principals.
• It must keep within India any personal data that the government specifies on a committee's recommendation.

Breach of these additional obligations can attract a penalty of up to 150 crore rupees.

The Data Protection Officer

The Data Protection Officer (DPO) is a new figure in Indian law.

The DPO under the DPDP Act

Only a Significant Data Fiduciary is required to appoint a DPO. Section 2(l) defines the DPO as an individual appointed by a Significant Data Fiduciary under Section 10. Section 10 lays down four requirements. The DPO must:

1. represent the Significant Data Fiduciary under the Act;
2. be based in India;
3. be an individual responsible to the Board of Directors or a similar governing body; and
4. be the point of contact for the grievance redressal mechanism.

Ordinary Data Fiduciaries

Ordinary Data Fiduciaries are not legally required to appoint a DPO. But under Section 8(9) and Rule 9, they must prominently publish on their website or application the business contact information of a person who can answer questions about the processing of personal data. That contact must also appear in every response to a Data Principal who exercises her rights. Many organisations will appoint a privacy officer anyway as good practice, but legally the DPO is a Significant Data Fiduciary requirement.

Indian DPO and European DPO compared

Point	DPDP Act	GDPR
Who must appoint	Only a Significant Data Fiduciary	Article 37: public authorities, and any controller or processor whose core activities involve large-scale regular and systematic monitoring of individuals, or large-scale processing of special categories of data or criminal records
Reports to	Board of Directors or similar governing body	Highest level of management (Article 38)
Independence	Not spelt out	Article 38: must be independent; cannot be instructed on how to perform the tasks, cannot be dismissed or penalised for performing them
Tasks	No detailed list; the DPO represents the Significant Data Fiduciary, is based in India and is the grievance contact	Article 39: informs and advises the organisation, monitors compliance, advises on impact assessments, and is the contact point for the supervisory authority

The CCPA does not require a DPO at all.

What an Indian DPO does in practice

From the Act: the DPO answers to the Board of Directors, represents the company under the Act and handles grievances. In real organisations, the DPO also usually oversees impact assessments and audits, trains staff, reviews notices and contracts, and leads the response to a data breach.

The Consent Manager

The Consent Manager is an actor quite special to India. Instead of managing consent separately with, say, five banks, three insurers and two investment platforms, a person can use a registered entity whose platform lets her give, manage, review and withdraw consent across many Data Fiduciaries from one place.

Section 6(7) to 6(9) provide that:

• a Data Principal may act through a Consent Manager;
• the Consent Manager is accountable to the Data Principal; and
• every Consent Manager must be registered with the Board.

Rule 4 and the First Schedule

• Eligibility: only a company incorporated in India, with a net worth of at least 2 crore rupees, sound management and adequate technical capacity, may be registered.
• It must act in a fiduciary capacity towards the Data Principal.
• It must arrange data sharing so that it cannot itself read the contents of the personal data.
• It must maintain records of consents given, denied or withdrawn, and keep them for at least 7 years.
• It cannot sub-contract its obligations.
• It must avoid conflicts of interest with Data Fiduciaries.
• It cannot transfer control of the company without the Board's approval.

The model is similar in spirit to the Account Aggregator system in India's financial sector.

The Data Protection Board of India

The enforcer under the DPDP Act is the Data Protection Board of India.

Structure

• Section 18 (establishment): established by notification of the Central Government. It is a body corporate: it can own property, enter into contracts, and sue or be sued in its own name.
• Section 19 (composition): a Chairperson and such number of other Members as the Central Government notifies. Members must be persons of ability, integrity and standing, with special knowledge or practical experience in fields such as data governance, consumer protection, dispute resolution, information technology, the digital economy, law or regulation. At least one must be an expert in law.
• Section 20 (term): office for 2 years, with eligibility for re-appointment.
• Section 21 (disqualification): for reasons such as insolvency, conviction for an offence involving moral turpitude, incapacity or abuse of position. Removal only after a hearing.

Selection: Rule 17

Rule 17 creates two search-cum-selection committees:

• For the Chairperson: chaired by the Cabinet Secretary, with the Secretaries of the Department of Legal Affairs and of the Ministry of Electronics and Information Technology, and two experts.
• For other Members: chaired by the Secretary of the Ministry of Electronics and Information Technology.

The Central Government then makes the appointment.

Is the Board independent?

Section 28(1) says that the Board shall function as an independent body.

• Critics point out that members are selected by committees led by government officials, appointed by the Central Government, and serve short two-year terms with the possibility of re-appointment. This may weaken independence, especially because the government itself is often a Data Fiduciary.
• Supporters reply that the Board is an adjudicatory body with statutory protections and that its orders are subject to appeal.

Comparison: under the GDPR, Article 52 requires each supervisory authority to act with complete independence. Under the CCPA, enforcement is shared between a dedicated state agency, the California Privacy Protection Agency, and the Attorney General of California.

Powers and Functions of the Board

Section 27 lists the Board's functions:

1. On intimation of a personal data breach: direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty.
2. On a complaint by a Data Principal about a breach of her personal data, or about a Data Fiduciary's failure to meet its obligations or respect her rights: inquire and impose a penalty.
3. Act on a reference from the Central Government or a State Government, or in compliance with the directions of a court.
4. Inquire into complaints against Consent Managers and breaches of their registration conditions.
5. On a Central Government reference, inquire into an intermediary's failure to follow blocking directions under Section 37.

Under Section 27(2), the Board may also issue binding directions after hearing the person concerned.

Procedure of the Board

Digital office

Section 28 requires the Board to function as a digital office as far as practicable, with complaints received, heard and decided digitally. Rule 20 repeats this and allows techno-legal measures so that physical presence is not needed.

Stages of a proceeding

1. Preliminary decision: on receiving a complaint or intimation, the Board decides whether there are sufficient grounds to proceed. If not, it closes the matter with recorded reasons.
2. Inquiry: if there are sufficient grounds, it holds an inquiry following the principles of natural justice.
3. Powers during inquiry: the Board has the powers of a civil court for summoning and examining persons on oath, requiring documents, and inspecting data and records.
4. Limit, Section 28(8): the Board must not prevent access to premises or seize equipment in a way that adversely affects a person's day-to-day functioning.
5. Interim orders: may be issued after hearing the person concerned.
6. Time limit, Rule 19: an inquiry must be completed within 6 months; the Board may extend this by up to 3 months at a time, with recorded reasons.
7. Final outcome: after a hearing, the Board either closes the proceedings or imposes a penalty under Section 33, if the breach is significant.
8. False or frivolous complaints: the Board may issue a warning or impose costs on the complainant.

Mediation and voluntary undertaking

• Section 31 (mediation): if the Board thinks a complaint can be resolved by mediation, it may direct the parties to attempt mediation.
• Section 32 (voluntary undertaking): the Board may accept a voluntary undertaking from a person at any stage of a proceeding. The person may promise to take certain action, or to stop certain action, within a time fixed by the Board. Once accepted, the undertaking bars further proceedings on the same matters. If the person breaks it, the breach is treated as a breach of the Act, and a penalty may follow.

Appeals

• Forum, Section 29: any person aggrieved by an order or direction of the Board may appeal to the Appellate Tribunal, which is the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
• Limitation: within 60 days; the Tribunal may condone delay for sufficient cause.
• Disposal: the Tribunal should try to decide the appeal within 6 months, and must record reasons if it cannot.
• Rule 22: appeals are filed digitally, and the Tribunal may function as a digital office.
• Section 30: an order of the Tribunal is executable as a decree of a civil court.
• Section 29(9): Section 18 of the Telecom Regulatory Authority of India Act applies, and a further appeal lies to the Supreme Court.
• Section 39: civil courts are barred from entertaining any suit about matters the Board is empowered to decide.

Data Protection Impact Assessment

Why conduct one?

It is far cheaper to design privacy into a system than to repair a disaster later. A DPIA forces a project team to ask hard questions at the planning stage:

• Do we really need this data?
• Who will see it?
• How long will we keep it?
• What happens if it leaks?
• Could the system treat some people unfairly?

DPIA under the DPDP Act

A DPIA is legally mandatory only for Significant Data Fiduciaries. Section 10 describes it as a process comprising:

• a description of the rights of Data Principals and the purpose of processing their personal data;
• assessment and management of the risk to those rights; and
• other prescribed matters.

Rule 13 requires it once every 12 months, together with an audit, and requires a report of significant observations to be furnished to the Board.

DPIA under the GDPR

Under Article 35, any controller must carry out a DPIA before processing that is likely to result in a high risk to people's rights and freedoms. Examples given:

• extensive automated evaluation and profiling with legal or similarly significant effects;
• large-scale processing of special categories of data;
• large-scale systematic monitoring of public places.

Minimum contents:

1. a systematic description of the processing;
2. an assessment of necessity and proportionality;
3. an assessment of the risks; and
4. the measures to address them.

If high risk remains, Article 36 requires prior consultation with the supervisory authority.

A basic DPIA: worked example

Rights of Individuals: Why Rights Matter

Principles and obligations are written for organisations; a law that speaks only to them leaves the individual waiting. Rights let the individual take the first step: ask what is being done with her data, demand a correction, ask for erasure, or complain. Rights are how data protection principles become real for an ordinary person.

Rights under the DPDP Act

The rights of the Data Principal are in Chapter III, Sections 11 to 14. Two more rights must be added: the right to withdraw consent (Section 6) and the right to complain to the Board (Section 27). These rights come into force on 13 May 2027.

Right to access information: Section 11

On request, the Data Principal can obtain from the Data Fiduciary:

1. a summary of the personal data being processed and of the processing activities undertaken with that data;
2. the identities of all other Data Fiduciaries and Data Processors with whom the data has been shared, along with a description of the data shared; and
3. any other prescribed information related to her personal data and its processing.

Exception: Section 11(2)

The Data Fiduciary need not disclose sharing with another Data Fiduciary authorised by law to obtain the data, where that other Data Fiduciary asked in writing for preventing, detecting or investigating offences or cyber incidents, or for prosecuting or punishing offences. This protects investigations from being tipped off.

Indian access right compared with the GDPR

Section 11 speaks of a summary of the personal data, not a complete copy of every record. Article 15 GDPR goes further: it gives a right to obtain a copy of the personal data, together with information such as the purposes, the recipients, the retention period and the source of the data.

Right to correction, completion, updating and erasure: Section 12

The right is exercisable in accordance with any requirement or procedure under any law for the time being in force. On receiving a request, the Data Fiduciary must:

• correct inaccurate or misleading data;
• complete incomplete data; and
• update the data.

On a request for erasure, it must erase the data, unless retention is necessary for the specified purpose or for compliance with any law.

Right of grievance redressal: Section 13

• The Data Principal has a right to readily available means of grievance redressal provided by the Data Fiduciary or the Consent Manager, covering any act or omission relating to their obligations or her rights.
• The Data Fiduciary must respond within the prescribed period.
• Rule 14: every Data Fiduciary and Consent Manager must publish the period within which it will respond to grievances, which cannot exceed 90 days.
• Section 13(3): the Data Principal must exhaust this grievance mechanism before approaching the Board. The first door is always the organisation itself.

Right to nominate: Section 14

The Data Principal may nominate any other individual to exercise her rights in the event of her death or incapacity. Incapacity means inability to exercise the rights because of unsoundness of mind or infirmity of body. Rule 14 allows a Data Principal to nominate one or more individuals, using the means provided by the Data Fiduciary.

Right to withdraw consent, and to complain to the Board

• Section 6(4): the ease of withdrawing consent must be comparable to the ease of giving it.
• Section 6(6): once consent is withdrawn, processing must stop within a reasonable time, unless the law requires or authorises it.
• Section 27: a Data Principal may file a complaint with the Board concerning a personal data breach, a Data Fiduciary's failure to meet its obligations or respect her rights, or a Consent Manager's failure to meet its obligations.

No right to compensation

Duties of the Data Principal

The DPDP Act is unusual because it also imposes duties on the individual. Section 15 lists five duties. The Data Principal must:

1. comply with all applicable laws while exercising her rights;
2. not impersonate another person while providing personal data;
3. not suppress material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State;
4. not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and
5. furnish only verifiably authentic information while exercising the right to correction or erasure.

A breach of these duties can attract a penalty of up to 10,000 rupees. In addition, under Section 28(12), the Board may warn or impose costs on a person who files a false or frivolous complaint.

Rights under the GDPR

The European catalogue is longer and more detailed, and shows what India included and left out.

Article	Right	Content
13 and 14	Right to information	The controller must tell people about the processing, whether data is collected from them or from someone else.
15	Right of access	Confirmation of whether data is being processed, and a copy of the data.
16	Right to rectification	Correction of inaccurate data.
17	Right to erasure, which the Regulation itself calls the right to be forgotten	Applies on listed grounds, such as when the data is no longer necessary, consent is withdrawn, or processing is unlawful. Does not apply where processing is necessary for freedom of expression and information, compliance with a legal obligation, public health, archiving or research, or legal claims.
18	Right to restriction of processing	Data is kept but not used, for example while its accuracy is being checked.
20	Right to data portability	Where processing is based on consent or a contract and is carried out by automated means, the person can receive the data she provided in a structured, commonly used and machine-readable format, and have it transmitted directly to another controller where technically feasible.
21	Right to object	On grounds relating to her particular situation, a person can object to processing based on legitimate interests or public tasks; the controller must stop unless it shows compelling legitimate grounds. For direct marketing, the right is absolute.
22	Rights on automated decisions	See Profiling and Automated Decisions below.

The court's reasoning in Google Spain was later written into Article 17.

Time limit: controllers usually must respond to requests within one month, which may be extended by two further months for complex requests.

Rights under the CCPA

California consumers have a different set of rights:

• Right to know what personal information a business collects, uses, sells or shares, and to access specific pieces of it.
• Right to delete, subject to exceptions.
• Right to correct inaccurate information.
• Right to opt out of the sale or sharing of personal information, usually through a link that says Do Not Sell or Share My Personal Information.
• Right to limit the use and disclosure of sensitive personal information.
• Right not to be discriminated against or retaliated against for exercising these rights.

When responding to an access request, a business must provide the information, as far as technically feasible, in a portable and readily usable format. A business must normally respond within 45 days, which it may extend once by another 45 days.

Young consumers

For young consumers, the rule on sale is reversed. If a business actually knows that a consumer is under 16, it cannot sell or share her personal information without permission:

• Age 13 to 15: she must opt in herself.
• Under 13: a parent or guardian must authorise it.

The centre of gravity of each system

System	Approach
European (GDPR)	Asks whether the organisation had a legal basis to process at all.
Californian (CCPA)	Mostly lets businesses process data but gives consumers strong tools to stop sale and sharing.
Indian (DPDP Act)	Makes consent the main gateway and then gives a smaller set of rights.

Rights the DPDP Act Does Not Contain

Several rights well known in Europe do not exist in the DPDP Act:

• No general right to data portability.
• No general right to object, apart from the right to withdraw consent and the limit in Section 7(a), under which that use ends if she says she does not consent.
• No right to restriction of processing.
• No right against automated decision-making or profiling.

Related protections framed as duties, not rights

• Section 8(3): accuracy is required where data is used to make decisions affecting the Data Principal.
• Section 9(3): tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
• Rule 13: Significant Data Fiduciaries must verify, with due diligence, that their technical measures, including algorithmic software, are not likely to risk the rights of Data Principals.

The Right to Be Forgotten in Indian Law

The DPDP Act does not use the phrase "right to be forgotten". Its right to erasure under Section 12 operates against the Data Fiduciary that holds data on the basis of consent. It does not expressly give a person a right to make a search engine delist a news report that someone else published about her.

• In Indian law, such claims are argued under Article 21, drawing on the views of Justice S.K. Kaul in Puttaswamy.
• Courts decide them by balancing privacy against the freedom of speech and the public's right to know.
• The question is still developing, and High Courts have given different answers:
  • some have refused to remove judgments, treating court records as public;
  • others have ordered names to be masked in published judgments or removed from name-based search results, especially for persons who were acquitted.
• In 2024, the Supreme Court stayed one such High Court order and agreed to examine the issue; as of now it has not given a final decision.

Profiling and Automated Decisions

GDPR: Article 22

A person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning her or similarly significantly affects her. Such decisions are allowed only where they are:

1. necessary for a contract;
2. authorised by law; or
3. based on explicit consent.

In the contract and consent cases, the person must have safeguards, at least the right to:

• obtain human intervention;
• express her point of view; and
• contest the decision.

The Dutch data protection authority relied on Article 22 when it fined Uber in August 2026 for deactivating drivers' accounts through automated systems.

California: automated decision-making technology regulations

• Regulations on automated decision-making technology were adopted under the CCPA. They took effect on 1 January 2026, but the duties specific to such technology apply only from 1 January 2027.
• They apply where the technology is used to make significant decisions about matters such as lending, housing, education, employment and healthcare.
• The consumer must receive a notice before the technology is used.
• She has a right to opt out, subject to exceptions, such as where the business offers an appeal to a human reviewer.
• She has a right to access information about how the technology was used in her case.

India

India has no equivalent right in the DPDP Act. This is one of the clearest gaps in Indian law, and it becomes more serious as artificial intelligence spreads into lending, hiring and public services.

Exercising Rights through Others

Sometimes rights must be exercised by someone else. The DPDP Act handles this in three ways, shown in the first row below.

Law	Mechanism
DPDP Act	(1) The definition of Data Principal includes the parents or lawful guardian of a child and the lawful guardian of a person with disability. (2) A nominee can act after death or incapacity under Section 14. (3) A Data Principal can manage consent through a registered Consent Manager.
GDPR	Article 80: a non-profit body may lodge complaints or bring proceedings on behalf of data subjects who mandate it
CCPA	Consumers may use an authorised agent to submit requests

Whistle-blower Protection

A whistle-blower is a person, usually an employee, who reports wrongdoing inside an organisation, such as illegal data sharing or a hidden breach. Whistle-blowers matter greatly to data protection, because many privacy scandals come to light only through insiders.

Jurisdiction	Law governing whistle-blowing
European Union	A separate law, the Whistleblower Protection Directive of 2019, covering reports of breaches of European Union law in areas that include the protection of privacy and personal data.
India	(1) The Whistle Blowers Protection Act, 2014, on disclosures of corruption or misuse of power by public servants; the government has told Parliament that it has not yet been brought into force. (2) The vigil mechanism that certain companies must establish under the Companies Act, 2013.

Compliance programme: from law on paper to law in practice

Unit 6 deals with compliance, data breaches, contracts and enforcement.

Step 1: Know your data (data inventory or data mapping)

An organisation cannot protect what it does not know it has. Compliance therefore begins with a data inventory, often called data mapping. The organisation records:

• what personal data it collects, from whom and for what purpose;
• the legal ground for each purpose;
• where the data is stored and who can access it;
• with whom it is shared; and
• how long it is kept.

Record of processing: GDPR and DPDP compared

The GDPR formally requires a record of processing activities in Article 30, with a limited exemption for smaller organisations. The DPDP Act does not use that phrase, but Indian law still makes such records practically necessary:

• Section 6(10): the Data Fiduciary must prove that it gave notice and obtained consent.
• Rule 6: it must keep logs that allow unauthorised access to be detected and investigated.
• Rule 8: it must keep personal data, traffic data and processing logs for at least one year.

Without a map of its data, an organisation cannot do any of this.

Step 2: Lawful collection, notice and consent

For each purpose in the map, the organisation must identify its ground: consent, or one of the legitimate uses in Section 7.

Where consent is used:

• The notice must meet Section 5 and Rule 3: an itemised description of the data, the specific purposes, and the link to its website or app, plus any other means to withdraw consent, exercise rights and complain to the Board.
• The consent screen must require a clear affirmative action. Pre-ticked boxes and bundled consents should go.
• Unnecessary permissions, such as access to contact lists for a shopping application, should be removed.
• The organisation needs a consent management system that records who consented to what, when, through which notice, and when consent was withdrawn.
• For children, the system must obtain verifiable parental consent as required by Rule 10.

Step 3: Security safeguards

Under Section 8(5), the Data Fiduciary must take reasonable security safeguards to prevent a personal data breach. Rule 6 sets the minimum. It requires:

1. appropriate data security measures, such as encryption, obfuscation, masking or the use of virtual tokens;
2. control over access to computer resources;
3. visibility on who is accessing personal data, through logs, monitoring and review;
4. measures for continued processing if data is compromised, such as backups;
5. retention of logs and personal data for one year for detecting and investigating unauthorised access, unless another law requires otherwise;
6. appropriate provisions on security safeguards in contracts with Data Processors; and
7. appropriate technical and organisational measures to make all of this effective.

Step 4: Internal policies and accountability

The organisation should write its rules down and assign responsibility. Typical internal policies are:

• an information security policy;
• a data retention and deletion policy;
• an access control policy;
• a breach response plan;
• a policy on handling rights requests; and
• a vendor management policy.

Someone must own each policy. In a Significant Data Fiduciary, the DPO, who is responsible to the board of directors, will usually oversee this. Elsewhere, a privacy officer or a compliance committee may do so. Staff must be trained, because many breaches begin with a careless click on a phishing email.

Step 5: Handling requests from Data Principals

As Rule 14 requires, the organisation must publish how Data Principals can exercise their rights and what details they must provide to identify themselves. It needs a process to receive requests, verify identity, search its systems, respond and keep a record. Grievances must be answered within the period the organisation has published, which cannot exceed 90 days.

Step 6: Managing processors and vendors

Most organisations rely on vendors such as cloud hosts, payment gateways, customer-support centres and marketing tools.

• Section 8(2): a Data Processor can be engaged only under a valid contract.
• Section 8(1): the Data Fiduciary remains responsible for whatever the processor does.

Vendor management is therefore not optional. Before engaging a vendor, the organisation should check its security standards. The contract should contain data protection terms (discussed below). During the relationship, the organisation should monitor the vendor through reports, certifications or audits.

Step 7: Retention and deletion

Every category of data needs a retention period. Some periods come from other laws, such as banking, tax or employment laws; others come from business need.

• When the period ends, the data must be erased, and vendors must erase their copies too, under Section 8(7).
• Large e-commerce, online gaming and social media platforms must also follow the three-year inactivity rule and the 48-hour advance warning in Rule 8.
• Deletion must be balanced with the one-year minimum retention of logs and processing data under Rule 8(3).

Deletion should be real. Moving a file to a recycle bin is not erasure.

Step 8: Audits and continuous improvement

Compliance must be tested. Significant Data Fiduciaries must carry out an annual DPIA and audit under Rule 13 and appoint an independent data auditor under Section 10. Other organisations would be wise to run periodic internal reviews, because laws, systems and products keep changing.

Personal data breaches

Meaning: Section 2(u)

Breaches therefore include hacking and ransomware, but also:

• a lost laptop;
• a misdirected email;
• an employee who looks up a celebrity's medical records out of curiosity; and
• a misconfigured cloud folder that anyone can open.

Incident response: the sequence

1. Detect the breach, through monitoring tools, staff reports or complaints from customers.
2. Contain it: disconnect affected systems, revoke stolen passwords, close the open folder.
3. Assess what has happened: which data and systems were affected, how many individuals, and what harm might follow.
4. Preserve evidence, such as logs and system images, because investigators and regulators will need them.
5. Take remedial measures, such as patching the vulnerability or resetting credentials.
6. Follow the legal notification requirements.
7. Communicate clearly with affected people where the law requires it, telling them what they can do to protect themselves.
8. Learn from the incident and prevent recurrence.

An organisation that prepares a written plan and rehearses it will respond far better than one that improvises at midnight.

Breach intimation under Indian law

Section 8(6) requires the Data Fiduciary to intimate a personal data breach to the Board and to each affected Data Principal, in the prescribed form and manner. Rule 7 prescribes that manner.

Intimation to each affected Data Principal

The Data Fiduciary must give the intimation without delay, to the best of its knowledge, in a concise, clear and plain manner, through her user account or a registered mode of communication. It must state:

• a description of the breach, its nature, extent and timing;
• the likely consequences for her;
• the measures taken to reduce the risk;
• the safety measures she herself can take; and
• the business contact details of a person who can answer her questions.

Intimation to the Board: two stages

1. Without delay: a description of the breach, including its nature, extent, timing, location and likely impact.
2. Within 72 hours of becoming aware of the breach, or a longer period if the Board allows on a written request: detailed information, including:
   • updated details;
   • the broad facts and reasons behind the breach;
   • mitigation measures;
   • any findings about the person who caused it;
   • remedial measures to prevent recurrence; and
   • a report on the intimations given to affected Data Principals.

No threshold of harm: DPDP and GDPR compared

Under the DPDP Act and the Rules, there is no threshold of harm. Every personal data breach must be intimated to the Board and to affected Data Principals. The GDPR is different.

Point	DPDP Act and Rules	GDPR
Reporting to the regulator	Every breach, to the Board: first without delay, then details within 72 hours (extendable on written request)	Article 33: to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware
Threshold for the regulator	None	No duty if the breach is unlikely to result in a risk to people's rights and freedoms
Informing individuals	Every affected Data Principal, without delay	Article 34: without undue delay, only where the breach is likely to result in a high risk to them

Rule 7, like the other core Rules, comes into force on 13 May 2027.

Sector-specific duties alongside the DPDP framework

In April 2022, the Indian Computer Emergency Response Team issued directions under the Information Technology Act. They require:

• specified kinds of cyber security incidents to be reported to it within 6 hours of noticing them; and
• logs of information technology systems to be maintained in India for a rolling period of 180 days.

Regulators in sectors such as banking also have their own reporting rules. A single incident may therefore trigger several duties under different laws, each with its own recipient and its own timeline. A good breach response plan lists all of them in advance.

Penalties and enforcement under the DPDP Act

Civil monetary penalties: Section 33

From 13 May 2027, the DPDP Act uses civil monetary penalties imposed by the Board, not criminal punishment. Under Section 33, the Board may impose a monetary penalty specified in the Schedule. This requires:

1. an inquiry;
2. a finding that the breach of the Act or the Rules by a person is significant; and
3. a hearing.

Maximum penalties under the Schedule

Breach	Maximum penalty
Failure to take reasonable security safeguards to prevent a personal data breach	Up to ₹250 crore
Failure to give the Board or affected Data Principals intimation of a breach	Up to ₹200 crore
Breach of the additional obligations relating to children	Up to ₹200 crore
Breach of the additional obligations of a Significant Data Fiduciary	Up to ₹150 crore
Breach of the duties of a Data Principal	Up to ₹10,000
Breach of a voluntary undertaking	Up to the amount applicable to the original breach
Breach of any other provision of the Act or the Rules	Up to ₹50 crore

Under Section 42, the government may amend the Schedule, but it cannot increase any penalty to more than twice the amount originally enacted.

Factors for deciding the amount: Section 33(2)

• the nature, gravity and duration of the breach;
• the type and nature of the personal data affected;
• whether the breach is repetitive;
• whether the person gained, or avoided a loss, from the breach;
• whether and how quickly the person acted to mitigate the effects;
• whether the penalty is proportionate and effective to deter breaches; and
• the likely impact of the penalty on the person.

Other enforcement tools

• Voluntary undertaking (Section 32): the Board may accept a voluntary undertaking.
• Blocking (Section 37): the Board may advise blocking in the interests of the general public, but only after imposing penalties on a Data Fiduciary in two or more instances. The Central Government may then, after giving that Data Fiduciary a hearing, direct an agency or intermediary to block public access to information that enables it to offer goods or services in India. This is a serious power and must be exercised with recorded reasons.

The compensation gap

Under Section 34, all penalties go to the Consolidated Fund of India. The DPDP Act does not provide compensation to the individual whose data was misused.

• Section 43A of the Information Technology Act today lets affected persons claim compensation from a negligent body corporate.
• Section 44(2) of the DPDP Act omits Section 43A. The omission takes effect with the core provisions on 13 May 2027, so until then Section 43A still applies.
• Section 72A of the Information Technology Act, the offence of disclosure in breach of contract, is not repealed by the DPDP Act.

Once the new framework is fully in force, a victim of a breach will have no compensation remedy under the DPDP Act itself, and will have to look to other branches of law, such as contract, tort or consumer protection, where they apply.

Point	DPDP Act	GDPR
Compensation to the individual	None under the Act; look to contract, tort or consumer protection	Article 82: any person who has suffered material or non-material damage because of an infringement has the right to receive compensation from the controller or processor

Enforcement under the GDPR and the CCPA

GDPR: administrative fines under Article 83

The GDPR allows supervisory authorities to impose administrative fines under Article 83.

• For some infringements, the maximum is €10 million or 2% of total worldwide annual turnover, whichever is higher.
• For more serious infringements, the maximum is €20 million or 4% of worldwide annual turnover, whichever is higher. These include breaches of the basic principles, the lawful bases, individual rights or the transfer rules.

Point	GDPR	DPDP Act
Design of the maximum penalty	Grows with the size of the company (percentage of worldwide turnover)	A fixed amount per category of breach

CCPA: shared enforcement

• The California Privacy Protection Agency can impose administrative fines, and the Attorney General can bring civil actions.
• Penalties are counted per violation. The statute set maximums of $2,500 for each violation and $7,500 for each intentional violation; these amounts are now adjusted for inflation.
• Because penalties are counted per violation, the totals can become large.
• Private right to sue exists in only one situation: a data breach caused by a business's failure to maintain reasonable security. The consumer may then claim statutory damages within a range fixed by the law, without proving actual loss.

The privacy policy

The privacy policy is the first data protection document most people meet. Strictly speaking, two documents should be kept apart.

Privacy notice and privacy policy distinguished

Privacy notice	Privacy policy
The specific notice given at the time of collecting data for a purpose	The broader public statement of how an organisation handles personal data
In India, must satisfy Section 5 and Rule 3	In India, the 2011 Rules under the Information Technology Act still require body corporates to publish one, and good practice will continue to require one

Contents of a good privacy policy

• the name of the organisation and its contact details, including those of the DPO or the person who answers privacy questions;
• the categories of personal data collected and the sources;
• the purposes and the legal grounds;
• with whom data is shared, including processors and other fiduciaries;
• transfers outside India;
• retention periods;
• security measures, in general terms;
• how people can exercise their rights, withdraw consent, raise grievances and complain to the Board;
• special practices for children; and
• how the policy will be updated.

Data Processing Agreements and Data Protection Agreements

The second key document is the contract between the organisation that decides the purposes and the organisation that carries out the processing.

• In Europe, it is usually called a Data Processing Agreement, because Article 28 of the GDPR requires it.
• In India, practitioners use various names, such as Data Processing Agreement, Data Protection Agreement or data protection addendum.

Main clauses

1. Subject matter: the nature and purpose of processing, and the categories of personal data and Data Principals involved.
2. Instructions: the processor will process data only on the fiduciary's documented instructions.
3. Confidentiality: the processor's staff are bound to keep the data secret.
4. Security: the safeguards the processor must maintain, at least matching Rule 6.
5. Sub-processors: whether the processor may use other vendors, with the fiduciary's prior approval and on the same terms.
6. Breach notification: the processor must inform the fiduciary immediately, or within a short fixed time, so that the fiduciary can meet its own duty to inform the Board without delay.
7. Assistance with rights requests: the processor helps the fiduciary respond to access, correction and erasure requests.
8. Retention and deletion: the processor must delete or return data at the end of the contract or when instructed, and certify deletion, while respecting any legal duty to retain logs.
9. Audit and cooperation: the fiduciary may verify compliance, and the processor must cooperate with the Board or other regulators.
10. Cross-border transfers: where the data may be stored and processed, with transfers subject to Indian law and any government restrictions.
11. Liability, indemnity and termination: who pays if things go wrong, and the fiduciary's right to terminate for serious breaches.

The data protection clause in different agreements

Not every contract needs a full separate agreement. Often a data protection clause is inserted into a larger commercial contract.

E-commerce agreements

A marketplace platform and its sellers both handle customer data. The platform collects the customer's details, and the seller needs the name and address to ship the product. The agreement should:

• state who acts as a Data Fiduciary for which purpose;
• restrict sellers from using customer data for their own marketing without a proper legal ground;
• require security; and
• set out how breaches and customer complaints will be handled.

Software as a Service (SaaS) agreements

A business subscribes to software that runs on the provider's cloud. Usually the customer is the Data Fiduciary and the provider is the Data Processor.

The data protection clause should cover processing on instructions, security standards, data location, sub-processors, breach notice, export of data at the end of the subscription, deletion and audit rights. The customer should also ensure that the provider does not use customer data to train its own AI models unless the customer has expressly agreed and the law allows it.

Cloud and technology-service agreements

The same ideas apply, with special attention to where data centres are located, how backups are handled, and how quickly the provider will restore services after an incident.

Outsourcing and vendor agreements

For call centres or document processing, the clause should cover background checks of staff, restrictions on copying data to personal devices, and the return of records.

Employment-related vendor contracts

In contracts such as background verification, the clause should limit the checks to what is necessary and lawful.

Quick revision

• Big Data has made data the raw material of business, government and artificial intelligence. It brings real benefits, from instant payments to better healthcare, but also profiling, manipulation, discrimination and surveillance.
• The Constitution of India answers these dangers with a fundamental right to privacy, rooted in dignity and autonomy, and limited only by restrictions that are lawful, necessary and proportionate.
• From that constitutional foundation comes the DPDP Act, with its definitions, its consent-based structure, its legitimate uses, its reach beyond India's borders and its exemptions.
• Throughout, the DPDP Act is compared with the GDPR and the CCPA, to see what India borrowed and what it chose differently.
• The actors: the Data Principal, the Data Fiduciary, the Data Processor, the Significant Data Fiduciary, the Consent Manager, the Data Protection Officer and the Data Protection Board.
• The rights of individuals and, just as importantly, the rights that Indian law does not contain.
• The practical world of compliance programmes, breach response, contracts and penalties.
• The connecting idea is balance. Data Protection Law does not try to stop the digital economy. It tries to ensure that the enormous benefits of data do not come at the cost of the dignity, autonomy, security and privacy of the people that data describes. As India's law comes fully into force and artificial intelligence raises new questions, that balance will be tested in boardrooms, before regulators and in courts.