IT Law

Here is what you should know about data protection, DPDP act and cybersecurity compliance before you act or reply to anyone. Legals365 is the legal platform of Advocate B.K. Singh and associates, based in Delhi NCR.

In short. The Digital Personal Data Protection Act 2023 applies to any business processing digital personal data in India or offering goods or services to people in India. The DPDP Rules were notified in November 2025 with a phased start: the Data Protection Board began at once, and most duties on businesses, including notice, consent, security and breach reporting, apply from May 2027.

Every business that keeps a customer list, runs a website with a contact form, processes payroll or uses a CRM handles personal data. Until recently, Indian law on this was thin: section 43A of the IT Act and the 2011 rules on sensitive personal data, plus sector rules for banks, insurers and telecom companies. The Digital Personal Data Protection Act 2023 and the DPDP Rules notified in November 2025 change that. They set out who must do what, give individuals enforceable rights and create a Data Protection Board with power to impose penalties running into hundreds of crores.

The main obligations are not yet in force, but the window is short. This page explains what the DPDP Act requires, the phased timeline, consent and notice, the rights of individuals, children's data, security and breach reporting under both the DPDP regime and the CERT-In directions, retention and transfers abroad, significant data fiduciaries, penalties and the Board, processor contracts, sector rules, and the newer issues around AI-generated content, digital rights management and e-sports.

Law

Digital Personal Data Protection Act 2023 and DPDP Rules 2025; IT Act 2000 (ss.43A, 66, 70B, 72A, 79); CERT-In Directions of April 2022; IT (Intermediary Guidelines) Rules 2021 as amended in 2026

Regulator

Data Protection Board of India (digital office); CERT-In for cyber incidents; sector regulators such as RBI, SEBI and IRDAI

Commencement

Rules notified 13 November 2025; Board provisions at once; consent managers after 12 months; most other duties after 18 months (May 2027)

Breach reporting

To the Board and affected individuals without delay, with a detailed report to the Board within 72 hours; to CERT-In within 6 hours of noticing a reportable incident

Penalties

Up to 250 crore for failing to take reasonable security safeguards; up to 200 crore for breach notification and children's data failures

Appeal

From the Board to the Telecom Disputes Settlement and Appellate Tribunal within 60 days

What does the DPDP Act require, and when?

The DPDP Act requires anyone who decides why and how digital personal data is processed (a data fiduciary) to process it only for a lawful purpose, on the basis of consent or a listed legitimate use, after giving a clear notice; to keep it accurate and secure; to report breaches; to erase it when the purpose is served; and to let individuals exercise their rights. It covers data collected in digital form and data collected on paper and later digitised. It does not cover purely personal or domestic use, or data that the individual has made publicly available.

The Act applies to processing within India and also to processing outside India if it is connected with offering goods or services to people in India. A foreign SaaS company with Indian customers, or an overseas e-commerce site shipping to India, is covered.

Commencement is phased. The provisions setting up the Data Protection Board took effect when the Rules were notified on 13 November 2025. The provisions on registration of consent managers take effect twelve months later, in November 2026. The core duties of data fiduciaries, including notice, consent, security safeguards, breach intimation, retention limits, children's data and rights of individuals, take effect eighteen months after notification, in May 2027. Businesses that start now have time to do this properly; those that wait until early 2027 will be rewriting systems in a hurry.

The DPDP timeline at a glance

Data fiduciary, data processor and significant data fiduciary

The data fiduciary is the business that decides the purpose and means of processing. It carries the legal responsibility even when the work is done by someone else. A data processor processes data on the fiduciary's behalf, for example a cloud provider, a payroll vendor, a call centre or a marketing agency. Under the Act, the fiduciary may engage a processor only under a valid contract, and remains liable for what the processor does.

The government can notify any fiduciary or class of fiduciaries as significant data fiduciaries, based on the volume and sensitivity of data, the risk to individuals, and effects on sovereignty, electoral democracy and public order. Large platforms, big banks and health data businesses are the likely candidates. Significant data fiduciaries carry extra duties, discussed below.

The individual whose data is processed is the data principal. For a child (anyone under 18) or a person with a disability who has a lawful guardian, the parent or guardian acts as data principal for consent. A business should work out early which of its activities make it a fiduciary and which make it a processor for someone else, because the duties and the contracts are different.

Consent, notice and legitimate uses

Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. Pre-ticked boxes, consent buried in terms of use and bundled consent for unrelated purposes will not meet the standard. Every request for consent must come with a notice, in clear and plain language, describing the data, the purpose, how to withdraw consent, how to exercise rights and how to complain to the Board. The notice must be available in English or any language in the Eighth Schedule of the Constitution if the individual asks.

Withdrawal of consent must be as easy as giving it. Once consent is withdrawn, the fiduciary and its processors must stop processing for that purpose within a reasonable time, unless the law requires retention. Consent managers, registered with the Board, will let individuals give, manage and withdraw consent across fiduciaries from one platform.

Consent is not the only ground. Section 7 lists legitimate uses where consent is not needed, such as data voluntarily provided by the individual for a specified purpose where they have not objected, compliance with a law or court order, medical emergencies, disaster response and employment-related purposes. Section 17 adds exemptions, including processing to enforce legal rights and claims, for prevention and investigation of offences, for approved mergers and schemes, and to ascertain the financial position of a person who has defaulted on a loan. Lenders and recovery teams should note the last one, but it is narrow and does not permit harassment or disclosure to third parties; see our page on illegal recovery practices.

Rights of individuals and how complaints work

Data principals have the right to obtain a summary of their data and the processing activities, the identities of others with whom it has been shared; the right to correction, completion, updating and erasure; the right to grievance redressal; and the right to nominate someone to exercise their rights after death or incapacity. Fiduciaries must publish how these rights can be exercised and must respond within the time set in their published policy, which the Rules cap at 90 days for grievances.

An individual must first use the fiduciary's grievance mechanism before going to the Data Protection Board. The Board works as a digital office: complaints are filed online, hearings can be held virtually, and the Board can inquire, direct urgent measures and impose penalties. It cannot award compensation to the individual. A person who wants compensation for loss caused by a data breach still has to look to other remedies, such as a consumer complaint or, while it remains in force, a claim under section 43A of the IT Act. Our page on consumer complaints explains the consumer route.

Individuals also have duties under the Act. They must not file false or frivolous complaints, impersonate others or suppress material information, and the Board can impose a penalty up to ten thousand rupees for breach of these duties.

Children's data: schools, ed-tech, gaming and e-sports

For anyone under 18, the fiduciary must obtain verifiable consent from a parent or lawful guardian before processing. The Rules allow verification through reliable identity and age details already held by the fiduciary, details voluntarily provided, or virtual tokens issued by an authorised entity, including through DigiLocker. Fiduciaries must not undertake tracking, behavioural monitoring or targeted advertising directed at children, or any processing likely to harm a child's well-being.

Some categories are exempted from parts of these duties under the Fourth Schedule to the Rules, such as clinical establishments, educational institutions and childcare providers for specified purposes like health services, education, safety and tracking location during transport. Exemptions are tied to purpose, so a school app that also runs marketing must still meet the full standard for the marketing part.

Ed-tech platforms, gaming and e-sports platforms, social media and any service popular with teenagers should map which users may be minors, how age is established, and which features use behavioural data. A design built around engagement metrics may need to be changed for under-18 users rather than just covered with a new consent screen.

Security safeguards and breach reporting

The DPDP Rules require reasonable security safeguards, including encryption, obfuscation, masking or virtual tokens; access controls; visibility over access through logs and monitoring; measures for continued processing after a breach, such as backups; and retention of logs and personal data for at least one year to detect and investigate breaches. Processors must be bound by contract to the same standards. Failure to take reasonable safeguards to prevent a breach carries the highest penalty in the Act, up to 250 crore.

When a personal data breach occurs, the fiduciary must inform each affected individual without delay, in plain language, describing the breach, its likely consequences, the steps taken and those the individual can take, and a contact person. It must also inform the Board without delay, and give a detailed report within 72 hours covering the facts, the cause, the persons responsible if known, remedial steps and the notifications made. The Board can allow more time on request.

Separately, and already in force, the CERT-In Directions of April 2022 issued under section 70B of the IT Act require service providers, intermediaries, data centres and body corporates to report specified cyber incidents, including data breaches, data leaks, ransomware and unauthorised access, to CERT-In within six hours of noticing them. They also require logs to be kept for 180 days within India and system clocks to be synchronised with official time sources. Many businesses learn of these directions only after an incident.

Who must be told after a breach

Retention, erasure and transfers abroad

Personal data must be erased once the purpose is no longer being served or consent is withdrawn, unless the law requires retention. The Rules fix specific periods for large e-commerce platforms, online gaming intermediaries and social media intermediaries in the Third Schedule: data of users who have not engaged for three years must be erased, with notice to the user at least 48 hours before. Every business needs a retention schedule that matches each category of data to a legal or business reason, and a process for deleting data from production systems, backups and processor systems.

Retention is often driven by other laws. Tax records must be kept for the period under income tax and GST law, KYC records under the PMLA rules, employee records under the Labour Codes, and medical records under clinical establishment rules. These legal requirements override the erasure duty for that data, but only for as long as the law requires.

The Act allows transfer of personal data outside India except to countries the government restricts by notification. Sector rules that impose stricter localisation, such as the RBI's requirement that payment system data be stored in India, continue to apply. Significant data fiduciaries may face localisation for categories of data notified on the recommendation of a committee. For foreign investment and group structures where data flows to a parent abroad, see our page on FDI and FEMA compliance.

Extra duties for significant data fiduciaries

A significant data fiduciary must appoint a Data Protection Officer based in India who is responsible to the board of directors and acts as the point of contact for grievances; appoint an independent data auditor; and carry out periodic data protection impact assessments and audits. The Rules require these every twelve months, with the significant findings reported to the Board.

It must also verify that algorithmic software used for processing personal data does not pose a risk to the rights of individuals, which brings AI models and automated decision systems into the audit. Where the government notifies categories of personal data and traffic data that must stay in India, the significant data fiduciary must ensure they are not transferred abroad.

Businesses that expect to be notified should start treating these as current obligations. An impact assessment is far easier to carry out when a product is being designed than after it has millions of users. Our page on company compliance and directors explains how board-level reporting is usually set up.

Penalties, the Data Protection Board and appeals

Penalties under the Schedule to the Act go up to 250 crore for failure to take reasonable security safeguards to prevent a breach; up to 200 crore for failure to notify a breach and for breach of the duties on children's data; up to 150 crore for breach of the extra duties of significant data fiduciaries; and up to 50 crore for breach of any other provision. In deciding the amount, the Board must consider the nature, gravity and duration of the breach, the type of data, repetition, any gain or loss avoided, mitigation steps and the proportionality of the penalty. The money goes to the Consolidated Fund, not to the individual.

The Board acts on a complaint, a reference from the government or a court direction, or an intimation of a breach. It can accept a voluntary undertaking from the fiduciary at any stage, which bars proceedings on the matter covered. On repeated penalties, the Board can recommend that the government block public access to a fiduciary's platform.

Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal within 60 days, and from TDSAT to the Supreme Court. Civil courts have no jurisdiction over matters the Board can decide. Writ petitions in the High Court remain available against orders without jurisdiction or in breach of natural justice; see our page on cases in the Delhi High Court.

Building a DPDP compliance programme

Most businesses can complete this in two or three quarters if they start now. The order below avoids redoing work.

1. Map the data

   List every category of personal data you collect, where it comes from, why, where it is stored, who can access it, which processors receive it and whether it leaves India. Interview the teams; the systems inventory will be incomplete.

2. Fix the legal basis

   For each purpose, decide whether it rests on consent, a legitimate use under section 7, or an exemption. Drop purposes you cannot justify, and collect less data.

3. Rewrite notices and consent flows

   Draft plain-language notices for each point of collection, with itemised purposes and easy withdrawal. Test them on real users, including on mobile screens.

4. Contract with processors

   Sign data processing agreements with every vendor that touches personal data, covering security, sub-processing, breach notice, audit and deletion at the end of the contract.

5. Set up security and breach response

   Implement encryption, access controls, logging for at least one year and backups. Write an incident response plan that meets both the CERT-In 6-hour rule and the DPDP 72-hour report, and run a drill.

6. Publish rights and grievance channels

   Set up a process to receive, verify and answer requests for access, correction, erasure and nomination, and a grievance officer or DPO contact. Track response times.

7. Train and review

   Train staff who handle data, especially customer support and sales. Review the programme every year and whenever a new product or vendor is added.

DPDP readiness checklist

• Data inventory covering every system, spreadsheet and vendor
• Legal basis recorded for each processing purpose
• Itemised notice at every point of collection, available in Indian languages on request
• Consent records that show when, how and for what consent was given and withdrawn
• Age verification and verifiable parental consent for users under 18
• Data processing agreements with all processors
• Encryption, access controls and logs retained for at least one year
• Incident response plan covering CERT-In, the Board, individuals and regulators
• Retention schedule and a working deletion process, including backups
• Published contact for grievances and a process to answer rights requests
• Board-level reporting and, for significant data fiduciaries, a DPO, auditor and annual impact assessment

Contracts, policies and the documents regulators ask for

A privacy policy alone does not make a business compliant, but a regulator or court will read it first. It should match what the business actually does. A policy copied from a foreign website that promises GDPR rights the business never honours is worse than a short, accurate one. The notice under the DPDP Act is a separate, purpose-specific document shown at the point of collection, not a link to a long policy.

Contracts carry most of the risk allocation. Data processing agreements with vendors, data sharing agreements with partners, clauses in customer contracts for B2B services, and employment contracts and policies for staff data all need to be reviewed. Points that often go wrong are uncapped indemnities for data breaches, breach notice periods longer than six hours (which make CERT-In compliance impossible), silence on sub-processors abroad, and no obligation to delete at the end of the contract. Our page on commercial contracts covers drafting and disputes.

Employee data is a large and often ignored category: recruitment records, background checks, health information, biometric attendance and monitoring of work devices. Employment-related purposes are a legitimate use, but the processing must still be necessary and secure. The page on labour and employment law deals with the employment side.

Sector rules and the IT Act in the meantime

Until the DPDP duties commence, section 43A of the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 continue to apply. They require a body corporate handling sensitive personal data, such as passwords, financial information, health and biometric data, to have a privacy policy, obtain consent in writing for collection, and implement reasonable security practices, with compensation payable for negligence causing wrongful loss. The DPDP Act provides for section 43A to be omitted when its remaining provisions take effect. Section 72A, which makes disclosure of personal information in breach of a lawful contract an offence, continues.

Regulated sectors have their own rules that sit on top of the DPDP Act. Banks, NBFCs and payment companies follow RBI directions on IT governance, outsourcing, cyber security, digital lending and payment data storage, covered on our page on banking, NBFC and RBI matters. Market intermediaries follow SEBI's cybersecurity and cyber resilience framework, insurers follow IRDAI's guidelines, and telecom operators follow licence conditions. Where a sector rule is stricter, follow both.

Where a breach involves an offence, such as hacking, identity theft or extortion, the criminal side runs under the IT Act and the BNS, with a complaint to the cyber police station or on the national portal. Our page on cyber crime explains that process.

AI, synthetic content and digital rights management

India has no single AI statute. AI systems are governed by existing law: the DPDP Act for personal data used in training and output, the IT Act and the Intermediary Rules for platforms, copyright law for training data and outputs, consumer law for misleading claims, and sector rules for credit scoring, insurance and health. MeitY issued non-binding AI governance guidelines in late 2025. The amendments to the Intermediary Rules in force from 20 February 2026 require platforms to label synthetically generated content prominently, ask users to declare AI-generated uploads, remove content declared illegal by a court or the government within three hours, and remove non-consensual intimate images and deepfakes within two hours of a complaint. Check the current text of the rules, as the details matter for compliance.

Training an AI model on personal data scraped from the internet raises questions under the DPDP Act, since publicly available data made public by the individual is excluded but data made public by others is not. Using customer data to train models needs a legal basis for that purpose. Copyright questions about training on protected works are being tested in the Delhi High Court and are not settled.

Digital rights management is protected by sections 65A and 65B of the Copyright Act 1957, which make it an offence to circumvent an effective technological measure applied to protect copyright, or to remove or alter rights management information, with exceptions for purposes such as encryption research and lawful investigation. Content owners use these alongside takedown notices to intermediaries. Our pages on copyright and intellectual property cover the wider position.

E-sports, online gaming and the 2025 law

The Promotion and Regulation of Online Gaming Act 2025 prohibits online money games, including their advertisement and the processing of payments for them, while recognising and promoting e-sports and online social games. E-sports are treated as competitive sport, and the distinction between a skill-based e-sports tournament with entry fees or prize pools and a prohibited money game needs careful structuring. Check the current rules and notifications under the Act before launching any product with real-money elements.

E-sports organisers and gaming platforms process large volumes of personal data, much of it from minors, and many are likely to fall within the Third Schedule retention rules for online gaming intermediaries if they cross the user threshold. Player contracts, streaming rights, sponsorship deals and anti-cheat monitoring all raise data and intellectual property questions.

When Advocate B.K. Singh's office reviews a gaming or e-sports product, the first question is whether the money flows make it a prohibited money game under the 2025 Act, because no amount of privacy compliance helps a product that is unlawful in its basic design.

What to do this week

If you have had a breach or cyber incident, report it to CERT-In within six hours of noticing it, preserve logs and evidence, contain the incident, check your contracts for notice duties to customers and vendors, and inform your sector regulator if you are regulated. Decide on customer communication with the facts in hand, not before. Report any crime to the cyber police.

If you are preparing for the DPDP Act, start the data map, appoint someone senior to own the programme, and list every vendor that receives personal data. Review your website notices, sign-up flows and marketing consents against the DPDP standard. If your product is used by minors, look at age verification now, because it takes the longest to build. If you have received a complaint or a notice from a regulator, reply within the time given and with facts, and see our page on legal notices and replies.

If you want your notices, contracts or incident response checked before you act, the team of Advocate B.K. Singh at Legals365 can review them and tell you the next step through our talk to a lawyer page.

Frequently asked questions

Is the DPDP Act in force now?

Partly. The Data Protection Board and its procedures came into force with the Rules on 13 November 2025, consent manager provisions follow in November 2026, and most duties on businesses apply from May 2027. Meanwhile, section 43A of the IT Act, the 2011 SPDI Rules and the CERT-In Directions apply.

Does the DPDP Act apply to small businesses?

Yes. The Act has no general exemption based on size, though the government can exempt certain classes of fiduciaries, including startups, from some provisions by notification. Any business processing digital personal data of customers or employees should plan for compliance.

What is the penalty for a data breach under the DPDP Act?

Failure to take reasonable security safeguards that leads to a breach can attract a penalty up to 250 crore, and failure to notify the Board and individuals up to 200 crore. The Board fixes the amount based on gravity, duration, mitigation and proportionality. The penalty is paid to the government, not to affected individuals.

How quickly must a cyber incident be reported in India?

Under the CERT-In Directions of 2022, specified cyber incidents must be reported to CERT-In within six hours of being noticed. Under the DPDP Rules, once in force, a personal data breach must be reported to the Board and affected individuals without delay, with a detailed report to the Board within 72 hours.

Can I complain to the Data Protection Board directly?

You must first raise the grievance with the business concerned and give it the time allowed to respond. If it does not resolve the grievance, you can complain to the Board online. The Board can direct remedial steps and impose penalties but does not award compensation to you.

Do I need consent to send marketing messages to customers?

Marketing is a separate purpose and usually needs specific consent under the DPDP Act, with an easy way to withdraw it. Telecom regulations on commercial communications also apply to SMS and calls. Consent given only for order delivery does not cover marketing.

Can personal data be stored on servers outside India?

Generally yes, except in countries the government restricts by notification. Sector rules, such as the RBI's payment data storage requirement, can require data to stay in India. Significant data fiduciaries may face localisation for notified categories.

What is a significant data fiduciary?

A fiduciary or class notified by the government based on the volume and sensitivity of data and the risks involved. It must appoint a Data Protection Officer in India and an independent auditor, and carry out annual impact assessments and audits. It must also check that its algorithms do not harm individuals' rights.

Is a privacy policy enough to comply with the DPDP Act?

No. The Act requires a specific notice at the point of collection, valid consent or a legitimate use, security safeguards, breach response, retention limits and a rights process. A privacy policy is useful, but only as a description of what the business actually does.

Do AI-generated images have to be labelled in India?

Under the IT Rules amendments in force from 20 February 2026, platforms must prominently label synthetically generated content and ask users to declare it. Non-consensual deepfakes must be removed within two hours of a complaint. Check the current rules for the exact obligations.

Are e-sports legal in India?

Yes. The Promotion and Regulation of Online Gaming Act 2025 recognises and promotes e-sports while banning online money games. The structure of entry fees and prizes decides which side of the line a product falls, so check the current rules before launch.

Who hears appeals against the Data Protection Board?

Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal within 60 days of the Board's order, and from there to the Supreme Court. Civil courts cannot decide matters within the Board's jurisdiction. A writ in the High Court remains possible in exceptional cases.