India: Data Protection

India’s digital regulatory framework is multi-layered. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) sit alongside the long-standing Information Technology Act, 2000 (“IT Act”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Guidelines” or “IT Rules, 2021”).

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.

The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services, and cybersecurity platforms.

India's Global Capability Centre (GCC) story has changed a great deal in recent years. What began as a way to move routine back-office and support work to India has grown into something far more strategic. GCCs today work on artificial intelligence, cybersecurity, engineering, product development, research and development, finance and analytics and increasingly sit at the heart of their parent companies' global operations.

A strong privacy compliance framework gives an organisation a structured way to manage personal data from collection to deletion. It connects legal requirements with everyday business processes, technology, contracts and employee responsibilities. For Indian organisations, this has become increasingly important following the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

Nearly half a century after the 1975-77 Emergency imposed by Indira Gandhi's government - a period that witnessed wholesale press censorship and the suspension of fundamental rights - India finds itself confronting a new, more sophisticated threat to media freedom.

India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 introduce specific safeguards for children's personal data, including verifiable parental consent and restrictions on tracking, behavioural monitoring and targeted advertising. For businesses operating mobile applications and websites used by children, privacy compliance cannot be reduced to a privacy policy or consent button—it requires understanding what data is collected, how child users are iden

On May 29, 2026, the Delhi High Court delivered a landmark judgment in a batch of petitions that raised the same question, that stood at the intersection of constitutional law and the digital age viz. whether an individual whose name appears in judicial records that are accessible through internet search engines is entitled, by virtue of the right to informational privacy guaranteed under Article 21 of the Constitution, to seek de-indexing of those records from name-based search results and masking of personal identifiers (including names) from publicly accessible digital versions of those records.

On June 01, 2026, the Central Consumer Protection Authority (CCPA) issued a significant order against Physicswallah Limited (hereinafter referred to as Party), the EdTech unicorn behind the pw.live platform, finding it guilty of deploying three distinct dark patterns. The matter taken up suo moto by CCPA culminated in a penalty of INR 5,00,000 and a binding direction to eliminate all dark patterns from the platform immediately.