India: Privacy Protection

The Supreme Court of India has delivered a landmark judgment in Chaturbhuj Pradhan v. Amar Pradhan addressing the complex intersection of DNA testing in paternity disputes with fundamental rights to privacy, personal identity, and inheritance. This ruling establishes critical legal precedents on when courts can order genetic testing to determine biological parentage and how such orders balance individual autonomy against the rights of children and families.

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.

The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services, and cybersecurity platforms.

India’s welfare schemes touch the lives of hundreds of millions of citizens. When these citizens sign up for a government benefit, they hand over some form of personal information like their name, Aadhaar number, mobile number, bank account details and/or any other particulars. This data however, often leads into the hands of political parties. In the run up to the 2019 general elections, a Union Minister reportedly stated that “beneficiaries are present in every poor household, and their testimonies are our campaign”, describing welfare scheme beneficiaries as not just targets but a “new addition to our voter base” .

AI regulation does not always arrive in the form of a dedicated AI statute. More often, it enters through privacy law. On April 7, 2026, the Japanese Cabinet approved a bill to amend Japan’s Act on the Protection of Personal Information (“APPI”). The Diet passed the amendment on July 10, 2026, and it was promulgated on July 17, 2026 as Act No. 56 of 2026; the amendment is now enacted but not yet in force, with its main provisions taking effect on a date to be fixed by Cabinet order no later than mid-2028.

An analysis of the APAAR Scheme, the Supreme Court’s directions requiring meaningful parental consent, opt-out rights and DPDP Act compliance, and why these amendments are necessary for protecting students’ personal data.

The Digital Personal Data Protection Act, 2023 (hereinafter referred to as ‘the DPDP Act’ or ‘the Act’) represents a landmark legislative development in India’s data governance landscape, being the country’s first comprehensive statute dedicated exclusively to the protection of digital personal data. Passed by Parliament in August 2023 and notified in November 2024, the Act is accompanied by the Digital Personal Data Protection Rules, 2025 (‘the DPDP Rules’), which prescribe a phased 18-month compliance timeline for data fiduciaries.

India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) represents one of the most significant regulatory developments affecting corporate governance, data privacy compliance and risk management in recent years. While many organisations initially viewed the legislation as a technology or legal compliance issue, the DPDP Act has rapidly emerged as a boardroom concern requiring active involvement from directors, chief executive officers, managing directors and senior management.

The judgment consolidates many petitions filed by individuals with varied backgrounds, including persons who have been acquitted of criminal charges, parties to matrimonial disputes, individuals whose names appeared incidentally in judicial records, amongst others