Data Privacy and Protection

In August 2023, India witnessed a pivotal shift in its data privacy regulatory landscape with the enactment of the Digital Personal Data Protection Act, 2023 ("DPDP Act"). The DPDP Act provides a comprehensive set of guidelines that must be adhered to when managing digital personal data, ensuring the protection of individuals' privacy rights while balancing legitimate business needs and government requirements. ......

The Ministry of Electronics and Information Technology (Meity) released the Draft Digital Personal Data Protection Rules, 2025 ("Draft Rules") on January 3, 2025. The Draft Rules, introduced to supplement the implementation of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), mark a significant step forward in regulating and safeguarding the use of personal data. ......

On January 3, 2025, the Ministry of Electronics and Information Technology ("MeitY") notified the draft Digital Personal Data Protection Rules, 2025 (the "Draft Rules") under the Digital Personal Data Protection Act, 2023 (the "Act"). The Draft Rules aim to operationalize the Act by laying down the rules and standards necessary for the implementation of the same. ......

The Department of Telecommunications ("DOT") has notified the Telecommunications (Procedures and Safeguards for Lawful Interception of Messages) Rules 2024 ("Interception Rules") vide its notification dated December 6, 2024, replacing the extant Indian Telegraph Rules 1951. ......

On October 8, 2024, through a consultation paper released by the Securities and Exchange Board of India ("SEBI") a new policy has been proposed on data-sharing for the purposes of research and analysis ("Policy"). The Policy is applicable to all intermediaries and Market Infrastructure Institutions ("MIIs") and is aimed at streamlining business operations in India's financial markets while addressing critical data privacy challenges. . . . ...

On August 7, 2023, the Lok Sabha passed the new Digital Personal Data Protection Bill, 2023 ("Data Protection Bill") to provide for the processing of digital personal data. Currently, India does not have a standalone law on data protection. Use of personal data is currently regulated under the Information Technology (IT) Act, 2000. ......

In today’s news cycle, the interplay of AI, media, and privacy regulations are omnipresent and inescapable hot-button issues. However revolutionary as this advancement in technology may be, such fast-paced growth may have several repercussions on our everyday lives. We are moving towards a world where we co-opt and coexist with AI, becoming increasingly more intertwined with our everyday lives. ......

In 2017, the Supreme Court ruled that the right to privacy is a fundamental right under the Indian constitution. Subsequently, in 2018, the first draft of the Personal Data Protection Bill was prepared by an expert committee set up by the Ministry of Electronics and Information Technology (MeitY). ......

India has witnessed a steep rise in digital adoption, culminating in an increased usage of networked payment infrastructures like UPI, coordinated healthcare and vaccination platforms like CoWIN and Ayushman Bharat and the like. At the same time, processing abuse poses privacy risks and other harms at an individual and collective level. ......