We value your privacy & take necessary steps to protect your information.
REQUEST A CALLBACK
Relevant Legislation and Competent Authorities
The principal data protection framework in India is undergoing a transition from the legacy regime under the Information Technology Act, 2000 (“IT Act”) to the Digital Personal Data Protection Act, 2023 (“DPDPA”). Historically, Section 43A of the IT Act imposed liability on body corporates for failure to implement reasonable security practices while handling sensitive personal data, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) prescribed requirements for the lawful collection, use, disclosure and transfer of such data.
However, pursuant to a notification dated 13 November 2025, the DPDPA, with its phased enforcement now in full swing, will now be the principal data protection legislation in India. The DPDPA is being implemented in a phased manner, with certain provisions already in force and the remainder scheduled to come into force in stages over a period of 18 months, leading to full operationalisation by approximately mid-2027.
With the phased supersession of certain legacy IT Act provisions and the SPDI Rules framework, and the ongoing implementation of the new DPDPA regime, organisations are increasingly aligning their practices with the requirements under the new regime in anticipation of full enforcement.
Read the article (pdf) >>