India’s data protection law: Strengthen rules but also follow through to the last mile
6 years, 2 months ago

India’s data protection law: Strengthen rules but also follow through to the last mile

Hindustan Times  

News of the Washington DC attorney general’s case against Facebook has brought the spectre of Cambridge Analytica back with a bang. While it remains to be proven, the checklist of violations in the US case against Facebook is indicative of what is in store for users of many online platforms – from allegations of misleading privacy settings to indiscriminate sharing of data with third parties and failure to disclose data breach, the list covers them all. With India losing a substantial portion of the “business of data” due to its lack of perceptible data protection laws, the stop-gap arrangement, which remains till date was the introduction of two additional provisions under Section.43A and Section.72A of the IT Act, with the former providing civil penalties and the latter, criminal prosecution. The IT Rules for data protection, which were a direct lift from the European Union’s eight data principles under its 1995 directive along with the above provisions, unfortunately did not improve India’s prospects for being tagged a suitable destination for personal data transfers. From the well-known decisions of Maximillian Schrems striking down personal data transfers to the US on grounds of breach of citizens’ rights through state Strengthening laws is certainly an important first step but the follow through to the last mile is what India needs if its data protection processes are to be taken seriously.

Law India Personal Protection Data Protection Data Data Breach Case Act Facebook Personal Data Breach Cambridge Analytica  breach  rules  follow  act  protection  india  case  provisions  data  personal  law  strong  mile  strengthen  indias  rights

History of this topic

The challenge of policing digital giants
6 days, 10 hours ago

The challenge of policing digital giants

The Hindu  

On November 18, 2024, the Competition Commission of India issued a landmark order imposing a fine of ₹213.14 crore and forcing several behavioural remedies on Meta. This update required users to mandatorily consent to expanded data-sharing, allowing Meta to provide access to such data to all of its other platforms; forcing users to accept a data-sharing agreement on a “take-it-or-leave-it” …

Nasscom flags concerns over data localisation
2 weeks, 6 days ago

Nasscom flags concerns over data localisation

New Indian Express  

Tech industry apex body Nasscom on Thursday said the new proposal in the draft Rules under the Digital Personal Data Protection Act to restrict transfer of personal data outside India "appears to be inconsistent with the spirit and the objectives of the Act and should be reconsidered." In its feedback on the draft Rules under the DPDP Act, which was …

Congress leaders, activists bemoan weakening of RTI Act through data protection law
3 weeks, 1 day ago

Congress leaders, activists bemoan weakening of RTI Act through data protection law

The Hindu  

Congress president Mallikarjun Kharge reiterated concerns on Tuesday that the Digital Personal Data Protection Act, 2023, was weakening the Right to Information Act, 2005. “On the one hand, India has been coming on top in Misinformation and Disinformation for the past few years, on the other hand, the Modi government is bent on weakening the Right To Information Act implemented …

Data protection rules and Act, a net negative for privacy rights
1 month, 2 weeks ago

Data protection rules and Act, a net negative for privacy rights

The Hindu  

Around eight years since the judgment of the Supreme Court of India, in Justice K.S. Despite the Digital Personal Data Protection Act having been notified in August 2023, its provisions remain inoperative due to the delay in the notification of the Digital Personal Data Protection Rules Rules. ‘Significant Data Fiduciaries’, which are entities classified as such due to the volume …

Union Budget: IT ministry allocates ₹5 crore for Data Protection Board in FY26
1 month, 3 weeks ago

Union Budget: IT ministry allocates ₹5 crore for Data Protection Board in FY26

Hindustan Times  

The ministry of electronics and information technology has increased budgetary allocation for Data Protection Board of India by 2.5 times to ₹5 crore for FY26. The government had allocated ₹2 crore to meet the establishment and salary expenses of the Data Protection Board in FY25. In order to operationalise the Digital Personal Data Protection Act, 2023, which was notified in …

New Digital Rules Let You Wipe All Your Details Online
1 month, 3 weeks ago

New Digital Rules Let You Wipe All Your Details Online

Deccan Chronicle  

Hyderabad: Can a customer walk into a multinational company like Amazon and ask it to remove all her information from the company's database? With the draft Digital Personal Data Protection Rules, 2025 released in public domain seeking comments and feedback, the citizens can now look forward to a framework through which they can exercise their right to privacy. The rules …

Bill to take charge of India’s digital destiny
2 months, 1 week ago

Bill to take charge of India’s digital destiny

Hindustan Times  

You wake up, pour yourself a coffee, and scroll through your phone. But what if every app and website you’ve ever used — Instagram, Amazon, or even that odd e-store — was quietly rifling through your personal data without asking you? India’s proposed Digital Personal Data Protection Rules, 2025 aim to ensure this nightmare doesn’t become your daily reality. Localisation …

How the draft rules for implementing data protection falls short
2 months, 2 weeks ago

How the draft rules for implementing data protection falls short

The Hindu  

After a long wait of 16 months, the Ministry of Electronics and Information Technology has released the draft rules for implementing the Digital Personal Data Protection Act, 2023. Lack of detail The draft rules propose operative guidance for critical mechanisms such as notice and consent to a user for data collection and processing, intimation of data breaches, collection of parental …

India’s data protection rules need some fine-tuning
2 months, 2 weeks ago

India’s data protection rules need some fine-tuning

The Hindu  

On January 3, 2025, the Ministry of Electronics and Information Technology released the much-anticipated Draft Digital Personal Data Protection Rules — a key moment in India’s journey to regulate digital personal data. The draft rules represent a departure from the earlier and controversial Personal Data Protection Bill, which many deemed was overly restrictive and even hostile to industry interests. While …

Digital Personal Data Protection Draft Rules: What Are the Sticking Points?
2 months, 2 weeks ago

Digital Personal Data Protection Draft Rules: What Are the Sticking Points?

The Quint  

In 2023, the Digital Personal Data Protection Act was passed by the Parliament. The Act passed after questions were raised with regard to the protection of data and its regulation within the Indian territory and the Act was passed to safeguard the private sphere of the citizens and to push through the idea of ‘digital economy’. In response to the …

Were you hacked in 2024? India’s data protection rules require you to take action
2 months, 2 weeks ago

Were you hacked in 2024? India’s data protection rules require you to take action

Live Mint  

Last year, did any of your employees use a co-worker’s computer and read files without authorization? The draft Digital Personal Data Protection Rules, 2025, require such retrospective reporting. It covers data breaches occurring in the interim period from the notification of the Digital Personal Data Protection Act, 2023, to its full implementation sometime later this year. Various data security measures …

Rollout of Data Rules set for mid-2025: IT Minister
Trending News
2 months, 2 weeks ago

Rollout of Data Rules set for mid-2025: IT Minister

The Hindu  

The government is aiming to notify and begin implementing the Digital Personal Data Protection Rules, 2025 — currently in a draft state — by the middle of this year, Union Minister of Electronics and Information Technology Ashwini Vaishnaw said. “I don’t see too many amendments coming in the final notification beyond some tweaks.” While large firms are prepared to comply …

Well-equipped data protection board a must to enforce digital privacy laws, say experts
Top News
2 months, 2 weeks ago

Well-equipped data protection board a must to enforce digital privacy laws, say experts

Live Mint  

New Delhi: The draft rules for the Digital Personal Data Protection Act, published on Friday, have ignited discussions among legal and data privacy experts regarding the effective implementation of the law. “Provisions for criminal liability in cases of severe data breaches could go a long way in ensuring stricter compliance," said Nazneen Ichhaporia, partner at ANB Legal. On 3 January, …

Mint Explainer: The digital personal data protection Act, its rules, and roadblocks
Trending News
2 months, 2 weeks ago

Mint Explainer: The digital personal data protection Act, its rules, and roadblocks

Live Mint  

Companies waited nearly two years for the Indian government to frame rules for implementing the Digital Personal Data Protection Act—a threadbare legislation with a lot of queries on compliance mechanisms left unanswered. Concern: In emphasizing the “specified" purpose of the data, the legislators have created an overlap with the provisions of “Legitimate Use" under the DPDP Act, which allows data …

Mint Explainer: The digital personal data protection Act, its rules, and roadblocks
2 months, 2 weeks ago

Mint Explainer: The digital personal data protection Act, its rules, and roadblocks

Live Mint  

Companies waited nearly two years for the Indian government to frame rules for implementing the Digital Personal Data Protection Act—a threadbare legislation with a lot of queries on compliance mechanisms left unanswered. Concern: In emphasizing the “specified" purpose of the data, the legislators have created an overlap with the provisions of “Legitimate Use" under the DPDP Act, which allows data …

Data localisation only for specific purposes: IT secretary
2 months, 2 weeks ago

Data localisation only for specific purposes: IT secretary

Hindustan Times  

The draft Digital Personal Data Protection Rules will take a targeted approach to data localisation, affecting only specific categories of personal data and for specific purposes, information technology secretary S Krishnan said, adding that there are no easy solutions to verifying children’s age online. The current approach, however, empowers the government to specify countries where data cannot be transferred under …

Mint Quick Edit | India’s new privacy rules: A mixed bag
2 months, 3 weeks ago

Mint Quick Edit | India’s new privacy rules: A mixed bag

Live Mint  

More than a year after the Digital Personal Data Protection Act was passed, the government has released the draft rules that will enable this law’s implementation. While the rules are expansive, their requirement of parental consent for under-18-year-olds to join social media and gaming platforms could deliver a pragmatic age-gating regime. That said, the return of data localization requirements will …

No secret affair: on the draft Digital Personal Data Protection Rules, 2025
2 months, 3 weeks ago

No secret affair: on the draft Digital Personal Data Protection Rules, 2025

The Hindu  

The draft Digital Personal Data Protection Rules, 2025, is a long overdue advance in the direction of enforcing the fundamental right to informational privacy for Indians, affirmed by the Supreme Court of India in the landmark case, Justice K.S. The Digital Personal Data Protection Act, which these draft rules seek to enforce, was passed in Parliament over a year ago. …

India’s Digital Data Protection rules: A story of hits and misses
2 months, 3 weeks ago

India’s Digital Data Protection rules: A story of hits and misses

Live Mint  

The draft Digital Personal Data Protection Rules are finally with us and the long wait has for the most part been worth it. While the Act requires data fiduciaries to provide notice “in the event of" a personal breach, the rules state that intimation must be made “as soon as the Data Fiduciary becomes aware of it." Ever since Justice …

Parental nod, ID proof: How Modi govt plans to regulate digital access for minors
Top News
2 months, 3 weeks ago

Parental nod, ID proof: How Modi govt plans to regulate digital access for minors

India Today  

The Union government, at the beginning of the new year, unveiled a long-anticipated blueprint for India’s digital future: the draft Digital Personal Data Protection Rules, 2025. Social media platforms, gaming apps and e-commerce websites—all categorised as “data fiduciaries”—are now tasked with obtaining explicit, verifiable consent from users before collecting, processing or storing personal data. When the users in question are …

Data protection rules: India Inc says challenges remain
2 months, 3 weeks ago

Data protection rules: India Inc says challenges remain

New Indian Express  

NEW DELHI: The Ministry of Electronics and Information Technology has released the much-awaited draft rules for the Digital Personal Data Protection Act, 2025. Continued engagement from the government will be key to ensuring effective implementation.” Goldie Dhama, Partner at Deloitte India, said the draft offers important clarifications, mainly regarding verifiable consent for children’s data. After a gap of over 16 …

Digital Personal Data Protection Rules: Govt drafts stringent parental consent rules for social media users under 18
2 months, 3 weeks ago

Digital Personal Data Protection Rules: Govt drafts stringent parental consent rules for social media users under 18

Op India  

On 3rd December, the Government of India proposed detailed rules under the Digital Personal Data Protection Rules, 2025. One of the most talked-about aspects of the draft is the rule that makes verifiable parental consent mandatory for creating social media accounts and processing the personal data of children. As per the draft rules, every organisation that collects personal data must …

Experts cautiously welcome Digital Personal Data Protection Rules, 2025
2 months, 3 weeks ago

Experts cautiously welcome Digital Personal Data Protection Rules, 2025

The Hindu  

Experts working with the tech industry tentatively welcomed the draft Digital Personal Data Protection Rules, 2025, issued on Friday. “The draft rules provide some clarity on framing and displaying notices under the Digital Personal Data Protection Act, but they fall short in offering guidance on the mode of delivery or issuance—something well-defined under GDPR,” Ms. Suri said, referring to Europe’s …

Government releases Draft Digital Personal Data Protection Rules, no penalties specified
2 months, 3 weeks ago

Government releases Draft Digital Personal Data Protection Rules, no penalties specified

India TV News  

The government has unveiled the much-awaited Digital Personal Data Protection Rules Rules, 2023, omitting any specific mention of penalty for violation. The proposal comes more than a year after the Digital Personal Data Protection Act, 2023 was approved by Parliament. Key provisions in the draft rules The draft outlines procedures for obtaining explicit consent from individuals, including mandatory parental consent …

We should deal with technological transformations with utmost care
3 months ago

We should deal with technological transformations with utmost care

Live Mint  

Without a doubt, the biggest disappointment of 2024 has to be the fact that India’s data protection law is still not in force despite having managed to get through both houses of Parliament in record time in 2023. On the other hand, what is most gratifying is the pace at which India’s digital public infrastructure approach gained acceptance around the …

The legal gaps in India’s unregulated AI surveillance
3 months, 1 week ago

The legal gaps in India’s unregulated AI surveillance

The Hindu  

In 2019, the Indian government made headlines by announcing its intention to create the world’s largest facial recognition system for policing. The use of AI for surveillance has global parallels, often resulting in “dragnet surveillance”, a term that refers to indiscriminate data collection beyond just suspects or criminals. This article explores the legal frameworks, gaps, and concerns surrounding AI surveillance …

Anonymized medical data should be given an additional privacy shield
3 months, 1 week ago

Anonymized medical data should be given an additional privacy shield

Live Mint  

When I first saw the original blueprint of the Ayushman Bharat Digital Health Mission, the feature that really jumped out at me was its anonymizer module. This was the first time that a digital building block designed to de-identify personal data was being built directly into the digital workflow and I was excited by the possibilities that this offered. But, …

Privacy as priority: India can’t afford any further delay in notifying data protection rules
3 months, 1 week ago

Privacy as priority: India can’t afford any further delay in notifying data protection rules

Live Mint  

A few days ago, Signzy, a popular Know Your Customer verification service used by India’s top banks and fintech firms, was affected by a cyber attack that may have exposed the sensitive personal information of millions. India’s Digital Personal Data Protection Act was passed six years after the Right to Privacy verdict in 2017. The Digital India Act, touted as …

India to introduce new legal framework for data privacy, free data flow: Piyush Goyal
4 months ago

India to introduce new legal framework for data privacy, free data flow: Piyush Goyal

Live Mint  

New Delhi, Novemeber 22 : Union Minister Piyush Goyal announced that India is set to bring in a new legal framework to ensure data privacy while promoting the free flow of data among trusted global partners. The minister stated this during his address at the UK India Business Council's 'UK-India Technology Futures Conference' held in New Delhi on Thursday. In …

Deloitte India partners with Securiti to enhance data privacy and compliance solutions
4 months, 1 week ago

Deloitte India partners with Securiti to enhance data privacy and compliance solutions

Live Mint  

Deloitte Touche Tohmatsu India LLP has announced a strategic partnership with data privacy and security company Securiti to address growing challenges in data governance, privacy, and compliance. Notably, the collaboration combines Deloitte India’s domain expertise with Securiti’s technology platforms to deliver tailored, end-to-end security solutions for businesses navigating increasingly complex regulatory requirements. The act adds to the compliance obligations businesses …

EU's data privacy laws stymie India's investigation into airline bomb hoax calls
4 months, 1 week ago

EU's data privacy laws stymie India's investigation into airline bomb hoax calls

Live Mint  

New Delhi: India’s hunt for the perpetrators of multiple bombing threats that significantly disrupted the domestic aviation and hospitality sectors has hit a roadblock in Europe, where most of the hoax calls are said to have been made through virtual private networks. “India has currently hit a roadblock in the European Union, with France and Germany being among the nations …

Data Protection Rules to be published within a month: Union IT minister
7 months, 1 week ago

Data Protection Rules to be published within a month: Union IT minister

Hindustan Times  

A draft of the Digital Personal Data Protection Rules will be published for public consultation within thirty days, IT minister Ashwini Vaishnaw said on Monday. Vaishnaw also said that the government has resolved the issue around processing consent for children’s data and the details would be revealed when the draft rules are released for consultation. Under the DPDP Act, a …

New data law, a barrier to journalistic free speech
11 months, 1 week ago

New data law, a barrier to journalistic free speech

The Hindu  

In August 2023, India got its first comprehensive data protection law, the Digital Personal Data Protection Act, 2023. Three previous drafts of the DPDP Act had exemptions for journalistic activities, but the final law withdrew such an exemption. Three previous drafts of the DPDP Act, one released by an expert committee on data protection, the other by the government, and …

Corporate boards should foster a culture of data privacy in organizations
1 year ago

Corporate boards should foster a culture of data privacy in organizations

Live Mint  

The digital age has ushered in a new era of responsibility—to safeguard the core of our online existence: our data. In acknowledging the role of data privacy being integral to corporate governance and risk management, the board has a crucial role in not only ensuring that the enterprise meets legal obligations, but also establishing a bedrock of trust under its …

Why customer protection is central to financial inclusion
1 year, 1 month ago

Why customer protection is central to financial inclusion

Hindustan Times  

Imagine the following scenario. Raja can “cash out” and receive the value of his investment, but then he will forfeit the life insurance amount that his family would have earned upon his death. Raja would be better off buying a term life insurance policy, which would not promise any investment returns but only a single payout to his family in …

Alert first, act fast: Diktat on data breaches soon
1 year, 2 months ago

Alert first, act fast: Diktat on data breaches soon

Live Mint  

Organizations that notice breaches of personal data may have to immediately alert users and flag them to the Data Protection Board, followed by a detailed filing within 72 hours. The Digital Personal Data Protection Act, India’s first law on data protection, took effect in August, and upcoming rules under the Act will lay the ground for compliance by technology companies. …

India's Data Revolution: Unpacking the DPDPA 2023 and Ensuring Accountability
1 year, 4 months ago

India's Data Revolution: Unpacking the DPDPA 2023 and Ensuring Accountability

The Quint  

It is crucial to establish mechanisms that hold the government accountable as a data custodian, said Dr Kislay Pandey, a leading corporate lawyer of India. Specific measures need to be taken to explicitly regulate emerging technologies like AI and tapping into their potential to bolster data protection. He further said, “To ensure the efficacy of data protection and privacy regulation …

The Art of A Good Unicorn | Startup founders, be careful as data is more liability than asset now
1 year, 4 months ago

The Art of A Good Unicorn | Startup founders, be careful as data is more liability than asset now

Hindustan Times  

India has become a rapidly evolving digital landscape where technology reigns supreme. And therein lies the rub: The need for accountability and data protection brewing in Internet startups handling data in India’s burgeoning startup ecosystem. And so, in August 2023, India’s Rajya Sabha passed the Digital Personal Data Protection Act 2023 to redefine how digital personal data is processed. Or …

How safe is our personal health data with the Indian government? | In Focus podcast
1 year, 4 months ago

How safe is our personal health data with the Indian government? | In Focus podcast

The Hindu  

Just about a month ago, Rescurity, an American cyber security firm, said that personal information of 815 million Indians was being sold on the dark web. The All India Institute of Medical Sciences – AIIMS in Delhi has also been hit by cyber attacks – in one ransomware case, the hackers took over the servers, encrypted the data, and made …

India Inc has some way to go to comply with data protection act: PwC India
1 year, 5 months ago

India Inc has some way to go to comply with data protection act: PwC India

Live Mint  

New Delhi: A new report by PwC India on how compliant Indian companies are with the Digital Personal Data Protection Act, which came into effect on 11 August, reveals some startling facts. Cookies: PwC India found that 16% of company websites display a cookie consent banner to users, highlighting that their personal data will be collected and processed. Privacy notices: …

Only 9% of Indian organizations secure explicit user data consent: Report reveals
1 year, 5 months ago

Only 9% of Indian organizations secure explicit user data consent: Report reveals

India TV News  

Only 9% of Indian organizations secure explicit user data consent: Report reveals PwC India conducted a thorough examination of the websites belonging to 100 Indian enterprises in order to gauge their adherence to the DPDP Act. A recent report has shed light on significant compliance gaps in data consent practices among Indian organizations as the government collaborates with industry stakeholders …

Data protection rules to come out over next thirty days, say MoS IT Rajeev Chandrasekhar
1 year, 6 months ago

Data protection rules to come out over next thirty days, say MoS IT Rajeev Chandrasekhar

The Hindu  

Rules for the Digital Personal Data Protection Act, 2023 will come out in the coming month, Minister of State for Electronics and Information Technology Rajeev Chandrasekhar said on Wednesday. Mr. Chandrasekhar was speaking at a “Digital India Dialogues” event, where industry representatives from firms that will have to comply with the requirements of the DPDP Act were present. “We will …

Navigating the complex landscape of data privacy laws in India
1 year, 6 months ago

Navigating the complex landscape of data privacy laws in India

Hindustan Times  

In an era where data is hailed as the "new oil," the need for strong data privacy laws has never been more critical. India, too, has stepped up its game in this regard with the introduction of the Digital Personal Data Protection Act, 2023. Compliance with data protection laws, such as the Digital Personal Data Protection Act, 2023 in India, …

Transfer of personal data under U.N. treaty will be according to native laws
1 year, 6 months ago

Transfer of personal data under U.N. treaty will be according to native laws

The Hindu  

As United Nations member states negotiate a treaty to counter cybercrimes, India has made suggestions at the international forum that transfer of “personal data” under the convention will be done in accordance with the country’s domestics laws and not other applicable international laws. The Digital Personal Data Protection Act enacted by the Parliament in August says that personal data can …

HNLU To Conduct A Round Table On Data Protection In A Digital World: Perspectives From India
1 year, 6 months ago

HNLU To Conduct A Round Table On Data Protection In A Digital World: Perspectives From India

Live Law  

Hidayatullah National Law University, a leading institution in the field of legal education, is proud to announce an upcoming round table discussion on the topic "Delineating the Issues Relating to Data Protection in a Digital World: Perspectives from India." It will be an exceptional opportunity to engage with experts and explore the intricacies of data protection in the digital age …

Today’s Cache | India’s Personal Data Protection Act weakens RTI; Google hit with copyright lawsuit; Microsoft unbundles Teams to avert fines
1 year, 6 months ago

Today’s Cache | India’s Personal Data Protection Act weakens RTI; Google hit with copyright lawsuit; Microsoft unbundles Teams to avert fines

The Hindu  

India’s Personal Data Protection Act weakens RTI Activists have long warned of dilution of the Right to information and with the Digital Personal Data Protection Act, of 2023, the qualified prohibitions to certain right to information to be kept secret have turned into total prohibitions. The lawsuit, alleging copyright violations, was filed by the Danish Media Association a year after …

DC Edit | E-com policy initiative welcome
1 year, 7 months ago

DC Edit | E-com policy initiative welcome

Deccan Chronicle  

The Union government’s decision to finalise the long overdue national e-commerce policy is a welcome move, which will guide one of the fast-growing sectors of the Indian economy. By offering huge discounts, the e-commerce sector has gradually transformed from a $14-billion market in 2014 to $70-billion in 2022 — a growth of five times affecting fortunes of hundreds of brick-and-mortar …

Digital Personal Data Protection Act Will Make Companies Handle Data Of Indians Under Legal Obligation: IT Minister
1 year, 7 months ago

Digital Personal Data Protection Act Will Make Companies Handle Data Of Indians Under Legal Obligation: IT Minister

ABP News  

Union Minister of State for Electronics and Information Technology Rajeev Chandrasekhar on Thursday said the Digital Personal Data Protection Act passed by Parliament recently will make digital companies handle the data of Indian citizens under absolute legal obligation. "The Digital Personal Data Protection Act that was passed by Parliament a few days ago is a very important milestone in the …

Personal Data Protection: How India's Law Looks Compared to EU's Regulations
1 year, 7 months ago

Personal Data Protection: How India's Law Looks Compared to EU's Regulations

The Quint  

DPDPA seeks “to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto,” as mentioned at the beginning of the legislation. In August 2017, when the nine-judge bench …

Word choice in India’s data protection law and a dilution of rights
1 year, 7 months ago

Word choice in India’s data protection law and a dilution of rights

The Hindu  

After years of going back and forth on its contents, India finally has a data protection law, i.e., the Digital Personal Data Protection Act, 2023. In the search for an answer to this question, we need to look at two basic features of any data protection law: the use of personal data with consent and without it. As decades of …

Discover Related