Shaping the Future of Data Protection in India: Legislative Evolution and Proposals

India’s journey toward robust data protection has been marked by evolving legal frameworks and growing awareness of digital privacy rights. While the country emerged as a global outsourcing hub, its data protection regime remained fragmented for decades, relying primarily on provisions within the Information Technology Act, 2000. Today, as digital transactions surge and data breaches make headlines, India stands at a critical juncture with new legislative developments that promise to reshape how personal information is handled across the nation.

The foundation: Information Technology Act, 2000 🔗

When the Indian Parliament enacted the IT Act in 2000, India became the 12th country to have dedicated legislation addressing electronic commerce and cybercrime. The Act provided legal recognition to electronic records and digital signatures, laying groundwork for India’s digital economy. However, data protection was not its primary focus.

The IT Act’s approach to data protection was limited to certain provisions. Section 43A of the Act made body corporates liable for negligence in implementing reasonable security practices while handling sensitive personal data. The provision states that companies must compensate affected individuals if they fail to maintain adequate security measures, with penalties extending up to one crore rupees.

The 2011 rules: defining sensitive personal data 🔗

To operationalize Section 43A, the government notified the Information Technology Rules, 2011, commonly known as the SPDI Rules. These rules defined sensitive personal data or information to include passwords, financial information, health conditions, sexual orientation, medical records, and biometric information. Companies were required to obtain consent before collecting such data and maintain privacy policies on their websites.

However, the framework had significant limitations. The concept of consent was not clearly defined, leaving businesses to rely on contract law principles. There was no independent data protection authority to enforce compliance. The rules applied only to body corporates engaged in commercial activities, leaving gaps in coverage.

Gaps in the existing framework 🔗

The IT Act’s data protection provisions revealed several shortcomings as India’s digital landscape evolved. The Act focused primarily on cybercrime and e-commerce transactions rather than comprehensive privacy protection. It lacked provisions for data breach notification timelines, cross-border data transfer restrictions, and individual rights like data portability.

Critics pointed out that the framework did not adequately address issues like purpose limitation, data minimization, or storage limitation. Companies could retain personal data indefinitely without clear justification. The enforcement mechanisms were weak, with no dedicated regulator to handle complaints or impose penalties for violations.

Global scandals and domestic concerns 🔗

High-profile data breaches worldwide, including the Cambridge Analytica scandal, heightened awareness about data privacy risks. In India, incidents like the Star Health insurance data breach affected over 31 million users, exposing vulnerabilities in existing protections. The outsourcing and BPO sectors, which handle vast amounts of international client data, faced growing scrutiny about their security practices.

These events underscored the need for a more robust framework that could match international standards and restore trust in India’s digital ecosystem.

The constitutional catalyst: right to privacy verdict 🔗

A watershed moment came in August 2017 when the Supreme Court of India declared privacy as a fundamental right protected under Article 21 of the Indian Constitution. In the landmark judgment of Justice K.S. Puttaswamy v. Union of India, the nine-judge bench recognized that privacy is intrinsic to life and personal liberty.

This constitutional recognition created momentum for comprehensive data protection legislation. The government established a committee of experts under Justice B.N. Srikrishna to develop a data protection framework suitable for India’s needs and aspirations.

Legislative evolution: from 2018 to 2023 🔗

The journey from the Srikrishna Committee’s report to final legislation spanned over five years and involved multiple drafts. The Personal Data Protection Bill, 2018 proposed extensive provisions for consent management, data localization, and regulatory oversight. This evolved into the Personal Data Protection Bill, 2019, which was introduced in Parliament but later withdrawn in 2022 after receiving criticism from stakeholders.

The Digital Personal Data Protection Act, 2023 🔗

In August 2023, Parliament passed the Digital Personal Data Protection Act, representing a fresh approach to data protection. Unlike earlier drafts, the DPDP Act adopts a principles-based framework focusing on core concepts: consent and transparency, purpose limitation, data minimization, accuracy, storage limitation, security safeguards, and accountability.

The Act applies to digital personal data processed within India and also has extraterritorial application for entities offering goods or services to individuals in India. It establishes clear obligations for data fiduciaries (those who determine the purpose and means of processing) and rights for data principals (individuals whose data is processed).

Key provisions and innovations 🔗

The DPDP Act introduces several progressive features. Data principals have rights to access their information, seek correction or erasure, and nominate someone to exercise these rights on their behalf in case of death or incapacity. The Act provides special protections for children’s data, prohibiting processing that involves tracking, behavioral monitoring, or targeted advertising directed at minors.

Companies must report data breaches to both the Data Protection Board of India and affected individuals within 72 hours. Penalties for violations can reach up to 250 crore rupees, depending on the nature and severity of the breach.

Implementation through the 2025 rules 🔗

On November 13, 2025, the government notified the Digital Personal Data Protection Rules, 2025, operationalizing the Act after extensive public consultation. The rules specify compliance requirements in detail, including provisions for consent mechanisms, data retention limits, and procedures for exercising individual rights.

Organizations must now implement systems to obtain express consent before processing personal data, maintain records of processing activities, and ensure data accuracy. The rules follow a phased implementation approach, giving entities 12-18 months to achieve full compliance depending on their size and nature.

Implications for BPOs and outsourcing 🔗

India’s BPO and outsourcing industry, valued at billions of dollars, handles sensitive data for clients worldwide. The new data protection framework strengthens India’s position as a secure outsourcing destination by demonstrating commitment to international privacy standards.

However, compliance presents challenges. BPO firms must invest in infrastructure upgrades, employee training, and audit mechanisms. They need to align with both Indian regulations and international standards like GDPR to serve global clients effectively. Data security measures must include encryption, access controls, multi-factor authentication, and regular vulnerability assessments.

Building client confidence 🔗

Strong data protection laws address a key concern that previously deterred some international companies from outsourcing to India. With clear legal obligations and enforcement mechanisms in place, clients can have greater confidence that their data will be handled responsibly. This competitive advantage can help Indian BPOs differentiate themselves in the global market.

Remaining challenges and future directions 🔗

Despite progress, certain challenges persist. The DPDP Act applies only to digital personal data, leaving offline data largely unregulated until it is digitized. Government exemptions for processing related to national security and public order raise concerns about potential overreach, though these are balanced by legitimate state interests.

The Data Protection Board of India, established to adjudicate disputes and enforce compliance, faces the mammoth task of overseeing a diverse digital ecosystem. Its effectiveness will depend on adequate resources, technical expertise, and independence from political pressures.

Cross-border data transfers remain an evolving area. While the Act permits transfers except to restricted countries (to be notified by the government), clarity on which jurisdictions might face restrictions is still awaited.

Aligning with international norms 🔗

India’s framework shares similarities with GDPR in recognizing individual rights and imposing obligations on data processors. However, differences exist in scope (GDPR covers all personal data while DPDP focuses on digital data) and in the legal bases for processing (GDPR includes legitimate interests, which DPDP does not explicitly recognize).

This alignment with international principles helps Indian businesses interact seamlessly with partners in jurisdictions with strong data protection regimes. It also positions India as a responsible digital economy that values privacy alongside innovation.

The road ahead 🔗

India’s data protection journey reflects a gradual but determined shift from a fragmented approach to comprehensive legislation. The transition from the IT Act’s limited provisions to the DPDP Act represents recognition that privacy is not merely a regulatory requirement but a fundamental right deserving robust protection.

For businesses, compliance is no longer optional but essential. Organizations must move beyond checkbox exercises to embed privacy by design into their operations. This includes regular audits, employee awareness programs, and establishing clear accountability structures.

For individuals, the new framework empowers greater control over personal information. Exercising rights like accessing data, seeking corrections, and filing complaints can drive accountability and foster a culture of responsible data handling.

As implementation progresses and the regulatory ecosystem matures, India’s approach to data protection will continue evolving. Further amendments may address gaps related to non-digital data, artificial intelligence, and emerging technologies. International cooperation through adequacy agreements and mutual recognition frameworks will enhance cross-border data flows while maintaining protection standards.

What do you think? How effectively do you believe the Digital Personal Data Protection Act balances individual privacy rights with the needs of businesses and government? Can India’s new data protection framework truly position the country as a trusted global partner for digital services and outsourcing?

References

1. https://en.wikipedia.org/wiki/Information_Technology_Act,_2000
2. https://www.termsfeed.com/blog/india-it-act-of-2000-information-technology-act/
3. https://oercs.berkeley.edu/privacy/international-privacy-laws/india-privacy-law
4. https://www.michalsons.com/blog/information-technology-act-it-act-data-protection-india/23235
5. https://finlawassociates.com/blog/understanding-data-theft-under-it-act-2000-laws-penalties-and-prevention
6. https://en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Act,_2023
7. https://carnegieendowment.org/research/2023/10/understanding-indias-new-data-protection-law
8. https://www.hoganlovells.com/en/publications/indias-digital-personal-data-protection-act-2023-brought-into-force-
9. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655
10. https://outsourced.co/business-process-outsourcing-bpo-india/
11. https://www.answer-4u.com/blog/data-security-outsourcing
12. https://www.lw.com/admin/upload/SiteAttachments/Indias-Digital-Personal-Data-Protection-Act-2023-vs-the-GDPR-A-Comparison.pdf