The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) is the strangest landmark in Indian statute-making: a data protection law that protects nobody yet. Parliament passed it in August 2023, the President assented to it on 11 August 2023, and the rules that make it workable were notified in November 2025. Yet the obligations that matter, the duties to seek consent, to give notice, to keep data secure, to report breaches and to erase data when it is no longer needed, do not bind any data fiduciary until 13 May 2027, close to four years after the Act received assent. That single fact, the gap between enactment and enforcement, is the lens through which every provision of this statute has to be read. An article that describes the Act as though it were already operative misleads every business reader who consults it, and a compliance team that plans around the assent date rather than the commencement calendar will be building for a deadline that does not exist.

The second fact that has to be fixed before any provision is examined is what the Act does not do. It confers no right to compensation on the individual whose data is breached; the penalties it creates flow to the Consolidated Fund of India, not to the victim. It places duties, backed by a penalty, on the data principal herself, a feature almost unheard of in data protection statutes anywhere. It permits the Central Government to exempt its own instrumentalities from most of the Act by notification, and to block access to a platform on a reference from the Board. It contains no exemption for journalistic processing, a gap that petitioners have carried to the Supreme Court. And its machinery for enforcement, the Data Protection Board of India, exists in law since November 2025 but was still without an appointed Chairperson or Members when legal-press reporting examined the position in 2026, a body on paper awaiting the people who will give it a voice. All of this is in the statute as enacted; none of it is commentary.

What existed before the Act, and why it failed

Before 2023, India had no dedicated data protection statute. What it had was a single compensation provision in the technology statute and a set of rules made under it. Section 43A of the Information Technology Act, 2000 made a body corporate liable to pay damages by way of compensation where its negligence in maintaining reasonable security practices caused wrongful loss or wrongful gain to any person, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 supplied the operative detail: what counted as sensitive personal data, what reasonable security practices meant in practice, and what a privacy policy had to contain. The regime was compensation-centred rather than rights-centred. No individual had a general right to see what a company held about her, to have it corrected, to have it erased, or to object to its processing. The enforcement forum was an adjudicating officer under the technology statute, and the provision was invoked far less often than the scale of India’s digital economy would suggest.

The detail of that older regime deserves a paragraph because it is the regime businesses still operate under until May 2027. The 2011 Rules defined a sub-category of sensitive personal data, covering passwords, financial information, health conditions, biometric information and similar data, and attached the protections mainly to that sub-category rather than to personal data at large. A body corporate had to publish a privacy policy, obtain consent in writing for sensitive data, permit review and withdrawal, and maintain reasonable security practices, which the Rules anchored to documented information-security programmes and standards of the kind the technology industry certifies against. Compensation under Section 43A required the claimant to show negligence in maintaining those practices and a resulting wrongful loss or wrongful gain, a standard that made claims fact-heavy and rare. Alongside it grew a separate reporting track: directions issued by the Indian Computer Emergency Response Team in April 2022 under the technology statute require specified cyber incidents to be reported on a short clock measured in hours. That track belongs to incident reporting rather than to privacy rights, and it survives the 2023 Act, so a business that suffers a breach after May 2027 will owe reports on two tracks with two different clocks.

This thinness was tolerable when the provision was new, and it ceased to be tolerable long before Parliament replaced it. Three pressures converged. The first was scale: hundreds of millions of Indians came online, and the processing of their personal data became the raw material of the country’s largest businesses. The second was the courts: the Supreme Court’s unanimous nine-judge recognition of privacy as a fundamental right in August 2017 made a statutory framework a constitutional expectation rather than a policy choice, and the judgment laid down the proportionality standard that every subsequent restriction on privacy would have to satisfy. The third was comparison: other large economies had built full-scale regimes with real enforcement teeth, and India’s rules from 2011 looked, by the early 2020s, like a bicycle lock on a warehouse door.

The difference between the two regimes is a difference of kind, not of degree, and it is worth stating cleanly because much commentary treats the 2023 Act as a stronger version of the old rules. Section 43A was a liability rule: it attached a monetary consequence to one failure, negligent security, after loss had occurred, and it was otherwise silent. The 2023 Act is a governance code: it regulates the entire life of personal data from the notice that precedes collection to the erasure that ends retention, creates rights exercisable before any loss occurs, and staffs the system with a standing regulator. A liability rule waits for harm; a governance code tries to structure conduct so that harm is less likely and more visible when it happens. The trade the new code makes, dropping the liability rule’s compensation for the governance code’s penalties, is therefore not an oversight within a single design but the substitution of one regulatory philosophy for another, and arguments about the missing compensation right are really arguments about which philosophy a data protection law should embody.

The regime that continues to apply is worth naming precisely, because for the whole period until 13 May 2027 it remains the only operative one. The security-practices rules made in 2011 under the compensation provision of the technology statute still govern, and the provision itself survives until the amending section of the 2023 Act that omits it takes effect. The reader who wants the full record of that older machinery, and of how Section 43A was read in practice, will find it in the guide to the Information Technology Act, which this article treats as the continuing backdrop rather than re-writing it.

The legislative road to the 2023 Act was long and belongs, in its detail, to the companion article that owns the legislative history: a committee report in 2018, a bill in 2019 that went to a joint parliamentary committee, a withdrawal, a fresh draft in 2022, and the final bill moved in the Lok Sabha in August 2023 and passed within days. What the pillar needs from that history is only the shape of the choice Parliament made in the final text, which is what the rest of this article reconstructs provision by provision.

The passage itself, in outline, took six days of parliamentary time. The Bill was introduced in the Lok Sabha on 3 August 2023 by the Minister for Electronics and Information Technology, Ashwini Vaishnaw, amid opposition objection to its being taken up without referral to a standing committee. The Lok Sabha passed it on 7 August 2023 and the Rajya Sabha on 9 August 2023, and the President’s assent followed on 11 August 2023. The enacted text was markedly leaner than its ancestors: forty-four sections and a single Schedule, against the hundred-section architectures of the earlier drafts, and the leanness was the government’s stated philosophy, a short framework statute carried by rules rather than a code that tries to settle everything in primary legislation. Opposition members in both Houses concentrated on the State exemption, the absence of journalistic protection, and the Board’s appointment design, which are the same three points the later constitutional challenges press. That convergence is itself a finding: the litigation was visible in the debate, and the statute was enacted with its principal constitutional vulnerabilities named on the floor.

Why the Digital Personal Data Protection Act’s commencement calendar is the whole story

Section 1(2) of the Act provides that it shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint, and that different dates may be appointed for different provisions. That one subsection is the most consequential sentence in the statute for anyone planning around it, because it meant that for more than two years after assent nothing in the Act bound anyone. The machinery arrived in November 2025, when the Central Government issued the commencement notification and the Digital Personal Data Protection Rules, 2025 on the same day, splitting both instruments into three tranches.

The first tranche took effect on the notification date of 13 November 2025: the definitions in section 2, the chapter establishing the Data Protection Board of India with its composition, tenure and procedure, the provisions on protection of action taken in good faith, consistency with other laws, the bar of civil court jurisdiction, and the rule-making, notification-laying, schedule-amendment and difficulty-removal powers, together with the amendments the Act makes to the telecom disputes tribunal’s parent statute and to the Right to Information Act. What commenced was the scaffolding: the regulator exists, the interpretive machinery works, and two of the three consequential amendments bite. Nothing that touches a business’s daily operations was in that tranche.

The second tranche takes effect twelve months later, on 13 November 2026, and it is a single-purpose one: section 6(9), which requires every consent manager to be registered with the Board, and section 27(1)(d), which gives the Board the power to inquire into breaches of the conditions of that registration. Consent managers, the registered intermediaries through whom a data principal may give, manage, review and withdraw consent, become a regulated class a full six months before any fiduciary owes a duty to anyone.

The Rules mirror the same architecture, which is why the two instruments have to be read together. The Digital Personal Data Protection Rules, 2025 were notified by the same Gazette exercise, and their own commencement rule splits them into the same three tranches: the preliminary and Board-related rules on publication, the consent-manager registration rule at twelve months, and the operational rules, covering notice, consent mechanics, breach intimation, children’s data and the rest, at eighteen months. Draft rules had been published for consultation in January 2025, and the interval between the draft and the final text is part of the compliance story, because businesses that built against the draft found the architecture stable and the detail revised. The two G.S.R. numbers, 843(E) for the commencement notification and 846(E) for the Rules, are the citations a careful reader should look for in the Gazette, since much commentary cites the pair loosely and a compliance file should cite them exactly.

The third tranche takes effect eighteen months after notification, on 13 May 2027, and it is everything else: the applicability provisions, the lawful bases, the notice and consent machinery, the fiduciary obligations, the children’s provisions, the significant fiduciary duties, the rights and duties of data principals, the transfer provision, the exemptions, the Board’s inquiry and direction powers, the penalty machinery, the information and blocking powers, and the amendment that omits Section 43A of the technology statute. The consequence is stark and should be stated without hedging: until 13 May 2027, no data fiduciary in India is bound by the consent standard, the notice duty, the security safeguards, the breach-notification duty, or the erasure duty of the 2023 Act. The Act is in force; its operative core is not.

A proposal to compress the eighteen-month period to twelve months was consulted on in January 2026, which would have pulled the final tranche forward by half a year. No notification altering the dates has appeared in the material this article relies on, and a compliance plan should treat the published dates as the dates until a fresh notification says otherwise. The field within which all of this sits, from the technology statute through the telecom law to the coming data and telecom instruments, is mapped in the complete guide to technology law in India, which treats this Act as one instrument in a larger regulatory field rather than as a self-contained universe.

Why is the whole commencement calendar left to notification?

The Act leaves its commencement calendar to notification because its obligations cannot be switched on like a light: consent flows, notices in two dozen languages, grievance machinery, processor contracts and the regulator itself all had to be built before a single duty could bind a single business.

A consent architecture requires businesses to rebuild collection flows, rewrite notices in multiple languages, stand up grievance machinery, and renegotiate processor contracts; a breach-notification duty requires an incident-response function that most mid-sized firms do not have; and the regulator itself had to be constituted, staffed and digitised before it could receive a single complaint. Staged commencement is the standard technique for regimes of this kind, and it is also a political technique: it lets a government take the credit for enacting a rights statute while deferring the compliance pain, and the pain of enforcement, to a later administration’s watch. The honest reading holds both truths at once. The calendar is operationally necessary, and it is also the reason the statute’s tenth anniversary of the privacy judgment will arrive before its first substantive obligation binds anyone.

The artifact: what binds whom, and from when

The table below is this article’s findable artifact. No official source sets the statute’s obligations against its staged commencement in one view, and the date column is the part that matters most in practice, because every duty in the Act is real on paper long before it is real in law.

Obligation	Who owes it	What it requires	Binds from
Notice	Every data fiduciary	A notice stating the data, the purpose, the rights route and the complaint route, in clear language and in English or an Eighth Schedule language	13 May 2027
Consent	Every data fiduciary	Free, specific, informed, unconditional and unambiguous consent by clear affirmative action, limited to necessary data	13 May 2027
Consent manager registration	Every consent manager	Registration with the Board under the conditions prescribed (section 6(9))	13 November 2026
Security safeguards	Every data fiduciary	Reasonable security safeguards to prevent personal data breach (section 8(5))	13 May 2027
Breach notification	Every data fiduciary	Intimation to the Board and each affected principal without delay, detailed Board report within seventy-two hours	13 May 2027
Erasure	Every data fiduciary	Erasure on withdrawal of consent or when the purpose is no longer served, unless retention is required by law	13 May 2027
Grievance redressal	Data fiduciaries and consent managers	Readily available redressal means and a response within the prescribed period	13 May 2027
Children’s consent	Fiduciaries processing children’s data	Verifiable parental or guardian consent; no detrimental processing, tracking, behavioural monitoring or targeted advertising	13 May 2027
Significant fiduciary duties	Notified significant data fiduciaries	India-based data protection officer, independent data auditor, periodic impact assessment and audit	13 May 2027
Data principal rights	Data fiduciaries (duty), data principals (claim)	Access summary, correction and erasure, grievance redressal, nomination (sections 11 to 14)	13 May 2027

Two rows deserve emphasis because summaries omit them. The Board’s establishment provisions are already in force, which is why no row for the Board appears: the institution exists, and what arrives in May 2027 is not the Board but the jurisdiction, the inquiry and penalty powers that make the Board matter. And the consent-manager row is the only obligation in the table with a 2026 date, which makes it the first real deadline in the entire statute.

The digitisation trigger deserves a sentence of its own, because it converts legacy paper into regulated data without any act of collection directed at the principal. A hospital’s decades of paper case files, a bank’s physical account-opening forms, a school’s admission registers: none of it is digital personal data while it sits in the cabinet, and all of it becomes regulated the moment it is scanned into a system, at which point the notice, security and erasure duties attach to material collected under entirely different expectations. Businesses digitising archives for operational reasons are, often without noticing, expanding their regulated estate, and the prudent sequencing is to digitise with the retention schedule already decided rather than to scan first and deliberate later. The determination test has a collective edge as well: the fiduciary definition catches persons who determine purpose and means in conjunction with others, which is the statute’s answer to group structures and joint platforms, where a parent company sets the purposes, a subsidiary runs the systems, and each points at the other when a principal complains. The definition makes both fiduciaries, and the Board is unlikely to be sympathetic to internal architecture offered as a defence.

What the Act covers, and where it stops

Section 3 gives the Act a deliberately wide but bounded field. It applies to the processing of digital personal data within India, whether the data was collected in digital form or was collected in non-digital form and digitised afterwards. It also applies to processing outside India where that processing is connected with offering goods or services to data principals within India, which is how the Act reaches the foreign business that has no office in India but sells to Indian customers. The definition of processing is itself expansive: a wholly or partly automated operation performed on digital personal data, running from collection and recording through storage, use, sharing and erasure to destruction.

The exclusions matter as much as the inclusions. The Act does not apply to personal data processed by an individual for personal or domestic purposes, and it does not apply to personal data that has been made or caused to be made publicly available, either by the data principal herself or by someone under a legal obligation to publish it. The statute’s own illustration makes the point concrete: a person who blogs her views and publishes her personal data on social media in the process takes that data outside the Act. Data that has been genuinely anonymised, so that it is no longer data about an identifiable individual, falls outside the definition of personal data altogether, though the Act leaves the hard cases, data that is merely pseudonymised or that can be re-identified with modest effort, to be worked out in practice.

Two features of the coverage design deserve attention because they are the source of most misreading. First, the Act is medium-neutral within the digital world: it does not distinguish between data collected online and data collected on paper and later digitised, and a business that imagines its offline customer registers are outside the statute is wrong the moment those registers are entered into a system. Second, the Act has no threshold of scale or sensitivity for its basic application: unlike some regimes that exempt small businesses or non-sensitive data, the core duties apply to every data fiduciary from the largest platform to the neighbourhood clinic with a digitised appointment book, with relief for small players arriving only through the targeted exemption power, not through the coverage section.

Three boundary problems in the definitions

Statute pillars earn their keep at the edges, and three edges of this Act will generate a disproportionate share of its disputes. The first is anonymisation. The Act governs personal data, defined as data about an individual who is identifiable by or in relation to such data, so data rendered anonymous falls outside it; but the statute nowhere defines the standard of anonymisation, and the space between anonymised and merely pseudonymised data, identifiers removed but re-identification possible with auxiliary data, is where research datasets, advertising identifiers and analytics products live. A fiduciary that treats a hashed email address as anonymised data outside the Act is taking a position the text does not secure, and the Board’s early rulings on the point, whenever they come, will matter far beyond the parties.

The second edge is the publicly-available exclusion. Section 3(c)(ii) removes from the Act personal data made or caused to be made publicly available by the principal herself or by a person under a legal duty to publish it. The exclusion invites the scraping argument: that data a person posted publicly, on a social platform, a professional directory or a public register, may be harvested and processed freely because the Act does not reach it. The illustration in the statute, about a blogger’s own posts, supports the narrow version of the argument, data the principal herself published in the very act of publishing. The wide version, that anything visible anywhere is fair game for any purpose, reads an exclusion aimed at publication as though it were a licence for industrial collection, and a court or the Board will have to decide whether the purpose for which data was made public limits the purposes for which the exclusion protects its use. Businesses building training datasets or lead-generation products on scraped public data should treat the point as open, not settled in their favour.

The third edge is territorial. The Act reaches processing outside India only where it is in connection with offering goods or services to data principals within India. A foreign business with no Indian targeting is outside; a foreign business that merely finds its website accessible in India sits in a grey zone the section does not illuminate, because offering suggests direction and the statute sets no direction test. The mirror image is section 17(1)(d), which exempts processing of data of principals outside India by Indian businesses under foreign contracts: the provision is the statutory foundation of India’s outsourcing industry, ensuring that a Pune or Bengaluru processor handling European or American customer data under contract is not doubly regulated by the Indian Act for that work, and it interacts with the foreign client’s own regime, which will usually impose its standards contractually instead.

The cast of the Act: five actors

Section 2 builds the statute out of five roles, and most reading errors about the Act are role errors. The data principal is the individual to whom the personal data relates, and where that individual is a child, the definition expressly includes the parents or lawful guardian; where the individual is a person with disability, it includes her lawful guardian acting on her behalf. This is drafting with consequences: the guardian is folded into the principal’s identity, which is how the consent and rights machinery can operate for people who cannot operate it themselves. The data fiduciary is any person who, alone or with others, determines the purpose and means of processing: the test is decisional, not technical, and it catches the business that never touches a server as surely as the one that does. The data processor is any person who processes on the fiduciary’s behalf, and the definition does no more than that; the statute places its obligations almost entirely on fiduciaries and reaches processors only through the fiduciary’s contracts and erasure instructions, a design choice that keeps accountability single-pointed.

The significant data fiduciary is not a fifth actor so much as a fiduciary carrying a designation, created by notification under section 10 and carrying the additional duties examined below. The consent manager is the only genuinely new creature: a person registered with the Board who acts as a single point of contact enabling the principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. Two further definitions repay attention. Personal data breach is defined to include unauthorised processing as well as accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, where the incident compromises confidentiality, integrity or availability: the definition reaches insider misuse and ransomware alike, and it is deliberately wider than the picture of an external hacker that the phrase breach summons. And the Act is the first Indian statute to use she and her as its default pronouns, with section 2 expressly providing that she includes reference to an individual irrespective of gender, a drafting choice made in the text rather than left to the General Clauses Act.

Consent: the notice, the standard, and the withdrawal

The Act’s consent architecture is its most worked-out part, and it is worth reconstructing carefully because most summaries compress it into a slogan about consent being required. Section 5 requires that every request for consent be accompanied or preceded by a notice from the data fiduciary, and the notice must do three things: state the personal data and the purpose for which it is proposed to be processed, explain how the data principal may exercise her rights, and explain how she may complain to the Board. The notice, and the consent request itself, must be presented in clear and plain language, and the data principal must be given the option to access both in English or in any language listed in the Eighth Schedule to the Constitution. That language requirement is one of the statute’s most underestimated operational demands: a consent flow that exists only in English does not comply.

Section 6 then sets the standard the consent must meet. It must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, given for a specified purpose, and limited to such personal data as is necessary for that purpose. Any part of a consent that infringes the Act, the rules, or any other law is invalid to the extent of the infringement, and the statute illustrates the point with a consent term that purports to waive the right to complain to the Board. Where consent was given before the Act’s commencement, the fiduciary must, as soon as reasonably practicable, give the data principal a retrospective notice containing the same three elements, and may continue processing until consent is withdrawn.

Withdrawal is where the architecture shows its teeth. A data principal may withdraw consent at any time, and the ease of withdrawal must be comparable to the ease with which consent was given: the one-tap signup cannot be paired with a written application to the head office. On withdrawal, the fiduciary must within a reasonable time cease processing, and cause its processors to cease processing, unless some other provision of the Act or of another law requires or authorises the continued processing. The statute is careful about consequences: withdrawal does not affect the legality of processing done before it, and the consequences of withdrawal, such as losing access to a service whose supply depended on the data, are borne by the data principal. The burden of proof is also allocated: where a dispute arises in a proceeding about whether consent was the basis of processing, the fiduciary must prove that notice was given and consent was obtained in accordance with the Act and the rules.

The consent manager is the Act’s most distinctive institutional invention. A data principal may give, manage, review or withdraw her consent through a consent manager, a person registered with the Board who acts as a single point of contact through an accessible, transparent and interoperable platform, accountable to the principal and bound to act on her behalf as prescribed. Every consent manager must be registered with the Board subject to technical, operational, financial and other conditions, and that registration requirement is the one substantive provision that takes effect in the second tranche, in November 2026. The design imagines a market of intermediaries sitting between individuals and the businesses that want their data, though whether such intermediaries emerge at scale will depend on the registration conditions the rules set and on whether businesses find it cheaper to build compliant consent flows themselves.

The consent manager’s economics are the design’s unresolved question, and they are worth stating because they determine whether the institution lives. The manager is accountable to the principal and must act on her behalf, yet a service principals will not pay for must be paid for by somebody, and if fiduciaries fund the managers through whom consent reaches them, the manager’s independence rests on the registration conditions and the Board’s supervision rather than on its revenue model. The statute anticipates the conflict only through the accountability duty and the registration framework: technical, operational, financial and other conditions, enforced by the Board’s inquiry power over registration breaches from November 2026. The closest domestic analogy is the account-aggregator framework in financial data, where consent-based sharing intermediaries operate under a central bank licence and a no-monetisation-of-data discipline; the data protection version is broader, covering every sector, and its success will be measured by whether principals experience it as their agent or as one more consent screen between them and a service. A reader building study or compliance material on this machinery may find it useful to build a slide deck of the DPDP notice and consent requirements on ReportMedic’s PowerPoint viewer, which is the companion tool assigned to this article.

What happens to consent given before the Act commences?

Consent collected before the commencement date does not evaporate, and it does not need to be re-taken in the statute’s new form. Section 5(2) provides a bridge: the fiduciary must send a fresh notice with the same contents as a new one, and may keep processing until withdrawal.

The practical consequence is a retrospective notice campaign for every business holding legacy data, describing what it holds and why, delivered by email, in-app notification or another effective method. The bridge is humane to businesses and it is also the statute’s quiet admission that consent, as a legal basis, has a history problem: most of the data held in India was collected under consent standards far weaker than the one the Act demands, and the Act grandfathered that weaker consent rather than invalidating it.

The statute’s own illustrations do more analytical work than most summaries credit, and two of them should shape how the consent standard is understood. In the first, a telemedicine application asks consent for two purposes, providing telemedicine services and accessing the phone’s contact list; the illustration holds that the consent is limited to the first, because the contact list is not necessary for the specified purpose. Necessity is therefore not a drafting nicety but a limit built into consent’s validity: bundled consent, the single tap that authorises everything, fails the standard whenever the bundle reaches beyond what the purpose needs. In the second, an insurer’s consent form includes a term waiving the principal’s right to complain to the Board, and the illustration holds that part of the consent invalid. The statute polices the content of consent, not merely its form, and a consent document larded with waivers of statutory rights is partially void by operation of law.

Consent obtained through a consent manager, or through an interface the principal controls, raises the evidentiary question the Act answers in advance. Section 6(10) places the burden squarely on the fiduciary: in any proceeding where consent is in issue, the fiduciary must prove that notice was given and consent was granted in accordance with the Act and the rules. The practical consequence is an audit trail duty disguised as a proof rule. A business that cannot reconstruct what notice a principal saw, in what language, and what affirmative action she took, does not have consent in the eyes of the Board, whatever its signup numbers say. Consent records, version histories of notices, and withdrawal logs become primary compliance documents, and businesses that treat consent as a user-interface event rather than an evidentiary one will learn the difference at the inquiry stage.

One further point about the notice is easy to miss and expensive to repair. The notice must state the personal data proposed to be processed, and the consent it supports must be specific and limited to data necessary for the purpose. A notice written in categories so general that they cover anything, data relating to the provision of services and allied purposes, fails twice: it does not inform, which is the notice’s statutory function, and it undermines the specificity of the consent taken on its back. The discipline the Act imposes is itemisation: the fiduciary must know, collection point by collection point, what it takes and why, and must say so in language a customer can test against her own experience of the service. Businesses whose data practices grew organically, a field added here, a third-party script added there, will find the notice exercise forces the inventory that the compliance calendar begins with, which is why experienced practitioners treat notice-drafting not as a legal-writing task but as the audit itself, conducted in public.

Certain legitimate uses: the second door

Consent is only one of two doors into lawful processing. Section 7 permits processing without consent for certain legitimate uses, and the list is worth reading in full because it is where the State’s own data processing largely lives. A fiduciary may process data the principal voluntarily provided for a specified purpose, where she has not indicated that she does not consent to the use. The State and its instrumentalities may process data to provide or issue a subsidy, benefit, service, certificate, licence or permit, either where the principal previously consented or where the data sits in a notified State database, subject to prescribed governance standards. Processing is permitted for the performance of a State function under law or in the interest of sovereignty and integrity; for fulfilling a legal obligation to disclose information to the State; for compliance with a judgment or order, including foreign orders on contractual or civil claims; for medical emergencies threatening life or health; for epidemics and public health measures; for disasters and breakdowns of public order; and for employment purposes, including safeguarding the employer against loss, preventing corporate espionage, and protecting trade secrets, intellectual property and classified information, or providing a service or benefit the employee-principal has sought.

The benefits limb rewards a slower reading, because it is the channel through which the State will process the largest volumes of citizen data. Its structure is conditional in two steps: the processing must be for providing or issuing a prescribed subsidy, benefit, service, certificate, licence or permit, and either the principal previously consented to State processing for such purposes or the data is available in a database, register, book or document maintained by the State and notified by the Central Government. A standards condition rides on top: the processing must follow the standards of the Central Government’s policy for governance of personal data or of any governing law. The maternity-benefits illustration in the statute shows the intended reach: a woman who enrols for a maternity programme, consenting to provide her data for that programme, may have her data processed to determine eligibility for other prescribed benefits. The step from one programme to a general eligibility engine is precisely the step the illustration takes, and it is the step critics identify when they describe the limb as converting enrolment in a welfare scheme into a standing consent to inter-departmental data use.

The voluntary-provision limb is built differently and is easy to misread as consent by another name. It is not consent: there is no affirmative-action requirement, no notice attached to the limb itself, and the principal’s protection is the negative condition that she has not indicated she does not consent to the use. In structure it is the ghost of the deemed-consent idea that earlier drafts carried openly, retained in narrowed form and tied to the specified purpose for which the data was handed over. Its narrowness is its defence: the real-estate illustration closes the loop by requiring the broker to stop when the customer says the search is over. But a limb whose boundary is set by illustrations rather than by definition will be tested by businesses whose specified purposes are drafted wide, and the Board’s reading of how specific a specified purpose must be will decide whether the limb is a transaction-completion rule or a general processing licence.

The employment limb is the one private businesses will use most, and it is also the one most likely to be stretched. An employer that monitors employee communications to protect trade secrets is inside the clause; an employer that mines the same communications for productivity scoring is relying on a reading the clause does not obviously support. The voluntary-provision limb carries a similar boundary problem: the pharmacy illustration in the statute shows a customer who asks for an SMS receipt, a narrow purpose tied to the transaction, not a general licence to build a marketing profile from every purchase. The legitimate-uses door is real, but it is narrower than a hurried reading suggests, and each limb ties the processing to a purpose the principal can recognise.

What a data fiduciary must do, in order

Section 8 gathers the fiduciary’s general obligations, and they repay being read as a sequence rather than a list. The fiduciary is responsible for compliance with the Act and the rules in respect of any processing it undertakes itself or through a processor, irrespective of any agreement to the contrary and irrespective of whether the principal performed her own duties under the Act: responsibility cannot be contracted away, and a principal’s failure to behave well does not excuse the fiduciary. A processor may be engaged only under a valid contract, which makes the processor agreement a compliance document rather than a commercial formality. Where the data is likely to be used to make a decision affecting the principal, or to be disclosed to another fiduciary, the fiduciary must ensure its completeness, accuracy and consistency.

The security duty sits at the centre of the enforcement design. The fiduciary must protect personal data in its possession or control, including processing done through its processors, by taking reasonable security safeguards to prevent personal data breach. The statute does not prescribe the safeguards; it sets the standard of reasonableness and lets the penalty for its breach, up to two hundred and fifty crore rupees, supply the incentive. On breach, the fiduciary must intimate the Board and each affected data principal in the prescribed form and manner, and the Rules give that duty its teeth: intimation without delay to both, followed by a detailed report to the Board within seventy-two hours of becoming aware of the breach, or within such extended period as the Board may permit, covering the nature, extent and timing of the breach, its likely impact, and the remedial steps taken. There is no materiality threshold: any breach meeting the statutory definition triggers the duty, which is why the incident-response function the duty presupposes is one of the costliest things the Act demands of mid-sized businesses.

The erasure duty closes the loop. Unless retention is necessary for compliance with another law, the fiduciary must erase personal data when the principal withdraws consent or as soon as it is reasonable to assume the specified purpose is no longer served, and must cause its processors to erase what was made available to them. The statute supplies a deeming rule for when a purpose is no longer served: if the principal has neither approached the fiduciary for performance of the purpose nor exercised any right in relation to the processing, for such period as may be prescribed, the purpose is deemed spent, with different periods prescribable for different classes of fiduciaries and purposes. The fiduciary must also publish the business contact information of a data protection officer, where one is appointed, or of a person able to answer the principal’s questions about processing, and must establish an effective grievance-redressal mechanism.

The retention architecture built on the deeming rule is where the Act quietly changes everyday practice. For most businesses, personal data has been kept indefinitely by default, because storage is cheap and deletion feels risky. The Act reverses the default: the purpose defines the lifespan, inactivity starts a clock, and the clock is prescribed by class of fiduciary so that high-volume platforms, e-commerce entities, gaming intermediaries and social media services carry defined periods after which untouched accounts and their data must be erased, with prior notice to the principal before the erasure takes effect. A business that cannot say, for each category of data it holds, what purpose keeps it alive and what event kills it, is not ready for May 2027, however polished its privacy policy looks. The accuracy duty cuts the other way: where data feeds decisions, about credit, employment, insurance or admission, the fiduciary must ensure the data is complete, accurate and consistent, which makes stale or half-corrected records a compliance failure in their own right and not merely bad housekeeping. One short sentence of orientation is in order here: the general position described in this article is legal information, not advice on any individual matter, and limitation periods and forum rules are unforgiving.

A subscription business makes the erasure duty concrete. A streaming service holds a former subscriber’s viewing history, payment tokens, device identifiers and support correspondence. The subscription’s end does not by itself end every purpose: tax and accounting law requires retention of transaction records, fraud prevention may justify a defined window for some identifiers, and the support correspondence may be needed for a live dispute. What the Act forbids is the undifferentiated keep-everything default: the viewing history kept for recommendation purposes has no surviving purpose once the account closes and the prescribed inactivity logic runs, and it must go, with the processors instructed to delete their copies as well. The fiduciary’s work is the mapping, purpose by purpose and dataset by dataset, of what survives, under which law, and for how long, and the erasure certificate it can produce when the Board asks. Businesses that perform that mapping in the preparation window will find the duty administrative; businesses that postpone it will find it archaeological.

The accuracy duty has a frontier that will grow in importance as automated decision-making spreads. Section 8(3) is triggered where data is likely to be used to make a decision that affects the principal, and in a credit-scoring, hiring-screening or insurance-pricing pipeline the decision is the product: an error in the underlying record is not a clerical blemish but the direct cause of a refusal the principal may never be told about in terms she can contest. The duty’s three adjectives, completeness, accuracy and consistency, each bite differently in such pipelines: completeness against the file assembled from fragments that omit the exculpatory half, accuracy against the field that was wrong at entry, and consistency against the two databases that disagree about the same person, where the fiduciary must decide which record governs and be able to explain the choice. Read with the correction right, the duty makes data quality a legal obligation with an individual trigger, and the fiduciary that treats its master data as an operational detail rather than a regulated asset has misunderstood the statute’s centre of gravity.

Children and the verifiable-consent problem

Section 9 treats children’s data as the Act’s hardest operational problem, and it is honest about why. A child is defined as an individual who has not completed eighteen years of age. Before processing any personal data of a child, or of a person with disability who has a lawful guardian, the fiduciary must obtain verifiable consent of the parent or lawful guardian, in the prescribed manner. Processing likely to cause any detrimental effect on the well-being of a child is prohibited outright, as are tracking, behavioural monitoring and targeted advertising directed at children. The statute gives the Central Government two escape valves: it may exempt classes of fiduciaries or purposes from the parental-consent and no-tracking duties by prescription, and where it is satisfied that a fiduciary’s processing of children’s data is verifiably safe, it may notify an age above which that fiduciary is exempt from all or any of those obligations.

The well-being standard carries its own difficulty. The prohibition is on processing likely to cause any detrimental effect on the well-being of a child, and neither phrase, detrimental effect nor well-being, is defined. Recommendation systems that maximise engagement, streak mechanics that punish absence, social comparison features, in-game purchase prompts aimed at minors: each is plausibly detrimental, none is certainly so, and the fiduciary must decide under a standard whose content the Board and the courts have yet to supply. The tracking prohibition has a similar penumbra: behavioural monitoring is banned, but the line between monitoring and the ordinary analytics that keep a service running, crash reporting, security logging, aggregate usage measurement, is not drawn in the text, and the prescription power to exempt classes and purposes is the safety valve through which the working line will mostly be negotiated. A fiduciary serving minors should therefore treat section 9 as a standard to be reasoned about and documented, not a checklist to be completed, because the defence of a well-being judgment will be the record of having made it carefully.

Verifiable consent is the phrase that will generate the most compliance work and the most litigation. The Act demands that the fiduciary verify that the person consenting is in fact the parent or lawful guardian and an adult, without specifying how, and the methods that suggest themselves, document upload, government identity checks, payment-based verification, each carry their own privacy and exclusion costs. A platform that over-verifies excludes children whose parents lack documentation; a platform that under-verifies fails the statutory standard. The prohibition on behavioural monitoring sits uneasily beside the recommendation engines that define the modern platform, and the exemption for verifiably safe processing invites the question of who certifies safety and against what standard. This is the provision where the statute’s ambition most visibly outruns its machinery, and it is no accident that it is also the provision whose breach carries the second-highest penalty in the Schedule.

The disability limb of section 9 is narrower than the children’s limb and easier to miss. It applies where a person with disability has a lawful guardian, and it routes the consent through that guardian, which connects to the Act’s definition of a data principal, where the guardian is folded into the principal’s identity for such a person. The design respects the guardianship framework of disability law rather than inventing a parallel one, but it leaves the hard cases, a person with disability who has no lawful guardian and manages her own affairs, to the ordinary consent route, which is the correct result even though the statute never says so expressly. The age threshold itself is a policy choice with edge effects: eighteen is higher than the age at which a young person may work, open certain accounts, or be tried for an offence, and a seventeen-year-old with an income and a smartphone is, for data purposes, a child whose parent must consent and whom no platform may behaviourally monitor. Critics of the threshold argue it infantilises older adolescents and pushes them toward age falsification, which degrades the very data the statute wants kept accurate; the statute’s answer is the verifiably-safe exemption, which lets the government relax the duties for fiduciaries whose processing is demonstrably safe, though the certification of safety is itself left to notification.

Significant data fiduciaries

Section 10 creates a two-tier regime. The Central Government may notify any fiduciary or class of fiduciaries as a Significant Data Fiduciary on the basis of an assessment of relevant factors, including the volume and sensitivity of data processed, the risk to the rights of data principals, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, the security of the State, and public order. The factors are a deliberate mixture of the commercial and the sovereign: a large social media platform qualifies on volume, a political consultancy on electoral risk, a health-data aggregator on sensitivity.

The designated fiduciary takes on three additional duties. It must appoint a data protection officer based in India, responsible to its board of directors or similar governing body and serving as the point of contact for the grievance mechanism. It must appoint an independent data auditor to evaluate its compliance. And it must undertake periodic data protection impact assessments, described in the statute as a process covering the rights of principals, the purposes of processing, and the assessment and management of risk to those rights, together with periodic audits and any other prescribed measures. The impact assessment is the duty with the most intellectual content, and its statutory description is precise enough to plan against: a process comprising a description of the rights of data principals and the purpose of processing of their personal data, and the assessment and management of the risk to the rights of the data principals, together with such other prescribed matters. Two features distinguish it from a compliance checklist. It is organised around the principal’s rights rather than the firm’s risks, so a well-built assessment reads the processing from the data subject’s side of the table; and it is periodic, which converts it from a launch document into a standing discipline that must be refreshed as purposes, vendors and data categories change. The independent data auditor carries a familiar structural tension: appointed and paid by the fiduciary, charged with evaluating that fiduciary’s compliance for the regulator’s benefit. Statutory audit in company law lives with the same tension and manages it through professional standards and rotation norms; the data audit regime will need its equivalent discipline, and the auditor’s findings, when the Board calls for them, will be among the most revealing documents in any inquiry.

The designation power lies entirely with the executive, exercised by notification, which means the two-tier regime exists only to the extent the government chooses to populate it. Until a notification designates someone, every fiduciary is an ordinary one.

That dependence has a planning consequence that businesses near the designation line should internalise. The factors are stated at a level of generality, volume, sensitivity, electoral risk, public order, that gives a large platform, a dominant payment network, a major health-data holder or a political-services firm no reliable way to self-assess whether designation is coming, and designation converts long-horizon duties into immediate ones: an India-based officer answerable to the board, an independent auditor with access to the compliance record, and impact assessments of a depth that cannot be improvised after notification. The rational course for a fiduciary plausibly within the factors is to build the machinery before designation, at rehearsal depth, so that notification is an activation event rather than a crisis. The statute’s silence on any designation timetable is therefore not a comfort; it is the very reason the preparation cannot wait for certainty.

The rights of a data principal

Chapter III gives the data principal four rights, and their modesty relative to other regimes is part of the statute’s character. The right to access information lets a principal who has previously given consent obtain from the fiduciary a summary of the personal data being processed and the processing activities undertaken, the identities of all other fiduciaries and processors with whom the data has been shared with a description of what was shared, and any other prescribed information. The statute carves out one disclosure: where the sharing was with a fiduciary authorised by law to obtain the data for prevention, detection or investigation of offences or cyber incidents, or for prosecution, the principal is not told. The right to correction and erasure lets the principal demand correction of inaccurate or misleading data, completion of incomplete data, updating of data, and erasure unless retention is necessary for the specified purpose or for compliance with law.

The right of grievance redressal requires the fiduciary or consent manager to provide readily available means of redress for any act or omission concerning the principal’s data or her rights, and to respond within the prescribed period; the principal must exhaust that route before approaching the Board. The right to nominate lets the principal designate another individual to exercise her rights in the event of her death or incapacity, with incapacity defined as inability to exercise the rights owing to unsoundness of mind or infirmity of body. What is absent is as notable as what is present: there is no right to data portability, no general right to object to processing, and no right to compensation, and the access right reaches only data processed on the basis of consent, including the deemed-consent limb of section 7, not data processed under the State-function or security limbs.

Two features of the rights chapter will decide how much it is worth in practice. The first is the exhaustion rule in section 13(3): the principal must exhaust the fiduciary’s grievance mechanism before approaching the Board. Read generously, the rule reserves a digital regulator for cases the business could not or would not fix. Read as a trap, it means the quality of the Board’s docket is set by the quality of thousands of private grievance desks, and a fiduciary that answers slowly, opaquely or not at all controls the gateway to the regulator. The prescribed response period, and the Board’s willingness to treat non-response as exhaustion, will determine which reading prevails. The second is the disclosure carve-out in section 11(2): a principal asking who her data has been shared with is not told about sharing with fiduciaries authorised by law to obtain it for prevention, detection or investigation of offences or cyber incidents, or for prosecution. The carve-out is understandable as an investigations safeguard, but its breadth is notable, because it hides precisely the sharing, to the State’s investigative machinery, that many principals most want to know about.

The form of the access right deserves a remark, because it is weaker than the phrase suggests. What the principal obtains is a summary of the personal data being processed and of the processing activities, not a copy of the data itself, and the identities of the fiduciaries and processors with whom it has been shared, with a description of the data shared. A summary can be accurate and uninformative at once, and the difference between the two will be the substance of early disputes: a fiduciary that answers a request with its privacy policy restated has complied with the letter in a way no regulator should accept, while a fiduciary that hands over raw records may breach its duties to others. The correction right has a similar texture: it obliges the fiduciary, on request, to correct inaccurate or misleading data, complete incomplete data, and update data, and the fiduciary’s own accuracy duty under section 8(3) means a correction request doubles as a notice that its decision-grade data was defective. The nomination right, finally, is the statute’s most humane provision and its least tested: it lets a principal plan for her own death or incapacity by naming the person who will exercise her rights, and it will collide in practice with succession disputes, family conflict and the fiduciary’s need to verify both the nomination and the event that activates it.

The duties of a data principal

Section 15 is the provision that surprises foreign readers most, because it imposes duties on the individual the statute exists to protect. A data principal must comply with all applicable laws while exercising her rights; must not impersonate another person when providing personal data for a specified purpose; must not suppress material information when providing data for a document, unique identifier, proof of identity or proof of address issued by the State or its instrumentalities; must not register a false or frivolous grievance or complaint with a fiduciary or the Board; and must furnish only verifiably authentic information when exercising the rights of correction or erasure. Breach of these duties attracts a penalty of up to ten thousand rupees, a figure deliberately trivial beside the crore-denominated penalties for fiduciaries, but a penalty all the same.

The provision has two faces. Its defenders read it as a good-faith clause: a rights regime in a country of this scale cannot function if impersonation, suppression and frivolous complaints are costless, and the Board is separately empowered to warn or impose costs on a complainant whose complaint it finds false or frivolous. Its critics read it as a deterrent: an individual of modest means, unsure whether her grievance will be judged frivolous, may choose not to complain at all, and the duties on providing authentic information sit oddly beside a consent architecture that otherwise asks little of the principal. The statute does not resolve the tension; it enacts it.

The grievance mechanism is the duty businesses most often mistake for a contact form. Section 8(10) requires an effective mechanism, section 13 gives the principal the right to use it and requires a response within the prescribed period, and the Rules cap the fiduciary’s published response timelines at ninety days. Effectiveness is the standard, and a mechanism that acknowledges complaints without resolving them, or that buries the channel inside an unrelated support queue, will be judged against the outcomes it produces when a disappointed principal carries the record to the Board. The mechanism is also the fiduciary’s early-warning system: grievance patterns are the cheapest breach-and-misuse detector a business owns, and the fiduciary that reads its grievance data as compliance intelligence, rather than as a customer-relations nuisance, will usually meet the Board, if it ever does, with a better record than the fiduciary that treated complaints as noise.

Moving data across borders

Section 16 takes the most permissive approach available to a legislature: the Central Government may, by notification, restrict the transfer of personal data by a fiduciary to such country or territory outside India as may be notified, and nothing in the section limits any other law that provides a higher degree of protection or a stricter restriction. Until such a notification is issued, transfer is permitted everywhere. The provision is a deliberate reversal of the earlier policy conversation, which had contemplated data localisation mandates and adequacy-style whitelists; the enacted position is a blacklist, and an empty one until the government fills it. A business planning its data flows should understand the mechanism rather than the moment: the operative step is the notification, and the section is designed so that the government can restrict transfers to a specific jurisdiction without amending the statute. The laying requirement applies to notifications under this section, so Parliament retains a thirty-day window to modify or annul a restriction after it is made.

The blacklist model has to be read alongside the sectoral restrictions that section 16(2) preserves. India’s financial regulators have long imposed their own geography on data: the Reserve Bank of India’s payment-data directions require payment system data to be stored in India, and sectoral rules for insurance, securities and banking carry their own localisation and outsourcing conditions. Section 16(2) provides that nothing in the transfer section restricts any Indian law providing a higher degree of protection or restriction, so the permissive default of the general statute coexists with hard localisation in regulated sectors, and a fiduciary that relies on the general position alone can still breach its sectoral obligations. The comparative point is worth making against the European model, which permits transfers on adequacy findings and contractual safeguards and restricts the rest: the Indian statute reverses the machinery, permitting by default and restricting by exception, which places the entire protective weight on the government’s alertness in issuing notifications. Critics of the model observe that a restriction that depends on the executive noticing a problem is weaker than a regime that requires justification before transfer; defenders answer that adequacy machinery is slow, political, and ill-suited to an economy whose technology sector runs on cross-border processing.

The transfer provision also sits inside a trade-policy posture that predates the Act. India has consistently resisted binding commitments on cross-border data flows in trade negotiations, arguing that data policy space is a development question, and section 16 is the domestic expression of that position: no standing commitments, no adequacy diplomacy, only a reserved executive power to restrict. Businesses with global architectures should note the consequence: the stability of India’s transfer regime is political rather than juridical, and a single notification, laid before Parliament but effective on issue, can re-draw the map for a destination overnight. Contract drafting has absorbed the lesson in other permissive regimes by building relocation and suspension clauses into processing agreements, and the same drafting is the prudent response here.

The exemptions

Section 17 is where the statute’s critics concentrate their fire, and it needs to be read with the same care as the obligations. Sub-section (1) takes Chapter II, except the responsibility and security-safeguards sub-sections of section 8, together with Chapter III and the transfer section, out of application in six defined cases: processing necessary for enforcing a legal right or claim; processing by a court, tribunal or other body entrusted by law with judicial, quasi-judicial, regulatory or supervisory functions, where necessary for that function; processing in the interest of preventing, detecting, investigating or prosecuting an offence or contravention; processing of data of principals outside India under a contract with a foreign person by a person based in India; processing necessary for court-approved mergers, amalgamations, demergers and reconstructions; and processing to ascertain the financial position of a loan defaulter, tied to the disclosure provisions of other laws. These are functional exemptions, and each is bounded by necessity.

Two of the functional exemptions repay a practical note. The legal-claims exemption exists so that litigation is not paralysed by the subject’s consent: a party assembling evidence, a lawyer preparing a claim, an insurer investigating a contested payout, each processes personal data of others, and the exemption for processing necessary for enforcing a legal right or claim keeps that ordinary forensic work outside the consent chapters while leaving the security duty intact. The mergers exemption performs the same service for corporate transactions, where due diligence over customer and employee data is impossible on a consent-first basis and the scheme is in any event court or tribunal approved, so the statute yields to the approval process as the safeguard. Both exemptions are necessity-bounded, which means the processing they protect is the processing the transaction or claim requires, not a general holiday for the parties’ other uses of the same data.

Sub-section (2)(a) is the provision that dominates the public argument. It takes the whole Act out of application in respect of processing by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to any cognisable offence relating to any of these, together with the Central Government’s processing of whatever data such an instrumentality furnishes to it. The exemption is enacted by notification, and its only statutory boundaries are the listed interests and the requirement of notification itself. Sub-section (2)(b) exempts processing necessary for research, archiving or statistical purposes, where the data is not used to take any decision specific to a principal and the processing follows prescribed standards. Sub-section (3) lets the government exempt fiduciaries, including startups, from the notice duty, the accuracy and erasure duties, the significant-fiduciary regime and the access right, having regard to the volume and nature of data processed. Sub-section (4) relieves State processing from the erasure and correction duties where no decision affecting the principal is involved. Sub-section (5) gives a five-year power to exempt any fiduciary or class by notification.

Three features of the exemption architecture deserve closer reading than they usually receive. The first is the survival clause inside sub-section (1): even in the exempt functional cases, the fiduciary’s non-delegable responsibility under section 8(1) and the security-safeguards duty under section 8(5) continue to apply. A court processing personal data for its judicial functions, or an investigator processing data to detect an offence, is outside the notice, consent and rights chapters, but is not outside the duty to keep the data secure or the responsibility for its processors. The statute thereby separates the process exemptions, which are broad, from the security duty, which is nearly universal, and a leak from an exempt system is not an exempt leak. The second feature is the research exemption’s two conditions: the data must not be used to take any decision specific to a data principal, and the processing must follow prescribed standards. The first condition is the operative one, and it draws the line between studying a population and acting on a person: a university analysing health records to model disease spread is inside the exemption, and the same dataset used to flag an individual patient for intervention is outside it. The third feature is the five-year power in sub-section (5), under which the Central Government may, before the expiry of five years from commencement, declare that any provision of the Act shall not apply to any fiduciary or class for a specified period. Read with sub-section (3), it gives the executive a general moratorium power over the young regime, useful for rescuing a sector that cannot comply in time and dangerous for exactly the same reason, because a moratorium declared for a large class would suspend the statute’s protection for millions of principals without a parliamentary vote.

The proportionality sentence is where the series’ account of the privacy judgment enters. The nine-judge bench that recognised privacy as a fundamental right laid down the standard every restriction must satisfy: a law, a legitimate state aim, and proportionality between the aim and the intrusion, with procedural safeguards. The petitioners who have challenged the exemption provisions argue that a power to exempt the State’s own instrumentalities from nearly the entire statute, exercisable by notification on broadly stated grounds, cannot survive that standard; the design’s defenders answer that the listed interests are the classic grounds on which every data protection regime yields to the state, and that the notification route keeps the exemption visible and contestable. The full judicial treatment of the privacy judgment, and of the Aadhaar verdict that applied it, is developed in the account of the Puttaswamy judgment, which this article cites rather than reproduces.

Why does the Act pair civil-court powers for the Board with no right to compensation?

The pairing looks contradictory until the enforcement theory is stated plainly. The Board’s civil-court powers are investigatory: they let a digital-first regulator summon witnesses, examine on oath, receive affidavit evidence and inspect data, so it can establish what happened inside a company’s systems after a breach.

Compensation is a different function: it requires a forum that measures individual loss, apportions causation, and awards damages, and the statute assigns that function to no one. The penalties the Board imposes are regulatory, calibrated by the gravity and repetitiveness of the breach and credited to the Consolidated Fund, not to the victim. The design treats a data breach as a public wrong to be deterred rather than a private loss to be made good, which is coherent as regulatory theory and unsatisfying as justice to the person whose data was exposed. Both things are true, and the statute chose deterrence.

The Data Protection Board of India

Chapter V creates the Board, and its design repays close attention because the Board is simultaneously the statute’s enforcement engine and its most contested institution. Section 18 establishes the Data Protection Board of India by notification as a body corporate with perpetual succession and a common seal, capable of holding property, contracting, suing and being sued. Section 19 provides that it shall consist of a Chairperson and such number of other Members as the Central Government may notify, all appointed by the Central Government in the prescribed manner, each a person of ability, integrity and standing with special knowledge or practical experience in data governance, administration of social or consumer protection laws, dispute resolution, information technology, the digital economy, law, regulation or techno-regulation, with at least one member an expert in law. The term of office is two years, renewable, and removal requires an opportunity of being heard. Section 28(1) declares that the Board shall function as an independent body and, as far as practicable, as a digital office, with complaints received, allocated, heard and decided digitally by design.

The digital-office design is more than an administrative preference; it is a theory of regulation. A Board whose intake, allocation, hearing and pronouncement are digital by design can in principle handle a complaint volume that would drown a conventional tribunal, publish its orders in searchable form as a matter of course, and build the precedent library that a new regime needs faster than any court system could. The same design carries risks the statute does not discuss: digital-by-default processes disadvantage complainants with poor connectivity or low digital literacy, the very principals whose data is most likely to be processed without meaningful consent; automated triage can quietly become automated disposal; and a regulator that never sits in a room with the parties may find its fact-finding thinner than its paperwork suggests. Section 28’s qualifying phrase, as far as practicable, is the statutory room for the Board to keep physical channels where digital ones would defeat access, and how generously the Board reads that phrase in its first procedural rules will say much about the institution it intends to be. The direction power completes the design: after hearing the person concerned and recording reasons, the Board may issue such directions as it considers necessary, and may later modify, suspend, withdraw or cancel them on representation or on a government reference, which makes its orders living instruments rather than one-shot judgments, closer to a supervisor’s toolkit than to a court’s decree.

Chapter VI gives the Board its work. It may act on an intimation of breach, a complaint by a data principal, a reference from the Central or a State Government, or a court’s direction; it determines whether sufficient grounds exist to inquire, conducts the inquiry on principles of natural justice with civil-court powers, and on completion either closes the proceedings or proceeds to penalty under section 33. It may issue directions to secure compliance, modify them on representation, accept voluntary undertakings that bar further proceedings on the same matter, and direct mediation where a complaint seems resolvable that way. The Board’s officers are deemed public servants, its premises-access powers are carefully limited so as not to disrupt a person’s day-to-day functioning, and it may requisition police assistance.

The staffing position is the awkward coda. The provisions establishing the Board took effect with the first tranche in November 2025, and the recruitment machinery moved in 2026: nominations for the Chairperson and Member posts were solicited through May and June 2026 by Search-cum-Selection Committees, the chairmanship committee chaired by the Cabinet Secretary. Reporting in August 2026 recorded that no Chairperson or Members had yet been appointed. The statute does not make the substantive obligations contingent on the Board being staffed; the calendar runs regardless. The result is a regulator that exists in law, with its constitution, procedure and terms of service in force, but that had not, at the time of that reporting, begun to function as an adjudicatory body.

The appointment design under the Rules deserves the same scrutiny as the statute’s text, because it is where the independence question is actually decided. The Rules constitute Search-cum-Selection Committees: for the Chairperson, a committee chaired by the Cabinet Secretary with the Secretaries of Legal Affairs and of the electronics and information technology ministry and two outside experts; for the Members, a committee chaired by the electronics ministry’s Secretary with the Legal Affairs Secretary and two experts. The committees recommend; the Central Government appoints. Every element of that sentence is a choice. There is no judicial member on either committee, no parliamentary role, and no security of tenure beyond the two-year renewable term the Act itself sets, and a member who hopes for reappointment serves at the pleasure of the executive whose instrumentalities the Board may have to penalise. The counter-design is also visible in the text: the Act prescribes professional qualifications rather than leaving appointment wholly open, requires at least one legal expert, protects salary and service terms against disadvantageous variation after appointment, and requires a hearing before removal. Independence in Indian institutional design is usually a matter of these accumulations rather than of any single guarantee, and the petitioners’ argument, examined later in this article, is that the accumulation here points the wrong way.

Penalties, appeals, and the road past the Board

Section 33 lets the Board impose monetary penalties where it determines, on conclusion of an inquiry, that a breach of the Act or the rules is significant, after giving the person an opportunity of being heard. The Schedule sets the maxima: up to two hundred and fifty crore rupees for failure to take reasonable security safeguards; up to two hundred crore rupees for failure to notify the Board and the affected principals of a breach; up to two hundred crore rupees for breach of the children’s obligations; up to one hundred and fifty crore rupees for breach of the significant-fiduciary duties; up to ten thousand rupees for breach of a data principal’s duties; and up to fifty crore rupees for breach of any other provision. The Board must have regard to the nature, gravity and duration of the breach, the type of data affected, its repetitiveness, any gain realised or loss avoided, mitigation efforts and their timeliness, proportionality and deterrence, and the likely impact of the penalty on the person. The Central Government may amend the Schedule by notification, but no amendment may raise a penalty beyond twice its original figure.

The appeal route runs to the Telecom Disputes Settlement and Appellate Tribunal, designated as the Appellate Tribunal for this Act. An aggrieved person must appeal within sixty days of receiving the Board’s order, in the prescribed form and on payment of the prescribed fee, with condonation available for sufficient cause; the Tribunal hears the parties and may confirm, modify or set aside the order, endeavouring to dispose of the appeal within six months and recording reasons in writing if it does not. Appeals from the Tribunal’s orders lie under section 18 of the telecom tribunal’s parent statute, which is the route to the Supreme Court. The Board’s orders are executable as decrees of a civil court, and no civil court has jurisdiction over matters the Board is empowered to decide, with no injunction available against action taken under the Act.

The section 33 factors repay attention because they are the Board’s sentencing guidelines in embryo, and businesses should expect the Board’s early penalty orders to build a tariff out of them. Gravity and duration reward the fiduciary that finds its own breach quickly; the type of data affected loads health, financial and children’s data more heavily than contact details; repetitiveness is the factor that converts a first accident into an expensive pattern; gain realised or loss avoided lets the Board disgorge the economics of under-investment in security, so that a firm which saved money by skimping cannot keep the saving; mitigation and its timeliness reward rehearsed incident response in hard currency. The proportionality and likely-impact factors pull the other way, protecting the small firm from annihilation by a ceiling set for giants. The interplay of the two sets is the penalty jurisprudence this Act will develop, and it will be developed in reasoned orders of a digital regulator rather than in courtrooms, which places a premium on those orders being published and consistent.

Two further powers complete the enforcement picture. Section 36 lets the Central Government call for information from the Board, any fiduciary or any intermediary for the purposes of the Act. Section 37 lets the Central Government, on a written reference from the Board intimating that monetary penalty has been imposed on a fiduciary in two or more instances and advising blocking in the public interest, and after giving the fiduciary an opportunity of being heard, direct an agency or intermediary to block public access to the information that enables the fiduciary’s offering of goods or services in India. Blocking is the statute’s ultimate sanction, and it is deliberately hedged: two prior penalties, a Board reference, a hearing, recorded reasons, and the public interest.

A worked illustration shows how the Schedule is meant to bite, and its limits. Take a mid-sized platform that suffers a breach exposing the personal data of several lakh customers, where the Board finds the security safeguards fell short of reasonableness and the intimation to affected principals was late. Two Schedule rows are engaged at once: up to two hundred and fifty crore rupees for the safeguards failure and up to two hundred crore for the notification failure, and the Board’s section 33 inquiry then discounts or loads those ceilings by the statutory factors, the gravity and duration of the breach, the type of data exposed, whether the platform gained or saved money by under-investing in safeguards, how it behaved once the breach surfaced, and what a penalty of a given size does to a business of its scale. The result is a penalty that can plausibly exceed a year’s profit for a mid-sized firm while remaining a rounding error for a global platform, which is why the per-breach ceiling, rather than a turnover-based formula of the European kind, is a real design limitation: the same Schedule must discipline both, and a fixed ceiling that deters the small firm may merely price the large one.

How is the section 37 blocking power different from a monetary penalty?

A penalty punishes a past breach and prices future compliance; blocking removes the business from the market altogether. The two sanctions operate on different theories and carry different safeguards, and the statute treats blocking as the graver step, surrounding it with conditions that do not attach to fines.

Penalties are imposed by the Board after inquiry, calibrated to the breach, and appealable to the tribunal. Blocking is imposed by the Central Government on the Board’s reference, only after penalties have been imposed in two or more instances, only after a hearing, and only where the government is satisfied it is necessary or expedient in the public interest. The penalty says the fiduciary did wrong; the blocking order says the fiduciary, having been penalised repeatedly, may no longer reach the Indian public. It is the one provision in the Act where enforcement shades into prior restraint on a business’s presence, and the hedging around it, reference, repetition, hearing, recorded reasons, is the statute’s acknowledgment of how serious a step it is.

The small print: sections 34 to 43

The miscellaneous chapter is where statutes hide their temperament, and this one is no exception. Section 34 sends every rupee of penalty to the Consolidated Fund of India, a fiscal detail with doctrinal weight: the Board is not funded by its fines, and no part of a penalty compensates anyone, which closes the compensation question at the level of public finance as well as private right. Section 35 protects action taken in good faith by the government, the Board and its people. Section 36 is the information power: the Central Government may require the Board, any fiduciary or any intermediary to furnish such information as it may call for, for the purposes of the Act. The purposes of the Act are wide, the class of persons is wider, and the provision carries no built-in hearing, warrant or notification to the principal whose data may be furnished, which is why the Reporters Collective petition targets it as an engine of unaccountable state access. The provision’s defenders would locate it among the standard information-gathering powers of framework statutes, and the constitutional question, whether a power so framed satisfies the privacy judgment’s requirement of safeguards proportionate to the intrusion, is squarely before the Court.

Section 39 bars the jurisdiction of civil courts over any matter the Board is empowered to decide and forbids injunctions against action taken under the Act. Ouster clauses of this kind are read narrowly by Indian courts, and constitutional remedies under Articles 32 and 226 are beyond their reach, but within the ordinary civil system the bar is complete: the Board and the Tribunal are the only road. Section 40 concentrates the subordinate-legislation power in the Central Government across a long enumerated list, from the manner of notice to the techno-legal measures of the Board’s digital office, which is the textual basis for calling this a framework Act: a striking fraction of its operative content, response periods, retention periods, exemption classes, even the Board’s procedure, is delegated. Section 41 answers with the laying requirement for rules and for notifications under sections 16 and 42. Section 43 gives the difficulty-removal power a three-year life from commencement, which, on a commencement that begins in November 2025, makes the power a feature of the regime’s infancy rather than a standing amendment route.

The blocking power should be distinguished from its better-known cousin in the technology statute, because the two are routinely conflated. Section 69A of the Information Technology Act empowers the government to block public access to information on grounds centred on sovereignty, defence, security and public order, through a committee process with its own rules; it is a content-and-security power directed at information as such. Section 37 of this Act is different in trigger, in theory and in target: it is set in motion by the Board after repeated monetary penalties, it is directed at the information that enables a particular fiduciary to offer goods or services, and its ground is the public interest in stopping a repeat offender from reaching the market. One power polices information in the interest of the State; the other polices market access in the interest of data principals. The distinction matters for any business assessing its exposure, because a platform can be entirely compliant with content law and still accumulate the penalty record that makes a section 37 reference possible.

What the Act changes in other statutes

Section 44 makes three consequential amendments, and their commencement positions differ, which is why they are so often misstated. Sub-section (1) amends section 14 of the Telecom Regulatory Authority of India Act, 1997 to add the Appellate Tribunal under this Act to the list of tribunals whose orders follow the statutory appeal route; it took effect with the first tranche in November 2025. Sub-section (2) amends the Information Technology Act, 2000 in three ways: it omits Section 43A, the compensation provision; it inserts a reference to this Act in the proviso to section 81, which gives the technology statute’s provisions overriding effect subject to stated exceptions; and it omits clause (ob) of section 87(2), the very rule-making power under which the 2011 security-practices rules were made. That sub-section takes effect only with the final tranche on 13 May 2027, which means Section 43A and the 2011 rules survive until then, and the compensation route they provide remains available in the interim. Sub-section (3) substitutes clause (j) of section 8(1) of the Right to Information Act, 2005, replacing the personal-information exemption’s public-interest balancing language with a shorter formula; it took effect in November 2025. The history of that substitution, and its effect on disclosure practice, belongs to the legislative history of data protection law in India, which owns the amendment’s full story. The transparency practice under the Right to Information Act itself, and how the exemption jurisprudence developed before the substitution, is traced in the guide to the Right to Information Act.

A complaint’s journey: how enforcement is supposed to work

The enforcement machinery is best understood by walking a single grievance through it, because the statute’s design choices only become visible in sequence. A customer of an online marketplace learns that her name, address, phone number and order history have surfaced in a leaked database being traded in messaging groups. Her first statutory door is not the Board: section 13 requires her to take the grievance to the fiduciary first, through the readily available redressal means the fiduciary must provide, and the fiduciary must respond within the period the Rules prescribe, which the Rules cap at ninety days. The fiduciary’s answer, or its silence, is the ticket to the next door. If the answer is inadequate, she may complain to the Board, digitally, and the Board then performs its gatekeeping function under section 28: it decides whether sufficient grounds exist to proceed, closes the proceeding with recorded reasons if they do not, and inquires if they do. Separately, the breach itself should already have reached the Board by the other route, the fiduciary’s own intimation duty under section 8(6), and the Board may on that intimation direct urgent remedial or mitigation measures before any inquiry concludes.

Before the journey begins, the Board performs a triage that will define its relationship with complainants. Section 28(3) requires it to determine whether sufficient grounds exist to proceed, and section 28(4) lets it close proceedings with recorded reasons where they do not; section 28(12) adds the sharper edge that a complaint found false or frivolous can attract a warning or costs against the complainant. Read together with the principal’s statutory duty not to register false or frivolous complaints, the design gives the Board a firm hand against abusive filings, and it also means the first decision in every case, grounds or no grounds, is a decision about the complainant as well as the complaint. How the Board writes those early closure orders, and whether it publishes them, will determine whether triage reads as case management or as deterrence of the hesitant, which is precisely the criticism the duties provision attracts in the petitions.

Inside the inquiry, the Board works like a court for evidence and like a regulator for outcomes. It summons and enforces attendance, examines on oath, receives affidavit evidence, and inspects data, books and documents, while being barred from preventing access to premises or seizing equipment in a way that disrupts day-to-day functioning. It follows the principles of natural justice and records reasons. It may issue interim orders where the situation requires them. At the inquiry’s end it has three exits short of penalty: closure, a direction to secure compliance, or acceptance of a voluntary undertaking from the fiduciary, which can include commitments to act or refrain from acting within set timelines and even to publicise the undertaking. If the fiduciary breaks the undertaking, the breach is treated as a breach of the Act itself and the penalty route reopens. Where the Board thinks the complaint can be resolved by mediation, it may direct the parties to attempt it. Only where the Board determines that a breach is significant does section 33 engage, and the penalty is then set within the Schedule’s ceilings by reference to the statutory factors.

From the fiduciary’s side of the same journey, the inquiry has a distinctive texture that businesses should anticipate. The Board’s questions will be answered out of records or not at all: the consent trail for the affected data, the notice version in force when it was collected, the processor contracts governing the systems involved, the access logs showing who touched the data and when, the incident timeline from detection to intimation. An inquiry is therefore lost or won in the document room long before it reaches any hearing, and the fiduciary that maintained its records as a by-product of ordinary operations will experience the process as production, while the fiduciary that must reconstruct its past under deadline will experience it as excavation. The voluntary-undertaking route gives the well-prepared fiduciary a strategic option worth understanding early: an undertaking accepted by the Board bars proceedings on its contents, so a fiduciary that discovers its own breach, reports it, remediates, and offers a credible undertaking has a path to closure that a fiduciary dragged to inquiry does not. The design rewards self-reporting in structure, whatever the first penalty orders eventually say in figures.

The journey exposes the design’s two pressure points. The first is time: the fiduciary’s response window, the Board’s grounds determination, and the inquiry itself each consume months, and a principal whose data is circulating needs mitigation in days; the urgent-directions power on breach intimation is the statute’s answer, but it depends on the fiduciary intimating promptly, which is the very conduct in doubt in the worst cases. The second is asymmetry of information: the Board’s civil-court inspection powers exist precisely because the evidence of what a fiduciary did with data sits inside the fiduciary’s own systems, and the inquiry succeeds or fails on the quality of logs, access records and consent trails the fiduciary kept. Enforcement under this Act is therefore an audit discipline before it is a litigation discipline, and the businesses that will fare best in it are the ones that treated record-keeping as a compliance function from the start.

The Act beside other law

Section 38 states the Act’s relationship to the rest of the statute book in two movements: the Act’s provisions are in addition to, and not in derogation of, other laws, and where a provision of the Act conflicts with a provision of another law, the Act prevails to the extent of the conflict. The first movement preserves the sectoral regimes, the banking regulator’s data directions, the securities regulator’s cybersecurity frameworks, the health records rules as they develop, and the first movement is why a hospital, a bank and a gaming company can each owe duties under this Act and under a sectoral code simultaneously. The second movement is the supremacy clause the sectoral codes will be tested against, and its practical meaning will be worked out case by case, because Indian courts generally prefer reading statutes harmoniously to declaring conflict. A reader of this article should take the provision structurally: the Act is designed as a floor with a trump card, not as a replacement code.

The coexistence with the technology statute’s intermediary framework needs one clarification, because platforms habitually conflate two different liabilities. The safe harbour that the technology statute gives an intermediary against liability for third-party content is a shield about content; it says nothing about the platform’s own conduct as a fiduciary of the personal data it collects for its own purposes, and a platform can hold the safe harbour intact while breaching every duty in Chapter II of this Act. The amendment of the section 81 proviso, inserting this Act into the list of statutes that stand outside the technology Act’s overriding effect, is the textual signal that Parliament intended the two regimes to run in parallel, each in its own lane: content liability there, data governance here. Due-diligence obligations under the intermediary rules, grievance officers and response clocks included, likewise continue in their lane, and a platform’s compliance map that merges the two regimes into a single privacy workstream will mislead it about both.

The comparison that every business reader will make is with the European General Data Protection Regulation, and the honest version of it cuts in both directions. The Indian Act is narrower in its rights: no portability, no general objection right, no compensation right, and an access right tied to consent-based processing. It is broader in one respect that matters operationally: breach notification has no harm threshold and runs to every affected principal, where the European regime keys individual notification to high risk. Its sanctions are fixed ceilings in rupees rather than a percentage of worldwide turnover, which makes them predictable and, for the largest platforms, comparatively light. Its transfer model is a blacklist rather than an adequacy system. Its regulator is a government-appointed digital board rather than a network of independent supervisory authorities. And it imposes duties on the data subject herself, which the European instrument does not. The pattern across all six differences is consistent: this is a statute designed for administrative enforceability in a state with limited regulatory bandwidth, trading individual remedial richness for machinery a single digital office can run. Whether that trade is wisdom or capitulation is the argument the next decade of litigation will have.

One more asymmetry inside the rights chapter itself deserves emphasis, because it inverts what many readers assume. The access and correction rights are framed around processing for which the principal previously gave consent, expressly including the voluntary-provision limb of section 7. Processing under the State-function, security and sovereignty limbs of section 7 is not consent-based, and the principal’s statutory window into it is correspondingly narrower, quite apart from the section 17 exemptions that may remove the Act altogether for notified instrumentalities. The practical result is a two-zone statute: in the commercial zone, the principal’s rights are real and will be routinely exercised; in the State zone, the rights thin out at exactly the point where the data volumes are largest and the power imbalance greatest. Defenders of the design answer that state processing is governed by the authorising statutes, by constitutional review, and by the proportionality standard itself; critics answer that a right which stops at the boundary of the most powerful processor is a right with its centre missing. The challenges before the Supreme Court put that exchange at the heart of the case.

What the Act does not contain

A pillar article should inventory the absences, because readers arrive with expectations imported from other regimes and from the Act’s own publicity. There is no registration of data fiduciaries: unlike the consent-manager class, ordinary fiduciaries do not register, license or notify their existence to the Board, which learns of them through complaints, references and breach intimations. There is no general data protection officer requirement: only significant data fiduciaries must appoint one, and ordinary fiduciaries need only publish the contact details of a person who can answer questions. There are no criminal offences in the Act: the sanction structure is monetary and administrative, supplemented by directions and the blocking power, and conduct that other statutes punish, such as dishonest receipt of stolen data resources under the technology statute, remains punishable there rather than here. There is no collective or representative complaint mechanism for groups of affected principals, no provision for the Board to order restitution, and no private right of action created by the statute itself. There is no prior authorisation regime for high-risk processing: the impact-assessment duty for significant fiduciaries is periodic and self-administered, not a licence sought in advance. And there is no general data localisation: outside the sectoral rules preserved by section 16(2), data may be held anywhere until a restriction notification says otherwise. Each absence is a deliberate simplification, and together they explain both the Act’s administrative lightness and its remedial thinness.

The compliance calendar in practice

For the business reader, the staged commencement converts into a work programme with a shape worth stating, because the eighteen months between the Rules and the final tranche are the only preparation window the statute will ever offer. The foundation is an inventory: a record of what personal data the business holds, where it came from, for what purpose, on what basis, who it is shared with, and how long it is kept, since the notice duty, the access right and the erasure duty all presuppose answers the business cannot improvise. The second layer is the consent estate: notices rewritten to the section 5 standard in the languages the business’s customers actually use, consent flows rebuilt so that the affirmative action is clear and the unnecessary items are unbundled, withdrawal made as easy as grant, and the retrospective notices prepared for the legacy base. The third layer is the machinery: processor contracts re-papered as compliance documents, the grievance desk built and timed, the incident-response plan written and rehearsed against the without-delay and seventy-two-hour clocks, retention schedules set dataset by dataset so the erasure duty can be executed rather than admired. The fourth layer is the population at special risk: children’s data audited for verifiable consent and for tracking and advertising exposure, and, for businesses likely to be designated significant data fiduciaries, the officer appointed, the auditor engaged and the first impact assessment run as a rehearsal rather than a premiere.

The sequencing matters because each layer feeds the one after it, and because the date that disciplines the whole programme is not May 2027 but the internal dates by which systems must be ready to be tested. Businesses that ran this programme early against the draft rules published for consultation in January 2025 discovered that the final Rules changed detail without changing architecture, which is the strongest practical argument for beginning on architecture rather than waiting for every subordinate instrument to settle. The opposite failure is also common: treating the gap before commencement as a holiday. The gap is the compliance period the statute allows exactly once, and the fiduciary that arrives in May 2027 with unmapped data, unrewritten notices and an unrehearsed breach plan will be in breach of duties that are, by then, immediately enforceable, with a regulator whose first penalties will set the market’s expectations.

The honest assessment

The criticisms of the Act should be stated in their proponents’ terms, at full strength. The State exemption is the principal one: section 17(2)(a) permits the Central Government to exempt its own instrumentalities from the entire statute by notification on grounds as broad as public order and the prevention of incitement to cognisable offences relating to the listed interests, and the petitioners who have challenged it argue that a data protection law from which the State can exempt itself is a law that protects the citizen against everyone except the most powerful processor of her data. The Board’s independence is the second: the Chairperson and Members are appointed by the Central Government, hold office for two years renewable, and function within a digital-office design whose procedures the government prescribes, and the petitioners argue that a regulator so constituted cannot be the independent authority the privacy judgment’s proportionality standard presupposes. The absence of compensation is the third: a person whose data is breached has no claim against the fiduciary under this statute, and the petitioners point out that the omission of Section 43A removes the one compensation route that existed. The duties on data principals are the fourth: a penalty for a false or frivolous complaint, however small, is said to deter the very complaints the regime needs. The transfer provision is the fifth: permitting transfer everywhere except to notified countries reverses the protective default and leaves the protection to a notification that may never come. And the absence of any journalistic exemption is the sixth: reporters who process personal data in the public interest face the same duties as any fiduciary, a position the journalist petitioners say chills reporting.

The defence should be stated fairly, and it is not weightless. A regime of this width imposed overnight on an economy with very uneven compliance capacity would produce widespread formal non-compliance and little actual protection; the staged commencement, whatever its political conveniences, is operationally defensible, and other jurisdictions have phased their own regimes. The consent and notice obligations genuinely require system changes that cannot be made in weeks, particularly the language requirement and the withdrawal-parity rule. The exemption for State instrumentalities is bounded by the listed interests and enacted by notification, which keeps it visible and challengeable, unlike a blanket exclusion buried in a definition. The Board’s design as a digital office with civil-court powers, fixed qualifications and a hearing requirement before removal is a real attempt at a modern regulator, and section 28(1)’s declaration that it shall function as an independent body is not nothing. Penalties calibrated to the breach and credited to the Consolidated Fund are a coherent deterrence design even if they leave the victim uncompensated. This article adjudicates none of these disputes; the courts will, and the petitions are already before them.

Two quieter features deserve a word in the assessment because they will shape the regime’s texture. The startup and small-fiduciary relief in section 17(3) is the statute’s acknowledgement that a single compliance template cannot fit both a global platform and a fifty-person software firm, and its volume-and-nature test is the right idea; the risk is that relief granted by notification, class by class, produces a patchwork in which the citizen cannot tell whether the business holding her data owes her the full set of rights or a reduced one. The consent-manager institution cuts the other way: it is the Act’s one genuine structural innovation, an attempt to move consent from a click extracted by the data-seeker to a dashboard held by an agent of the data-giver, and if the registration framework nurtures it, India will have built something no other major regime has. The assessment that balances the Act is therefore not a midpoint between the petitioners and the government. It is that the statute’s machinery is more imaginative than its safeguards, and both halves of that sentence will be tested in the same litigation.

The litigation position, confirmed against reporting from LiveLaw and other legal press, is this: writ petitions filed in 2026 challenge provisions of the Act and the Rules before the Supreme Court, and the provisions under challenge map closely onto the criticisms set out above. The petitions variously assail the exemption for State instrumentalities in section 17(2)(a), the offence-investigation limb of section 17(1)(c), the Board’s composition and appointment provisions in sections 19 and 24, the penalty provision in section 33(1), the Central Government’s power to call for information in section 36, the legitimate-uses gateway in section 7, the omission of Section 43A effected by section 44(2)(a), and the Right to Information substitution in section 44(3), together with Rules on consent, on the Board’s constitution, and on the furnishing of information to the government. Venkatesh Nayak’s petition takes aim at the Right to Information amendment and related provisions; the Reporters Collective and the journalist Nitin Sethi challenge the information power and the absence of journalistic safeguards; the National Campaign for People’s Right to Information raises cognate challenges to the amendment’s effect on the transparency regime; and the journalist Geeta Seshu, with the Software Freedom Law Center, mounts the broader challenge, arguing the framework weakens the protections recognised in the privacy judgment, departs from the committee report that preceded it, and facilitates disproportionate state surveillance without adequate safeguards. Further petitions have been tagged with the lead matter. The Court has issued notice, and while hearing the petitions the Chief Justice orally observed that there were some creases which required to be ironed out; the pleas concerning the Right to Information amendment have been referred to a larger bench. No final determination has been made, and this article describes the dispute structurally rather than predicting its outcome.

The timeline itself has become a contested question, and the argument should be recorded in both directions before the claim of this article is stated. The consultation on compressing the eighteen-month tranche to twelve months, reported in January 2026, drew the predictable division: industry bodies that had begun preparation against the draft rules argued the longer runway was being consumed by businesses that had not started, and that a shorter deadline would concentrate effort; civil-society critics argued the opposite direction, that the delay had already consumed the statute’s moral momentum and that any date beyond 2027 rewarded inertia. A third position, heard from practitioners rather than from either camp, is that the binding constraint is not industry readiness but the regulator’s: an earlier start date with an unstaffed Board would produce duties without adjudication, which is worse than duties deferred, because it teaches the market that obligations are unenforced. The published dates stand unrevised in the Gazette, and the debate matters chiefly as evidence of how commencement calendars become political instruments in their own right, argued over long after the statute they govern has been enacted.

The namable claim of this article is the one stated at its opening: a data protection law that protects nobody yet. The Act was enacted in August 2023, its rules were notified in November 2025, and its core obligations on notice, consent, security, breach notification and erasure do not bind any data fiduciary until 13 May 2027, so that for the whole period in which India has been described as having a data protection law, the operative regime has remained the security-practices rules made in 2011 under a compensation provision of the technology statute. This is the eighth commencement finding in the series and one of the largest gaps: a statute presented as India’s answer to a fundamental right recognised in 2017 will impose its first substantive obligation a decade later.

What stops the Central Government from doubling the penalties again and again?

Section 42 lets the Central Government amend the Schedule by notification, which looks like a blank cheque to raise penalties without returning to Parliament. The cheque is not blank: no notification may raise any penalty beyond twice the figure enacted in the original Schedule.

The two-hundred-and-fifty-crore ceiling for security-safeguard breaches can therefore at most become five hundred crore by executive action; beyond that, only Parliament can raise it. Every amendment takes effect as if enacted in the Act and comes into force on the notification date, and the laying requirement means Parliament gets its thirty-day window to modify or annul. The cap is a small but real piece of legislative self-restraint, and it is the answer to the reader who fears penalty inflation by notification.

The Act in one argument

The statute’s design can be stated as a single connected argument, and a reader who holds it can predict how most disputes under the Act will be framed. Processing is legitimate only through consent or a listed use; consent is valid only when it is informed, specific and revocable on equal terms; the fiduciary, not the processor and not the principal, carries the duties, and the heaviest of them, security, accuracy, notification and erasure, are standards of conduct rather than checklists; enforcement is administrative, digital and deterrent, run by a government-appointed Board with court-like investigatory powers and no damages to award; the State reserves to itself a wide, notified exemption and a conditional blocking power; and the whole machine is set running on a notified calendar that puts the duties last. Every contested question in the Act is a stress placed on one of those six propositions: the scraping dispute stresses the coverage definitions, the exemption litigation stresses the fifth proposition against the privacy judgment, the compensation debate stresses the fourth, and the compliance industry’s entire workload flows from the second and third. A statute whose argument is this legible is easier to criticise than a muddled one, and also easier to operate, defend and amend, which may be the most that can be asked of a first data protection law for a country of India’s scale.

A final structural observation explains why this statute will keep changing without returning to Parliament. Between the rule-making power in section 40, the exemption and designation notifications, the Schedule-amendment power in section 42, and the laying procedure that gives Parliament a revising window over the most sensitive instruments, the Act is built to evolve through subordinate legislation. Its centre of gravity sits in the Gazette as much as in the statute book: the response periods, retention periods, exemption classes, designation lists and even penalty levels of the working regime will be found in notifications and rules layered over a forty-four-section frame. For the researcher, that means the article of record is a snapshot of a moving structure, and the discipline this pillar has followed, stating commencement positions by their notification dates and mechanisms by their sections, is the only durable way to write about it. For the citizen, it means the statute’s real content will be decided in instruments most citizens never read, which is a reason for the Board’s orders and the government’s notifications to be public, reasoned and archived with the same care as the Act itself.

The closing verdict

The Digital Personal Data Protection Act is best understood as two statutes in one: a framework Act, largely in force, that creates a regulator, defines its vocabulary, and rearranges the appeal routes; and an obligations Act, largely dormant, whose duties on consent, notice, security, breach notification, erasure and children’s data will begin to bind on 13 May 2027. Read as a framework, it is a competent piece of institutional design with real weaknesses in the independence of its regulator and the breadth of its State exemption. Read as an obligations regime, it is ambitious, detailed, and in places operationally heroic, particularly on verifiable parental consent and breach notification without a materiality threshold. The gap between the two readings is the article’s subject, and it is also the series’ standing warning about staged commencement as a mode of legislation: the statute books can show a right long before the citizen can use it.

Four developments will tell a future reader whether this statute became a working regime or a framework that waited too long. The first is the staffing of the Board, because every other mechanism depends on it and the recruitment record of 2026 showed the institution lagging its own calendar. The second is the first significant-fiduciary notification, which will reveal whether the government intends the two-tier regime to be a real discipline on the largest platforms or a power kept in reserve. The third is the constitutional litigation, in which the exemption architecture and the Right to Information substitution will be measured against the proportionality standard with a full record. The fourth is the approach of May 2027 itself: whether fiduciaries arrive ready, whether the Board’s first enforcement choices are measured or theatrical, and whether the timeline survives unshortened and unextended. A pillar written before those answers exist should name the questions plainly, which is what this closing section is for.

The cluster’s specialist articles carry the parts this pillar has compressed. The legislative history owns the decade-long road from the committee report through the withdrawn bills to the enacted text, and the full story of the Right to Information amendment. The account of the privacy judgment owns the proportionality standard against which the exemptions will be tested. The technology-law guide holds this Act within the larger field of instruments that govern India’s digital economy. The reader who wants the statute’s text should consult the Gazette; the reader who wants to understand what the text will do, and when, has the map in the sections above.

Frequently Asked Questions

Q: What does the Digital Personal Data Protection Act cover?

The Act applies to the processing of digital personal data within India, whether the data was collected in digital form or was collected in non-digital form and digitised afterwards, and to processing outside India connected with offering goods or services to data principals in India. Processing is defined broadly to include collection, storage, use, sharing, erasure and destruction of digital personal data. The Act does not apply to personal data processed by an individual for personal or domestic purposes, nor to personal data made publicly available by the data principal or under a legal obligation to publish. Data that has been genuinely anonymised, so it no longer relates to an identifiable individual, falls outside the definition of personal data. There is no threshold of business size or data sensitivity for the core duties to apply; every data fiduciary is covered, with targeted relief available only through the exemption power.

Q: What are the lawful grounds for processing personal data?

A person may process personal data only in accordance with the Act and for a lawful purpose, meaning a purpose not expressly forbidden by law, on one of two bases. The first is consent: free, specific, informed, unconditional and unambiguous consent signified by clear affirmative action for a specified purpose, limited to the data necessary for that purpose. The second is certain legitimate uses under section 7, which include processing of voluntarily provided data for the specified purpose, State provision of subsidies, benefits, services, certificates, licences or permits, performance of a State function under law or in the interest of sovereignty and security, compliance with legal disclosure obligations or court orders, medical emergencies, epidemics and public health measures, disasters and breakdowns of public order, and employment purposes such as safeguarding against loss or protecting trade secrets. Consent and legitimate use are the only two doors; processing through neither is unlawful.

Q: What rights does a data principal have?

The Act gives a data principal four rights. The right to access information lets a principal who previously gave consent obtain a summary of the personal data being processed and the processing activities, the identities of other fiduciaries and processors with whom the data was shared with a description of what was shared, and other prescribed information, except where sharing was with a law-enforcement-authorised fiduciary for offence prevention, detection, investigation or prosecution. The right to correction and erasure covers correction of inaccurate or misleading data, completion, updating, and erasure unless retention is necessary for the specified purpose or for compliance with law. The right of grievance redressal requires fiduciaries and consent managers to provide readily available redressal means and respond within the prescribed period, with exhaustion required before approaching the Board. The right to nominate lets the principal designate someone to exercise her rights on death or incapacity.

Q: What obligations fall on a data fiduciary?

A data fiduciary is responsible for compliance with the Act and the rules for all processing it undertakes or commissions from a processor, regardless of any contrary agreement and regardless of whether the principal performed her own duties. It may engage a processor only under a valid contract. Where data is likely to be used for a decision affecting the principal or disclosed to another fiduciary, it must ensure completeness, accuracy and consistency. It must take reasonable security safeguards to prevent personal data breach, and on breach intimate the Board and each affected principal without delay, with a detailed Board report within seventy-two hours under the Rules. It must erase data on consent withdrawal or when the purpose is no longer served, unless retention is legally required, publish contact details of a data protection officer or an answerable person, and maintain an effective grievance-redressal mechanism. These duties bind from 13 May 2027.

Q: How does the Act treat children’s data?

A child is defined as an individual below eighteen years of age. Before processing a child’s personal data, or that of a person with disability having a lawful guardian, the fiduciary must obtain verifiable consent of the parent or lawful guardian in the prescribed manner. Processing likely to cause any detrimental effect on a child’s well-being is prohibited, as are tracking, behavioural monitoring and targeted advertising directed at children. The Central Government may exempt classes of fiduciaries or purposes from the parental-consent and no-tracking duties by prescription, and where satisfied that a fiduciary’s processing of children’s data is verifiably safe, may notify an age above which that fiduciary is exempt from all or any of those obligations. Verifiable consent is the most operationally demanding duty in the statute, since the fiduciary must confirm the consenting person is genuinely the parent or guardian and an adult, without the Act specifying the method.

Q: Which data protection exemptions apply to the State?

Section 17(2)(a) provides that the Act does not apply to processing by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to any cognisable offence relating to these, together with the Central Government’s processing of data such an instrumentality furnishes to it. Section 17(4) additionally relieves State processing from the erasure and correction duties where no decision affecting the principal is involved. The State also benefits from the legitimate-uses door in section 7 for subsidies, benefits, services, certificates, licences and permits, and for functions performed under law or in the interest of sovereignty and security. These exemptions are the most criticised part of the statute, and writ petitions before the Supreme Court argue that the notified-instrumentality power cannot survive the proportionality standard of the privacy judgment.

Q: What is the Data Protection Board and who appoints it?

The Data Protection Board of India is established under section 18 as a body corporate with perpetual succession, intended to function as far as practicable as a digital office. It consists of a Chairperson and such number of other Members as the Central Government notifies, all appointed by the Central Government in the prescribed manner from persons of ability, integrity and standing with expertise in data governance, law, technology, regulation and related fields, with at least one member an expert in law. The term of office is two years, renewable, and removal requires an opportunity of being heard. The Board inquires into breaches on intimation, complaint, government reference or court direction, following natural justice with the powers of a civil court, and may issue directions, accept voluntary undertakings, direct mediation, and impose the monetary penalties specified in the Schedule. Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal. The Board’s establishing provisions are in force, though reporting in August 2026 recorded that no Chairperson or Members had yet been appointed.

Q: When do the data protection obligations actually take effect?

The obligations take effect in three tranches under the commencement notification of 13 November 2025. The first tranche, effective on notification, brought into force the definitions, the Board’s establishment and machinery provisions, and the amendments to the telecom tribunal statute and the Right to Information Act. The second tranche, on 13 November 2026, brings the consent-manager registration requirement and the Board’s power to inquire into breaches of registration conditions. The third and final tranche, on 13 May 2027, brings everything else: the applicability provisions, consent and notice, the fiduciary obligations including security safeguards and breach notification, the children’s provisions, significant-fiduciary duties, data principal rights, transfers, exemptions, the Board’s inquiry and penalty powers, and the omission of Section 43A of the Information Technology Act. A proposal to compress the timeline was consulted on in January 2026 but no altering notification has appeared in the material relied on.

Q: What must a notice under the Digital Personal Data Protection Act contain?

Every request for consent must be accompanied or preceded by a notice from the data fiduciary stating three things: the personal data and the purpose for which it is proposed to be processed, the manner in which the data principal may exercise her rights, and the manner in which she may complain to the Board. The notice must be in clear and plain language, and the principal must be able to access it in English or any Eighth Schedule language. Where consent was given before the Act’s commencement, the fiduciary must give a retrospective notice with the same contents as soon as reasonably practicable and may continue processing until withdrawal. The notice is the instrument that makes consent informed in the statute’s design: a consent taken without the three disclosures is not a valid consent, and in any proceeding the fiduciary bears the burden of proving that notice was given and consent obtained in accordance with the Act and the rules.

Q: Can a data principal withdraw consent, and what must happen then?

Yes. A data principal may withdraw consent at any time, and the ease of withdrawal must be comparable to the ease with which consent was given, so a one-tap signup cannot be undone only through a cumbersome offline process. On withdrawal, the fiduciary must within a reasonable time cease processing the principal’s data and cause its processors to do the same, unless continued processing is required or authorised under the Act, the rules, or another Indian law. Withdrawal does not affect the legality of processing done before it, and its consequences, such as losing access to a service that depended on the data, are borne by the principal. A consent manager, once the registration framework commences, offers an additional channel for withdrawal. The withdrawal right is one of the duties that binds from 13 May 2027, and fiduciaries will need withdrawal flows built and tested well before that date.

Q: What is a consent manager, and when does consent manager registration begin?

A consent manager is a person registered with the Data Protection Board who acts as a single point of contact enabling a data principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. The manager is accountable to the principal and must act on her behalf as prescribed. Every consent manager must be registered with the Board subject to technical, operational, financial and other prescribed conditions. The registration requirement, in section 6(9), is the one substantive provision that commences in the second tranche on 13 November 2026, together with the Board’s power to inquire into breaches of registration conditions. The design anticipates a market of intermediaries between individuals and data-seeking businesses, but whether such intermediaries emerge at scale will depend on the registration conditions and on whether businesses find self-built consent flows cheaper.

Q: What is a significant data fiduciary, and what extra duties does the designation bring?

The Central Government may notify any fiduciary or class of fiduciaries as a Significant Data Fiduciary after assessing factors including the volume and sensitivity of data processed, risk to data principals’ rights, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. A designated fiduciary must appoint a data protection officer based in India who is responsible to its board of directors and serves as the grievance-redressal contact, appoint an independent data auditor to evaluate compliance, and undertake periodic data protection impact assessments, periodic audits, and other prescribed measures. The impact assessment must describe principals’ rights and processing purposes and assess and manage risks to those rights. Designation is entirely by executive notification, so the two-tier regime exists only as far as the government populates it, and the duties bind designated fiduciaries from 13 May 2027.

Q: Can a data fiduciary transfer personal data outside India?

Yes, by default. Section 16 permits transfer of personal data outside India to any country except one that the Central Government restricts by notification, and nothing in the section limits any other Indian law imposing stricter transfer controls. Until such a notification is issued, transfers may go anywhere. The provision reverses the earlier policy conversation about localisation mandates: the enacted model is a blacklist, empty until filled, rather than a whitelist or an adequacy regime. The operative step is the notification, and the section is built so the government can restrict transfers to a particular jurisdiction without amending the statute. Notifications under this section must be laid before Parliament, which has thirty days in session to modify or annul them. Businesses should therefore plan around the mechanism, a notification can change the position for a destination overnight, rather than around any fixed list.

Q: How large are the penalties the Data Protection Board can impose?

The Schedule sets six maxima. Breach of the duty to take reasonable security safeguards can attract up to two hundred and fifty crore rupees, the heaviest. Failure to notify the Board and affected principals of a breach, and breach of the children’s obligations, each carry up to two hundred crore rupees. Breach of the significant-fiduciary duties carries up to one hundred and fifty crore rupees. Breach of any other provision of the Act or the rules carries up to fifty crore rupees. Breach of a data principal’s own duties carries up to ten thousand rupees. In fixing an amount within the ceiling, the Board must consider the nature, gravity and duration of the breach, the type of data affected, repetitiveness, any gain realised or loss avoided, mitigation efforts and their timeliness, proportionality and deterrence, and the likely impact on the person penalised. Sums realised go to the Consolidated Fund of India, not to affected individuals.

Q: Where does an appeal lie against an order of the Data Protection Board?

An appeal lies to the Telecom Disputes Settlement and Appellate Tribunal, designated as the Appellate Tribunal under the Act. It must be filed within sixty days of receiving the Board’s order or direction, in the prescribed form and manner and on payment of the prescribed fee, though the Tribunal may condone delay for sufficient cause. After hearing the parties, the Tribunal may confirm, modify or set aside the order, and it must endeavour to dispose of the appeal within six months, recording written reasons if it does not. The Tribunal’s orders are executable as decrees of a civil court. A further appeal lies under section 18 of the Telecom Regulatory Authority of India Act, 1997, which is the route to the Supreme Court. No civil court has jurisdiction over matters the Board is empowered to decide, and no injunction may be granted against action taken under the Act.

Q: What duties does the Act impose on data principals themselves?

Section 15 imposes five duties. A data principal must comply with all applicable laws while exercising her rights under the Act, must not impersonate another person when providing personal data for a specified purpose, must not suppress material information when providing data for a document, unique identifier, proof of identity or proof of address issued by the State or its instrumentalities, must not register a false or frivolous grievance or complaint with a fiduciary or the Board, and must furnish only verifiably authentic information when exercising the rights of correction or erasure. Breach attracts a penalty of up to ten thousand rupees, and the Board may separately warn or impose costs on a complainant whose complaint it finds false or frivolous. The duties are unusual in data protection law and are criticised as deterring complaints, while their defenders read them as a good-faith clause necessary for a grievance system operating at India’s scale.

Q: Can a data principal claim compensation under the Act for harm caused by a data breach?

No. The Act creates no right to compensation for the individual harmed by a breach. The monetary penalties the Board imposes are regulatory: they are calibrated to the breach and credited to the Consolidated Fund of India under section 34, not paid to affected principals. This is a deliberate design choice, and it is also one of the most criticised features of the statute, with petitioners before the Supreme Court arguing that a data protection law without a compensation remedy fails the privacy judgment’s promise of an effective remedy. The position is sharpened by the coming omission of Section 43A of the Information Technology Act, which did provide a compensation route for negligence in maintaining reasonable security practices. Until that omission takes effect on 13 May 2027, the Section 43A route remains available; afterwards, an individual harmed by a breach must look outside this statute, to consumer law, contract, or tort, for a damages claim.

Q: When does Section 43A of the Information Technology Act cease to apply?

Section 43A of the Information Technology Act, 2000, the compensation provision for negligence in maintaining reasonable security practices, is omitted by section 44(2) of the 2023 Act. That sub-section takes effect only with the final commencement tranche on 13 May 2027, so Section 43A and the security-practices rules made in 2011 under it remain in force until then. The sequencing is deliberate in effect if not in stated intent: the old compensation-centred regime hands over to the new penalty-centred regime on the same day the new duties begin to bind. The related rule-making power, clause (ob) of section 87(2) of the technology statute, is omitted on the same date, and the proviso to section 81 is amended to name the 2023 Act among the statutes whose provisions prevail. Businesses should treat the interim period as governed entirely by the old regime and plan the handover for May 2027.

Q: In which languages must the notice and the request for consent be available?

Both the notice under section 5 and the request for consent under section 6 must be presented in clear and plain language, and the data principal must be given the option to access each in English or in any language specified in the Eighth Schedule to the Constitution. The Eighth Schedule lists twenty-two languages, so a consent flow that exists only in English does not comply with the statute. The requirement applies equally to the retrospective notices that fiduciaries must give for consent collected before commencement. For businesses operating across states, the provision means consent interfaces, privacy notices and withdrawal flows must be genuinely multilingual, not merely translated on request. It is one of the Act’s most underestimated operational demands, because it turns every consent touchpoint into a localisation exercise, and it binds from 13 May 2027 with the rest of the consent machinery.

Q: Has the Digital Personal Data Protection Act been challenged in the Supreme Court?

Yes. Writ petitions filed in 2026 challenge provisions of the Act and the Rules. Venkatesh Nayak’s petition targets the Right to Information amendment effected by section 44(3) and related provisions; the Reporters Collective and the journalist Nitin Sethi challenge the Central Government’s information power and the absence of journalistic safeguards; the National Campaign for People’s Right to Information raises cognate challenges to the amendment’s impact on the transparency regime; and the journalist Geeta Seshu, with the Software Freedom Law Center, mounts the broader challenge, arguing the framework weakens the protections recognised in the privacy judgment, departs from the committee report that preceded the Act, and enables disproportionate state surveillance. Further petitions have been tagged with the lead matter. The Court has issued notice, and the pleas concerning the Right to Information amendment have been referred to a larger bench. No final determination has been made.