India’s New Digital Privacy Law: The DPDP Act and Rules Explained

India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) together create a new, self-contained regime for how digital personal data is collected, processed and protected in India. The framework is designed to balance two interests: the individual’s right to privacy and the legitimate need of the State and private entities to process data for lawful purposes.

Scope and Key Concepts

The DPDP Act applies to the processing of “digital personal data” within the territory of India, whether such data is collected directly in digital form or is digitised from non-digital form. It also applies extraterritorially where processing outside India is in connection with any activity related to offering goods or services to Data Principals within India (Section 3). At the same time, it carves out clear exclusions: personal or domestic use of data by an individual, and personal data made publicly available by the Data Principal herself or by another person under a legal obligation, fall outside its scope (Section 3(c)).

The Act defines its main actors in Section 2. A “Data Principal” is the individual to whom the personal data relates; in the case of a child, the term includes parents or lawful guardians, and in the case of a person with disability, it includes the lawful guardian acting on her behalf (Section 2(j)). A “Data Fiduciary” is any person who alone or with others determines the purpose and means of processing personal data (Section 2(i)), and a “Data Processor” is any person who processes personal data on behalf of a Data Fiduciary (Section 2(k)). “Personal data” is any data about an individual who is identifiable by or in relation to such data, while “digital personal data” is personal data in digital form (Section 2(t), 2(n)). The Act also establishes the “Data Protection Board of India” (“Board”) as an independent body to enforce the law (Section 18). The DPDP Rules adopt the Act’s definitions and add a few of their own, such as “user account”, “techno‑legal measures” and “verifiable consent” (Rule 2).

Consent, Legitimate Uses and Notice

Processing of personal data is lawful only if it satisfies the substantive conditions in Chapter II. Section 4 provides that a person may process the personal data of a Data Principal only in accordance with the Act and for a lawful purpose, either with the Data Principal’s consent or for certain legitimate uses. “Lawful purpose” is defined broadly as any purpose not expressly forbidden by law (Section 4(2)).

Consent is dealt with in Sections 5 and 6. A request for consent must be preceded or accompanied by a notice from the Data Fiduciary, informing the Data Principal of the personal data and purposes of processing, how she may exercise her rights under Sections 6 and 13, and how she may make a complaint to the Board (Section 5(1)). Where consent has been given before the commencement of the Act, the Data Fiduciary must issue a fresh notice “as soon as reasonably practicable” setting out the same information (Section 5(2)). The Act requires that consent be free, specific, informed, unconditional and unambiguous, indicated by a clear affirmative action, and limited to such personal data as is necessary for the specified purpose (Section 6(1)). Any portion of a consent request that infringes the Act or any other law is invalid to that extent (Section 6(2)). The Act grants the Data Principal a right to withdraw consent at any time, and requires that the ease of withdrawal be comparable to the ease of giving consent (Section 6(4)). Upon withdrawal, the Data Fiduciary and its Data Processors must cease processing unless such processing without consent is required or authorised under another provision of law (Section 6(5)–(6)).

Recognising that consent alone cannot support all processing, Section 7 lists “certain legitimate uses” for which personal data may be processed without consent. These include: where the Data Principal has voluntarily provided personal data for a specified purpose and has not indicated non‑consent; where the State or its instrumentalities process data to provide or issue subsidies, benefits, services, certificates, licences or permits as prescribed; performance of any function by the State or its instrumentalities under law or in the interests of sovereignty and security; disclosure obligations under law; compliance with judgments or decrees; responses to medical emergencies; public health measures; disaster and public order measures; and specific employment‑related purposes such as preventing corporate espionage or maintaining confidentiality of trade secrets (Section 7).

The DPDP Rules flesh out the content and presentation of notices and the mechanics of consent. Rule 3 requires that notices be presented in a way that is understandable on their own, use clear and plain language, give at minimum an itemised description of the personal data and the specified purposes, and include a specific communication link to the Data Fiduciary’s website or app along with a description of other means by which the Data Principal can withdraw consent, exercise her rights and make complaints to the Board.

Obligations of Data Fiduciaries and Processors

Section 8 sets out the general obligations of Data Fiduciaries. It provides that a Data Fiduciary is responsible for complying with the Act and rules for any processing undertaken by it or on its behalf, regardless of any agreement to the contrary or of the Data Principal’s failure to perform her duties (Section 8(1)). A Data Processor may only process personal data on a Data Fiduciary’s behalf under a valid contract and only for activities related to offering goods or services to Data Principals (Section 8(2)). Where personal data is likely to be used to make decisions affecting the Data Principal or to be disclosed to another Data Fiduciary, the processing Data Fiduciary must ensure completeness, accuracy and consistency of the data (Section 8(3)).

Section 8(4) requires implementing appropriate technical and organisational measures to ensure effective observance of the Act and rules. Section 8(5) obliges the Data Fiduciary to protect personal data in its possession or under its control, including in respect of processing by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. In case of a breach, Section 8(6) requires the Data Fiduciary to intimate the Board, and each affected Data Principal in the prescribed form and manner. Section 8(7) mandates erasure of personal data on withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, subject to retention necessary for compliance with law; Section 8(8) deems the specified purpose to be no longer served where the Data Principal has not approached the Data Fiduciary for performance of the purpose and has not exercised her rights for a prescribed period. Section 8(9) requires publication of the business contact information of a Data Protection Officer, where applicable, or another person able to answer questions about the processing of personal data. Section 8(10) requires that the Data Fiduciary establish an effective mechanism to redress grievances of Data Principals.

The DPDP Rules give these obligations practical content. Rule 6 specifies that “reasonable security safeguards” must include, at a minimum, measures such as encrypting or tokenising personal data; implementing access controls on computer resources; maintaining logs and visibility of access to enable detection, investigation and remediation of unauthorised access; ensuring data backups and other measures for continued processing in case of compromise; requiring Data Processors to implement equivalent safeguards via contract; and taking appropriate technical and organisational measures to ensure effective observance of these safeguards. Rule 7 sets out breach‑notification obligations. On becoming aware of a personal data breach, the Data Fiduciary must inform each affected Data Principal, without delay, in clear and plain language via the user account or registered communication channel, and must describe the breach, likely consequences, mitigation measures taken, safety steps the Data Principal can take, and contact details for queries. It must also intimate the Board without delay, and then within 72 hours (or such longer period as the Board may allow) provide detailed information on the nature, extent, timing and location of the breach, facts and reasons leading to it, mitigation measures, findings regarding the person who caused it, remedial measures and a report of notifications to Data Principals.

Rule 8 connects with Sections 8(7) and 8(8). It requires certain classes of Data Fiduciaries processing personal data for purposes specified in the Third Schedule to erase personal data after the corresponding time periods if the Data Principal neither approaches the Data Fiduciary for the specified purpose nor exercises her rights, unless retention is necessary for compliance with law. In addition, all Data Fiduciaries must retain personal data, associated traffic data and other logs of processing for at least one year from the date of processing for purposes listed in the Seventh Schedule, after which they must erase them unless longer retention is required by law or notified by the Government.

Children, Persons with Disabilities and Verifiable Consent

The Act adopts a stricter approach to processing personal data of children and persons with disabilities who have lawful guardians. Section 9(1) requires that, before processing such data, the Data Fiduciary must obtain verifiable consent of the parent of the child or the lawful guardian, in the manner prescribed. Section 9(2) prohibits the processing of personal data likely to cause any detrimental effect on the well-being of a child. Section 9(3) prohibits tracking, behavioural monitoring or targeted advertising directed at children. Section 9(4) and 9(5) allow the Central Government to prescribe exemptions from these obligations for specified classes of Data Fiduciaries or purposes and to notify, in respect of a Data Fiduciary that processes children’s data in a verifiably safe manner, the age above which the obligations under Section 9(1) and (3) will not apply.

The DPDP Rules define “verifiable consent” in this context. Rule 10 states that for processing a child’s personal data, the Data Fiduciary must adopt appropriate technical and organisational measures to ensure that the verifiable consent comes from a parent, and must verify that the person identifying as a parent is an identifiable adult. This can be done by reference to reliable identity and age details already available with the Data Fiduciary, or details (or virtual tokens mapped to such details) voluntarily provided by the parent or through a Digital Locker service provider or other authorised entity. Rule 11 provides that, for persons with disabilities with lawful guardians, the Data Fiduciary must observe due diligence to verify that the guardian is appointed under applicable guardianship law by a court of law, designated authority or local level committee.

Rule 12 and the Fourth Schedule then identify classes of Data Fiduciaries and purposes for which the prohibitions in Section 9(1) and 9(3) do not apply, subject to conditions. This allows, for example, certain educational platforms or child‑centric services to operate under modified obligations where the risk profile and safeguards justify it.

Significant Data Fiduciaries and Enhanced Obligations

Section 10 introduces the concept of “Significant Data Fiduciary”. The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary based on an assessment of factors such as the volume and sensitivity of personal data processed, risk to Data Principal rights, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order (Section 10(1)). Once so notified, a Significant Data Fiduciary must appoint a Data Protection Officer based in India, who represents it under the Act, is responsible to its Board of Directors or similar governing body and is the point of contact for the grievance‑redress mechanism (Section 10(2)(a)). It must also appoint an independent data auditor to evaluate its compliance with the Act (Section 10(2)(b)), and undertake periodic Data Protection Impact Assessments, audits and such other measures as may be prescribed (Section 10(2)(c)).

Rule 13 builds on these obligations by requiring every Significant Data Fiduciary to conduct a Data Protection Impact Assessment and an audit at least once every twelve months from the date on which it is notified as such, and to cause the person carrying out the assessment and audit to furnish to the Board a report containing significant observations. Rule 13 also requires Significant Data Fiduciaries to verify that technical measures, including algorithms and software used for hosting, displaying, uploading, storing, updating or sharing personal data, are not likely to pose a risk to Data Principal rights, and to ensure that specified categories of personal data and associated traffic data are processed under localisation‑type restrictions, including a prohibition on transfers outside India, where so specified by the Government on the recommendation of a committee.

Rights and Duties of Data Principals

Chapter III, comprising Sections 11 to 15, deals with the rights and duties of Data Principals. Section 11 gives the Data Principal a right, upon request, to obtain from a Data Fiduciary a summary of the personal data being processed and the processing activities, the identities of all other Data Fiduciaries and Data Processors with whom the data has been shared and a description of the personal data shared, and any other information related to her data and its processing as may be prescribed. Section 12 grants the right to correction, completion, updating and erasure of personal data for which she has previously given consent. Data Fiduciaries must correct inaccurate or misleading personal data, complete incomplete data and update data on request, and must erase personal data when requested unless retention is necessary for the specified purpose or to comply with law.

Section 13 provides a right to have readily available means of grievance redressal provided by the Data Fiduciary or Consent Manager in respect of any act or omission relating to the performance of obligations or the exercise of rights under the Act. The Data Fiduciary or Consent Manager must respond to grievances within a prescribed period, and the Data Principal must exhaust this mechanism before approaching the Board. Section 14 allows the Data Principal to nominate another individual, in a prescribed manner, who will exercise her rights in the event of death or incapacity. Section 15 lists duties of Data Principals, including complying with applicable laws when exercising rights, not impersonating others when providing personal data, not suppressing material information while providing data for identity documents, not registering false or frivolous grievances or complaints, and furnishing only verifiably authentic information when seeking correction or erasure.

Rule 14 supports these rights by requiring Data Fiduciaries and Consent Managers to prominently publish, on their websites or apps, details of the means by which Data Principals can make rights‑requests and any identifiers (such as customer IDs, application numbers, email addresses or phone numbers) required to identify them. It also obliges them to publish, within a reasonable period not exceeding ninety days, their internal timeframe for responding to grievances and to implement appropriate measures to meet that timeframe. Rule 14 further clarifies that nomination under Section 14 can be exercised using the means and particulars required by the Data Fiduciary, consistent with its terms of service and applicable law.

Exemptions and State Processing

Chapter IV (Sections 16 and 17) contains special provisions, including cross‑border transfer and exemptions. Section 16 empowers the Central Government, by notification, to restrict the transfer of personal data by a Data Fiduciary to specified countries or territories outside India. It clarifies that nothing in Section 16 overrides any stricter restriction or higher protection under other laws.

Section 17 provides a carefully layered set of exemptions. Section 17(1) disapplies almost all of Chapter II (except Sections 8(1) and 8(5)), Chapter III and Section 16 in certain situations. These include: processing necessary to enforce legal rights or claims; processing by courts, tribunals or other bodies entrusted with judicial, quasi‑judicial, regulatory or supervisory functions, where necessary for those functions; processing in the interest of prevention, detection, investigation or prosecution of offences or contraventions; processing of data of Data Principals outside India pursuant to a contract with a person outside India by a person based in India; processing necessary for schemes of compromise, arrangement, mergers, demergers or similar corporate restructurings approved by a competent authority; and processing to ascertain the financial information, assets and liabilities of loan defaulters by financial institutions, subject to relevant laws.

Section 17(2) disapplies the Act in respect of processing by such State instrumentalities as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to related cognisable offences, and in respect of processing necessary for research, archiving or statistical purposes where data is not used to take decisions specific to a Data Principal and where prescribed standards are followed. Section 17(3) allows the Government, having regard to the volume and nature of personal data processed, to notify certain Data Fiduciaries or classes, including startups, to whom Section 5, Sections 8(3) and 8(7), and Sections 10 and 11 shall not apply. Section 17(4) relaxes Sections 8(7) and 12(2)–(3) where processing is by the State and either is for a purpose that does not include making decisions affecting the Data Principal or falls within specified categories. Section 17(5) allows the Government, within five years of the commencement of the Act, to declare that any provision will not apply to certain Data Fiduciaries or classes for a specified period.

Rule 5, together with the Second Schedule, sets standards for State processing of personal data when providing or issuing subsidies, benefits, services, certificates, licences or permits, requiring lawful, necessary, proportionate and secure processing, limited retention and accuracy. Rule 16 implements the research exemption under Section 17(2)(b) by prescribing standards, also in the Second Schedule, for processing personal data for research, archiving or statistical purposes. Rule 23 allows the Central Government, acting through authorised officers, to require any Data Fiduciary or intermediary to furnish information for purposes listed in the Seventh Schedule (which include enforcing the Act and protecting sovereignty and security), and allows the Government to direct that such requirements not be disclosed to affected Data Principals where disclosure would prejudice these interests.

Data Protection Board of India and Appellate Mechanism

The institutional core of the enforcement framework is the Data Protection Board of India, established under Section 18. The Board is a body corporate with perpetual succession and a common seal, with power to acquire, hold and dispose of property, and to sue or be sued. Its headquarters are notified by the Central Government. Section 19 provides that the Board consists of a Chairperson and such other Members as may be notified, all appointed in the manner prescribed, and requires that the Chairperson and Members be persons of ability, integrity and standing with special knowledge or practical experience in fields such as data governance, social or consumer protection, dispute resolution, ICT, digital economy, law, regulation or techno‑regulation, with at least one legal expert. Section 20 provides that the Chairperson and Members hold office for a term of two years and are eligible for re‑appointment, and that their salary, allowances and terms of service will be as prescribed and cannot be varied to their disadvantage after appointment.

Sections 21 and 22 set out disqualifications and removal, as well as resignation, filling of vacancies and a one‑year cooling‑off period before accepting employment with a Data Fiduciary against whom proceedings were initiated by or before the Chairperson or Member, unless the Government approves earlier employment. Section 23 addresses the procedure for meetings and authentication of Board instruments, and protects Board proceedings from invalidation due to vacancies, appointment defects or procedural irregularities not affecting merits. Section 24 allows the Board, with Government approval, to appoint officers and employees.

Sections 25 to 27 deal with functions, powers and procedure. The Board’s functions include examining intimations of personal data breaches, directing urgent remedial or mitigation measures, inquiring into breaches or contraventions based on intimation, complaints, Government references or court directions, and imposing monetary penalties. The Board has powers similar to those of a civil court in respect of summoning and enforcing attendance, requiring discovery and production of documents, receiving evidence on affidavits and issuing commissions for the examination of witnesses or documents. It must be guided by the principles of natural justice, provide the person concerned with an opportunity of being heard, and record reasons in writing for its decisions.

The DPDP Rules complete the institutional picture. Rule 17 provides for two Search‑cum‑Selection Committees for recommending appointments to the Board: one chaired by the Cabinet Secretary for the Chairperson, and another chaired by the Secretary, Ministry of Electronics and Information Technology, for Members. Rule 18 and the Fifth Schedule specify the salaries and service conditions of the Chairperson and Members. Rule 19 addresses meeting procedures, quorum, voting, conflict‑of‑interest recusal and emergency decision‑making by circulation or by the Chairperson acting alone, subject to subsequent ratification. Rule 20 mandates that the Board function as a “digital office”, adopting techno‑legal measures to conduct proceedings without requiring physical presence, while preserving its power to summon individuals and examine them on oath. Rule 21 provides that the Board may, with Government approval, appoint officers and employees, with their service conditions set out in the Sixth Schedule.

Appeals from Board orders or directions lie to the Appellate Tribunal under Section 29. The Telecom Disputes Settlement and Appellate Tribunal, established under the Telecom Regulatory Authority of India Act, 1997, is designated as the Appellate Tribunal for DPDP purposes. Appeals must be filed within sixty days, with the Tribunal having discretion to condone delay, and the Tribunal is not bound by the Civil Procedure Code but guided by the principles of natural justice. Rule 22 requires that appeals be filed in digital form and accompanied by a fee equivalent to that applicable for appeals under the TRAI Act, payable through digital payment systems such as UPI, unless reduced or waived by the Tribunal Chairperson. It also provides that the Tribunal itself functions as a digital office.

Penalties and Blocking Powers

Section 33 and the Schedule create a detailed penalty framework. The Schedule prescribes maximum penalties for specified contraventions. For serious failures such as non-compliance with Section 8(5) on reasonable security safeguards, penalties can go up to Rs. 250 crore. Breaches of Section 8(6) (failure to notify personal data breaches) and of obligations in respect of children under Section 9 may attract penalties up to Rs. 200 crore. Non‑compliance by Significant Data Fiduciaries with additional obligations under Section 10 may draw penalties up to Rs. 150 crore. Other contraventions of the Act and rules may attract penalties up to Rs. 50 crore. A Data Principal who breaches her duties under Section 15 may be penalised up to Rs. 10,000.

When deciding the quantum of penalty, Section 33(2) requires the Board to consider factors such as the nature, gravity and duration of the breach, the type and nature of personal data affected, the repetitive nature of the breach, undue advantage gained or loss avoided, mitigation efforts, proportionality and effectiveness of the penalty, and the likely impact of the penalty on the person. Section 34 states that all sums realised by way of penalties must be credited to the Consolidated Fund of India.

In cases of repeated and serious non‑compliance, the Act also allows the Central Government, on the Board’s reference, to direct blocking of access by the public to the services of a non-compliant Data Fiduciary, by directing intermediaries to block access to its services, thereby acting as an ultimate deterrent in addition to monetary penalties.

Conclusion

The DPDP Act and the Rules together mark a structural change in India’s data governance landscape. They codify a rights‑based model that gives Data Principals clear, enforceable rights over their digital personal data, impose layered and risk‑based obligations on Data Fiduciaries and Significant Data Fiduciaries, and create a specialised, digital‑first regulator with strong investigative and penalty powers. For organisations, the framework demands careful re‑design of consent and notice flows, data security controls, retention practices, vendor contracts and governance structures. For individuals, it offers a more transparent and accountable environment in which their data is collected and used, anchoring digital commerce and public service delivery in a more robust privacy regime.

Image Credits:

Photo by Storm on Canva

The DPDP Act and the Rules together mark a structural change in India’s data governance landscape. They codify a rights‑based model that gives Data Principals clear, enforceable rights over their digital personal data, impose layered and risk‑based obligations on Data Fiduciaries and Significant Data Fiduciaries, and create a specialised, digital‑first regulator with strong investigative and penalty powers. For organisations, the framework demands careful re‑design of consent and notice flows, data security controls, retention practices, vendor contracts and governance structures. For individuals, it offers a more transparent and accountable environment in which their data is collected and used, anchoring digital commerce and public service delivery in a more robust privacy regime.

Related Posts

POST A COMMENT

Children’s Data: Rethinking Schedule IV Exemptions

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) creates heightened safeguards for children’s personal data, including requirements for verifiable parental consent (VPC) and a ban on tracking, behavioural monitoring, and targeted advertising for minors. However, the DPDP Rules introduce Schedule IV, which exempts wide categories of data fiduciaries and purposes from these child-specific protections. This article analyses whether these exemptions are justified, excessive, or structurally risky — and whether India has departed too far from global best practice in protecting children online.

The exemptions in Schedule IV of the DPDP Rules carve out wide classes of data fiduciaries and broad categories of purposes from the strict parental-consent and anti-tracking requirements under Section 9(1) and (3) of the DPDP Act. These exemptions are provided to healthcare, education, child and infant care sectors, and any third-party service providers who are engaged by such educational institutions and childcare establishments. Data used for the exercise of any power, performance of any function in the interests of children, providing public funds, subsidies, and benefits, for creating e-mails, for real-time location tracking, for ensuring restricted access to information, service and advertisements targeted towards children are also exempted. These exemptions are simultaneously pragmatic and problematic. They are pragmatic because they respond to clear implementation constraints; they are problematic because they hollow out the strongest legal protections for children and create regulatory complexity that will advantage well-resourced actors and confuse smaller ones. The central question, then, is whether these exemptions are excessive or required, and whether India should have retained verifiable parental consent (VPC) as the normative rule for processing children’s data.

While the exemptions are required to an extent, their scope is too wide—almost defeating the purpose of the protections in place. On one hand, the Act’s parental consent mandate and its categorical prohibition on behavioural monitoring for children are administratively heavy: meaningful VPC at scale demands reliable, ubiquitous age-verification infrastructure that India does not yet possess. Requiring authentication for routine public-interest services such as education, health, welfare delivery, or disability support would render these systems unworkable. The Rules’ drafters clearly intended to avoid paralysing essential services and to protect the informal economy by permitting carve-outs for state functions, healthcare, schooling, and benefits delivery. From an administrative-feasibility perspective, this is defensible: a legal rule that cannot be implemented in practice produces chaos and inequitable compliance. In this sense, some form of exemption was not merely advisable but inevitable.

However, on the other hand, the exemptions are also overbroad in form and risk creating perverse incentives. Firstly, Schedule IV’s Parts A and B do not simply list narrow exceptions; they cover entire sectors and wide functional categories — “education,” “healthcare,” even “creation of user accounts for communication.” This drafting invites interpretation disputes and allows commercial actors to strategically characterise their processing to fall within an exempted category. For example, an ed-tech platform offering ad-supported features can plausibly argue that it is an “education service” and thus escape the VPC and anti-tracking obligations, even when engaging in behavioural analytics for monetisation. The practical effect is a shift from clear statutory protection toward a discretionary, fact-dependent exercise that empowers sophisticated actors to structure themselves into exemptions while leaving small schools, NGOs, and local service providers uncertain and overburdened.

Additionally, these exemptions aggravate enforcement and accountability asymmetries. One would expect that the highest-risk actors, such as large digital platforms and ad-driven engagement ecosystems, should face the strictest constraints when processing children’s data. Yet the sectoral carve-outs create pathways for precisely such actors to claim exemption. Regulators will be forced into complex, purpose-driven interpretation disputes, a resource-intensive task that disproportionately benefits well-funded incumbents capable of deploying legal and technical argumentation. Meanwhile, smaller actors, fearing non-compliance, may collect unnecessary data or avoid collecting information that is genuinely needed, weakening their services and potentially excluding vulnerable children. This tension between usability and meaningful protection has been exacerbated by the carve-outs under Schedule IV.

Furthermore, from a child-rights and ethical standpoint, the exemptions represent a significant step backwards. The purpose of child-specific provisions is to recognise children’s limited capacity to assess digital risks and their heightened susceptibility to manipulation. By treating VPC as dispensable in most contexts, the Rules implicitly subordinate child protection to administrative convenience. While this may be justifiable for narrowly defined public-interest functions, it is far harder to defend across sectors where commercial incentives to profile and nudge minors remain strong. When the law ceases to provide a strong presumption in favour of parental oversight, responsibility shifts to ad hoc regulatory interventions and voluntary corporate restraint — approaches that have historically been inadequate.

Comparative global practice reinforces this concern, although different jurisdictions use different legal mechanisms. In the United States, COPPA requires verifiable parental consent for the collection of personal information from children under 13 by online services directed to children or services that have actual knowledge of a child user; its exemptions are narrow and mostly operational (such as security, support for internal operations, or legal compliance). In the European Union, GDPR Article 8 requires parental authorisation for processing the personal data of children under 16 in the context of “information society services” offered directly to them, with Member States allowed to lower the age to between 13 and 16; while GDPR does not rely on broad sectoral carve-outs, it instead uses other lawful bases such as “public interest” or “legal obligation” for essential services, and these bases still impose strict necessity and proportionality tests. The United Kingdom’s Age-Appropriate Design Code (Children’s Code) does not create a separate parental-consent regime but imposes stringent design-level obligations such as high privacy by default, limits on profiling unless it is demonstrably in the child’s best interests, and mandatory DPIAs for services likely to be accessed by children. California’s emerging approach (under the California AADC, currently under litigation but indicative of policy direction) similarly emphasises safety-by-design standards and assessments rather than relying solely on parental consent.

Taken together, these regimes differ in technique but converge on a common principle: special protections for children should be the baseline, and any relaxation of those protections must be narrow, justified, and accompanied by strong structural safeguards. Against this backdrop, India’s choice to exempt wide classes of data fiduciaries and broad categories of purposes through Schedule IV represents an unusually permissive model in comparative terms.

There are also practical steps that would preserve necessary flexibility while restoring protective force. The Rules should adopt narrow, tightly worded exemptions tied to specific tasks rather than entire sectors; mandate baseline technical and organisational safeguards, including data minimisation and default bans on profiling; require child-specific impact assessments; and create a public register of entities claiming Schedule IV exemptions. Most importantly, the burden of proof must be inverted: data fiduciaries seeking exemption should be required to publicly justify why VPC is infeasible and how risks to children are mitigated.

In short, while exemptions were necessary to avoid operational paralysis, the current sweep of Schedule IV is excessive and risks institutionalising weaker standards for child data protection. A more transparent, proportionate, and child-centric regulatory model grounded in VPC as the normative rule and supported by narrowly tailored exceptions would better reconcile India’s administrative realities with its substantive responsibility to protect minors in an increasingly data-driven ecosystem.

Image Credits:

Photo by Stock Dignity on Canva

While exemptions were necessary to avoid operational paralysis, the current sweep of Schedule IV is excessive and risks institutionalising weaker standards for child data protection. A more transparent, proportionate, and child-centric regulatory model grounded in VPC as the normative rule and supported by narrowly tailored exceptions would better reconcile India’s administrative realities with its substantive responsibility to protect minors in an increasingly data-driven ecosystem.

Related Posts

POST A COMMENT

The DPDP Act’s Penalty Regime: Design, Challenges, and Constitutional Questions

The Digital Personal Data Protection Act, 2023 (“DPDP Act”), introduces a significant shift in India’s data governance landscape by establishing a comprehensive, rights-based framework for regulating the processing of digital personal data. The penalty regime under the Act—its magnitude, proportionality, and enforceability—has naturally become one of the most debated aspects among enterprises and policy analysts. 

Following the notification of the DPDP Rules, several organisations were concerned about whether penalties would take immediate effect. The government has clearly notified that the penalty-related provisions will become enforceable only eighteen months after the notification of the Rules, meaning they come into force on 13 May 2027. Until then, monetary sanctions cannot be imposed. This transitional period provides a timely opportunity to engage in deeper reflection on the design and constitutional robustness of the penalty framework, and these discussions may ultimately shape a more balanced and predictable enforcement ecosystem.

Role and Discretion of the Data Protection Board

The Data Protection Board of India (DPB) is the specialised adjudicatory body entrusted with investigating breaches, determining violations, and imposing penalties. Its functions are essentially quasi-judicial and mirror the role played by sectoral tribunals that operate according to the principles of natural justice. Neither the Act nor the Rules currently prescribe detailed procedural guidelines for the DPB’s inquiry process and penalty determination. In the absence of clear procedures, the Board retains substantial discretion in deciding how to determine the penalty for violations. As per the law, it could impose penalties, issue warnings, direct remedial actions, or even close cases where violations are minor or have been promptly addressed. Given this wide discretion, the development of detailed operational procedures becomes essential to ensure consistency, transparency, and fairness in enforcement.

Magnitude of Penalties and Their Deterrent Nature

The DPDP Act authorises some of the highest administrative monetary penalties in Indian law. The Act prescribes penalties of up to ₹250 crores for failing to implement reasonable security safeguards, up to ₹200 crores for failures involving breach notifications or violations concerning children’s data, up to ₹150 crores for non-compliance by Significant Data Fiduciaries, and up to ₹50 crores for other remaining categories of violations. Unlike regulatory sectors where penalties correspond to quantifiable economic harm, data protection violations often result in intangible, unpredictable, or non-economic forms of harm. This means that the consequences of similar lapses can differ significantly depending on context; a small organisation’s failure could lead to substantial harm, while a large organisation’s failure may produce comparatively limited consequences.

Penalties under the DPDP Act are therefore designed primarily as deterrents, rather than as mechanisms to compensate data principals. This is reinforced by the fact that penalties are credited to the Consolidated Fund of India, and the Act does not establish any dedicated compensation mechanism for affected individuals. While civil and tort law remedies remain formally available, the statute neither excludes nor explicitly recognises these avenues of redress. This raises a question of whether Data fiduciaries will eventually have to face both the penalty regime under the DPDP Act and class tort claims by the data Principals.

Factors Guiding Penalty Determination

Section 33(2) of the Act outlines a range of factors that the DPB must consider when determining the quantum of penalties, such as the nature, gravity, and duration of the breach; the type of personal data involved; whether the violation was repetitive; the advantage gained or loss avoided by the violator; the promptness and adequacy of mitigation efforts; and the proportionality and impact of the proposed penalty on the concerned entity. These considerations broadly reflect international regulatory practice. However, the Act departs notably from global standards by omitting turnover-based penalty caps, a central feature of the GDPR and many other contemporary privacy laws. The absence of such caps introduces uncertainty and places substantial responsibility on the DPB to develop a fair and defensible methodology for determining penalties.

Conceptual Ambiguities and Procedural Gaps

The DPB’s broad discretion increases the possibility of inconsistent enforcement unless clear procedural norms are established. Certain conceptual and practical ambiguities are evident. The Act does not create a standalone penalty for unlawful or unauthorised processing of personal data, even though such conduct lies at the core of privacy regulation worldwide. While one could argue that such violations fall within the residual penalty category, failing to identify them explicitly risks weakening deterrence and undermining the central objective of the Act. Similarly, the foundational requirement to implement “reasonable security safeguards,” which triggers the highest penalties under the Act, lacks clarity. The expression Reasonable security safeguards could be interpreted in many ways. Unless more clarity is brought by further rules or notifications, its meaning must ultimately be shaped through judicial interpretation.

The severity of monetary penalties under the DPDP Act may also prompt constitutional challenges. Litigation may arise under Article 19(1)(g), which protects the freedom to carry on trade or business, or under Article 14, which prohibits arbitrary state action. Indian courts have historically invalidated administrative penalties that are manifestly disproportionate or imposed without adequate rationale, and similar scrutiny is likely once the DPDP Act becomes operational. Questions regarding proportionality, the fairness of procedure, and the adequacy of reasoning will almost certainly be tested through judicial review, especially in cases where the DPB imposes large penalties without comprehensive statutory guidance.

Difficulties in Drawing Parallels with Other Regulatory Models

Another challenge that we can foresee is in the difficulty of drawing from the enforcement models of other Indian regulators. Many regulatory bodies, such as SEBI, the Competition Commission of India, and IRDAI, impose penalties that are closely tied to measurable economic harm or quantifiable indicators such as turnover, profit, or customer loss. Data protection violations, however, frequently involve harm that is intangible and more closely related to violations of the fundamental right to privacy, recognised by the Supreme Court in K.S. Puttaswamy v. Union of India. Historically, infringements of fundamental rights such as discrimination, untouchability, or forced labour have been addressed through criminal sanctions or constitutional remedies rather than administrative monetary penalties. The DPDP Act’s reliance solely on monetary penalties to address privacy violations therefore raises important questions about whether such penalties are adequate to safeguard a constitutional right and whether the DPB can exercise its powers consistently and effectively.

Need for Clarity Before Enforcement Begins

In conclusion, the penalty regime under the DPDP Act represents a significant evolution in India’s approach to personal data protection. While the Act is ambitious and seeks to strengthen accountability, it also introduces substantial challenges concerning proportionality, clarity, consistency of enforcement, and constitutional soundness. As the enforcement provisions come into effect after 2027, it is important that more detailed rules and clarifications are brought well in advance. Otherwise, we may have to wait for the judicial interpretations to have clarity on how these penalties are determined and how the broader enforcement ecosystem works. Although, considering the delay of our adjudicatory system, leaving to get it matured through judicial precedents is not a desirable option.

Image Credits:

Photo by Galeanu Mihai on Canva

The DPDP Act authorises some of the highest administrative monetary penalties in Indian law. Unlike regulatory sectors where penalties correspond to quantifiable economic harm, data protection violations often result in intangible, unpredictable, or non-economic forms of harm. This means that the consequences of similar lapses can differ significantly depending on context; a small organisation’s failure could lead to substantial harm, while a large organisation’s failure may produce comparatively limited consequences.

Related Posts

POST A COMMENT

Searching for the True Face of Consent Managers

“Human beings are the agents of their own destiny.” Yet destiny, more often than not, bends to the command of the law and third-party agents are imposed upon me. When the Digital Personal Data Protection Act, 2023 (DPDP Act), came into force, privacy enthusiasts immediately turned their attention to an entirely new type of intermediary it introduced — the Consent Manager.

Section 2(g) defines a Consent Manager as an entity registered with the Data Protection Board, acting as a unified, transparent, and interoperable point through which Data Principals can give, manage, review, or withdraw consent. Section 6(7) reinforces this role, while Section 6(8) declares that the Consent Manager must act on behalf of the Data Principal, accountable to them and bound by obligations yet to be detailed.

From these provisions, I envisioned an almost idealistic figure, a guardian of my data, a true agent who could bind me even more effectively than I could bind myself. In my imagination, Consent Managers were noble institutions: perhaps NGOs, charitable organisations, or government-backed bodies devoted to the cause of privacy. I pictured them as selfless agents who would make thoughtful decisions on my behalf, safeguard my interests, and uphold the fair use of my data. Individuals of unimpeachable character, untouched by commercial motives, sustained by CSR funds or philanthropic contributions. A benevolent service designed for ordinary citizens.

However, my quixotic imagination failed the moment I read the Digital Personal Data Protection Rules, 2025 (DPDP Rules). They paint a very different picture. Rule 4 and the First Schedule lay out a detailed set of requirements.

I am, as Descartes described, a thinking being capable of choice — yet the Consent Manager who acts on my behalf is not someone I am free to choose. It is someone defined and characterised by statute. And the law is clear: a Consent Manager cannot be an individual. It must be a company incorporated in India, equipped with the technical, operational, and financial capacity to discharge its responsibilities. Its “general character of management” must be sound — a phrase whose meaning continues to puzzle me. What is this “character”? How is it assessed? Has this expression “general character of management” ever been used meaningfully in another regulatory context? I am still searching for clarity.

Then comes the financial threshold: a minimum net worth of two crore rupees. With that, the role begins to look less like a public-spirited safeguard and more like the terrain of well-capitalised corporates. Such net-worth requirements are typical for financial intermediaries. Why mandate such a requirement here? Why this specific number? It almost appears arbitrary.

The more I read, the more my earlier idealism faded. The rules make it evident that the Consent Manager is expected to operate as a business, one that must demonstrate revenue prospects and provide corresponding capital adequacy. But what will be its source of revenue?  Will individuals have to pay to manage their own consents?  Will Data Fiduciaries pay for each consent processed? Will earnings depend on the number of consents granted or the number refused?  This leads to a deeper concern:  If commercial interests become central, how can a Consent Manager’s incentives remain aligned with the welfare of the Data Principal?

Technology, interoperability, and user-friendly consent mechanisms are undeniably important. That part is entirely logical. Yet the broader picture remains murky. I find myself perplexed — not just about the identity of a Consent Manager, but about its business model and even its intended purpose.

Are these entities supposed to be my agents, defending the sanctity of my personal data? Or are they simply another intermediary, positioned to profit from it?   Only time will tell which face of the Consent Manager will ultimately emerge.

Despite all my confusions, I have one clear aspiration: as a legal practitioner, to create and register Consent Managers; and perhaps, in doing so, shape their true character.

Image Credits:

Photo by Galeanu Mihai on Canva

Technology, interoperability, and user-friendly consent mechanisms are undeniably important. That part is entirely logical. Yet the broader picture remains murky. I find myself perplexed — not just about the identity of a Consent Manager, but about its business model and even its intended purpose.

Related Posts

POST A COMMENT

Right to Erase or Risk of Being Erased? The Flaws of Mandatory Data Erasure

The publication of the Digital Personal Data Protection Rules, 2025, in the Official Gazette on 13 November 2025 introduces, under Rule 8, a stringent set of erasure requirements for certain high-volume Data Fiduciaries—namely, e-commerce platforms and social-media intermediaries with 20 million users or more, and online gaming intermediaries with at least five million users. Under this rule, such entities must delete personal data unless its retention is legally required, and must initiate erasure when a user account has been inactive for three years. The process includes a mandatory 48-hour notice to the Data Principal, after which, if the user fails to log into the account, the fiduciary is obliged to erase the data.

Although this framework may appear at first glance to advance privacy protection, it raises significant concerns. The mandatory deletion of dormant accounts risks inadvertently destroying an individual’s digital history—personal records, communications, receipts, and documents that may hold long-term personal or legal value. A 48-hour response window is unreasonably short; a Data Principal may easily miss such a notification, or may be incapacitated, travelling, or otherwise unable to react within the allotted time. Rather than safeguarding individual rights, this provision could result in the irreversible loss of valuable information.

This approach also reflects a deeper conceptual confusion. The government appears to enforce data subject rights with a data fiduciary’s time-bound obligation to delete. Data erasure, under established global privacy norms, is fundamentally a user-driven prerogative—not a rigid, time-bound compliance burden imposed on organisations. Control over the fate of personal data should rest with the Data Principal, not be dictated by an automated regulatory timetable.

GDPR and most contemporary privacy regimes recognise the Right to Erasure as an individual right: personal data must be deleted when it is no longer necessary and when the individual expressly requests its removal. The obligation arises from the individual’s autonomy, not from a statutorily prescribed expiration period. By mandating deletion after a fixed period of inactivity, the DPDP Rules 2025 depart from this rights-based foundation and risk undermining the very autonomy they seek to protect. Lawmakers should not impose an arbitrary duration that automatically deems personal data no longer relevant.

This problem becomes even more pronounced in today’s digital environment. E-commerce receipts are often stored exclusively online within user accounts; warranty documents are maintained digitally; and cloud storage services allow users to keep important personal files, records, and archives in electronic form. A mandatory deletion requirement triggered solely by account inactivity could cause substantial inconvenience and, in many cases, irreversible harm to Data Principals who rely on these digital repositories.

Rule 8, therefore, requires urgent reconsideration. A policy intended to protect privacy should not inadvertently compromise personal autonomy, digital continuity, or the preservation of an individual’s historical and informational legacy.

Image Credits:

Photo by yenwen on Canva

The government appears to enforce data subject rights with a data fiduciary’s time-bound obligation to delete. Data erasure, under established global privacy norms, is fundamentally a user-driven prerogative—not a rigid, time-bound compliance burden imposed on organisations. Control over the fate of personal data should rest with the Data Principal, not be dictated by an automated regulatory timetable.

Related Posts

POST A COMMENT