Nearly every organisation holds personal data: payroll and HR files, customer lists, app users, CCTV footage. Data protection law in India now centres on the Digital Personal Data Protection Act, 2023, which works alongside the Information Technology Act, 2000 and the sector rules of regulators such as the RBI and SEBI.
DPDP Act compliance
The DPDP Act covers digital personal data processed in India, and processing outside India connected with offering goods or services to people in India. An organisation that decides why and how data is processed is a data fiduciary. It must give notice and rely either on consent that is free, specific, informed, unconditional and unambiguous, or on a legitimate use recognised by the Act, and it must protect the data with reasonable security safeguards.
The Act and the Digital Personal Data Protection Rules, 2025 are being brought into force in phases, which gives organisations a defined period to prepare. A compliance programme usually covers:
- a data map of what personal data is held, where, why and who receives it
- notices and consent flows, with withdrawal as easy as giving consent
- verifiable parental consent for children's data, and no tracking or targeted advertising aimed at children
- contracts with data processors and vendors
- security safeguards and a breach response plan
- handling of access, correction, erasure and grievance requests
- a Data Protection Officer, audits and impact assessments for entities notified as significant data fiduciaries
Breaches must be reported to the Data Protection Board of India and to affected individuals. The Board imposes penalties after inquiry, up to ₹250 crore for failing to take reasonable security safeguards against a breach, and its orders are appealable to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
IT Act matters and intermediary obligations
The Information Technology Act, 2000 remains the base law for electronic records, electronic signatures, cyber offences and intermediaries. As IT Act lawyers we handle compensation claims for unauthorised access to or damage of computer systems, which the State's adjudicating officer decides where the claim is up to ₹5 crore, and complaints of offences such as identity theft and cheating by personation. Under CERT-In's 2022 directions, specified cyber incidents must be reported within six hours of being noticed.
Platforms that host or transmit third-party content are intermediaries, and their safe harbour under Section 79 depends on due diligence under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021: published user rules, a grievance officer, and removal of unlawful content within the prescribed time once a court order or government notice gives actual knowledge. Significant social media intermediaries carry further duties. Platforms selling to consumers also answer to the Consumer Protection (E-Commerce) Rules, 2020, discussed in our note on the Consumer Protection Act, 2019.
Technology contracts, media and telecom
Technology contracts decide who owns code and data and who pays when systems fail. We draft and negotiate software licences, SaaS and cloud agreements, IT outsourcing and development contracts and data processing agreements, with ownership questions settled alongside our intellectual property practice. Contracts formed electronically are valid under Section 10A of the IT Act, though the Act does not apply to wills, powers of attorney, trusts or contracts for the sale of immovable property.
Media and content work covers defamation, now Section 356 of the Bharatiya Nyaya Sanhita, 2023 (formerly Sections 499 and 500 IPC), takedown and blocking requests, and content rules for broadcasters and films. The Telecommunications Act, 2023 replaces the Indian Telegraph Act, 1885 and the Indian Wireless Telegraphy Act, 1933 with a framework of authorisations, spectrum assignment and right of way for telecom infrastructure, brought into force in stages. Disputes between licensors, service providers and groups of consumers go to the TDSAT.
Questions about data, platforms or telecom regulation can be sent through the firm's contact page.
What the practice handles
- DPDP Act gap assessments and compliance programmes
- Privacy notices, consent flows and data processing agreements
- Breach response, CERT-In reporting and Data Protection Board proceedings
- IT Act compensation claims and cyber offence complaints
- Intermediary compliance, and takedown and blocking requests
- Software, SaaS, cloud and IT outsourcing contracts
- Defamation and content disputes across print, broadcast and online media
- Telecom authorisations, right of way and regulatory questions under the Telecommunications Act, 2023
- Appeals and disputes before the TDSAT
Where these matters are heard
- Data Protection Board of India
- Telecom Disputes Settlement and Appellate Tribunal, for DPDP and IT Act appeals and telecom disputes
- Adjudicating officer under Section 46 of the IT Act (the State's Secretary in charge of information technology)
- Department of Telecommunications and the Telecom Regulatory Authority of India
- High Courts, and the civil and criminal courts
Questions about Technology, Media & Telecom
Does the DPDP Act apply to a small business?
Yes. The Act has no general size exemption, so any person processing digital personal data in India, or processing data abroad to offer goods or services to people in India, is covered. The Central Government may exempt notified classes, including startups, from some obligations, and the heavier duties apply only to entities notified as significant data fiduciaries.
What must an organisation do after a personal data breach?
Under the DPDP Act, the data fiduciary must inform the Data Protection Board and each affected data principal, in the form and manner the rules prescribe. Specified cyber incidents must also be reported to CERT-In within six hours of being noticed. The first practical steps are to contain the breach, preserve logs and evidence, and establish what data was affected and whose.
Is consent the only basis for processing personal data?
No. Section 7 of the DPDP Act lists legitimate uses that do not need consent, including data a person has voluntarily provided for a specified purpose without objecting to its use, certain employment purposes, compliance with law or court orders, and medical emergencies. Other processing needs notice and consent that is free, specific, informed, unconditional and unambiguous.
Who decides compensation claims under the IT Act?
Claims under the IT Act of up to ₹5 crore are decided by the adjudicating officer, who in each State is the Secretary to the State Government in charge of information technology; larger claims go to civil courts. Appeals from the adjudicating officer lie to the TDSAT. Cyber offences are investigated by the police and tried in the criminal courts.
Are emails and chat messages admissible as evidence?
Yes. The Bharatiya Sakshya Adhiniyam, 2023 treats electronic records as documents, and a copy is proved with a certificate under Section 63 (formerly Section 65B of the Evidence Act) describing the record and the device that produced it. Preserving the original device, account access and metadata early makes proof far easier if a dispute reaches court.
A question that is not answered here? Send it to the firm.
This page describes the law in general terms as of 24 September 2026. It is not legal advice. The outcome of any matter depends on its facts, and the firm does not guarantee results.
