Data privacy and the DPDP Act

Almost every company now holds personal data: customer details, payment records, health information, employee files. A breach or misuse can hurt people directly, and it can cost the company fines, lawsuits and customers.

India's Digital Personal Data Protection (DPDP) Act was passed in 2023. The Rules that make it work were notified on 14 November 2025, with most duties applying after an 18-month phase-in. For banks, insurers, IT services, telecom, health care, e-commerce and consumer apps, data privacy has become one of the most material ESG issues.

Key terms

• Data principal: the person the data is about.
• Data fiduciary: the organisation that decides why and how personal data is processed.
• Data processor: an organisation that processes data on a fiduciary's behalf, such as an IT services firm working for a client.
• Significant data fiduciary: a fiduciary the government names because of the volume or sensitivity of its data, which faces extra duties.
• Data Protection Board: the body that hears complaints and imposes penalties.
• Consent manager: a registered platform through which people can give, manage and withdraw consent.

Core duties of a data fiduciary

• Give a clear, plain-language notice of what data is collected and why.
• Get valid consent, or rely on a lawful ground set out in the Act.
• Take reasonable security safeguards, such as encryption and access controls.
• Inform affected people and the Board of a personal data breach without delay.
• Erase data when it is no longer needed, and handle erasure requests within set time limits.
• Get verifiable consent from a parent or guardian before processing children's data (people under 18), except for essential services such as health care and education.
• Publish contact details for privacy questions.

Extra duties for significant data fiduciaries

Independent data audits, impact assessments, stricter checks on new or sensitive technologies, and, for some data, possible government directions on local storage.

Phase-in

The Rules allow 18 months for most duties, such as notices, consent and security safeguards, so they apply from around May 2027. Registration of consent managers comes earlier.

Penalties

Data sources

• BRSR Principle 9: the number of data breaches, the share involving customers' personal data, and complaints on data privacy and cybersecurity. Data breaches are a BRSR Core indicator.
• Annual report: risk sections, cyber incident disclosures and any regulatory penalties.
• Stock exchange filings: material cyber incidents disclosed as events.