Navigating the Digital Personal Data Protection Act, 2023
What boards and general counsel need to know about India's new privacy regime — from consent architecture to cross-border transfers.
The Digital Personal Data Protection Act introduces a principles-based framework that materially changes how Indian and foreign businesses process personal data. While the broad strokes echo GDPR, several India-specific provisions deserve careful structuring before enforcement begins.
Companies should treat compliance as a board-level program, not a checkbox: appoint a Data Protection Officer where mandated, redesign consent flows, and ensure vendor contracts allocate liability under the Act.
We expect the first wave of enforcement to focus on consent capture, breach notification timelines, and cross-border transfer documentation. Early movers will be measurably advantaged.