INDIA Trends and Developments Contributed by: Vikram Jeet Singh and Kalindhi Bhatia, BTG Advaya
BTG Advaya 2nd Floor, Hague Building Dr SS Ram Gulam Marg Ballard Estate Fort Mumbai – 400 001 India Tel: +91 22 6177 2900 Email: practicemanager@btgadvaya.com Web: btgadvaya.com
Data Protection Highlights in India India’s draft Digital Personal Data Protection Rules, 2025 (Data Privacy Rules) are intended to implement India’s new privacy law, the Digi- tal Personal Data Protection Act, 2023 (DPDPA), and were released for public comments on 3 January 2025. 2025 marks more than seven years after the inci- dent that triggered the search for a new data privacy law in India: on 26 September 2018, the Indian Supreme Court ruled that information privacy was a fundamental right, and required the Indian government to come up with a new data law. In the seven years since that Supreme Court judgment, there has been continuing rapid growth in digitalisation in India and across the world. India and the world have also gone through a global pandemic, and India has seen two national elections and the rise of a new “online” generation. In the past couple of years, the emergence of game-changing new technolo- gies such as generative AI has challenged pri- vacy regulations and models. The Draft Privacy Rules were available for public consultation until mid-March 2025. When they
are finalised and notified, the Digital Personal Data Protection Act, 2023 will become opera- tional. Life for businesses collecting and pro- cessing data of Indian individuals will change in the following ways once the new DPDPA is implemented in 2025. Imagining life under the DPDPA The term “Personal Data” means any data about an individual, who can be identified by, or in rela - tion to, such data. The DPDPA applies to any processing of “Personal Data” within the terri- tory of India, and to any processing of such data outside India if such processing is in connection with any activity related to the offering of goods or services to data principals within the territory of India. Such Personal Data can be processed only with the consent of the data principal, or pursuant to certain limited “legitimate uses” set out under the DPDPA. How will life change: five major impacts of the new DPDPA • A data regulator: for the first time, India will have a bespoke data regulator in the Data Protection Board, which will be constituted by the government and will have duties including
206 CHAMBERS.COM
Powered by FlippingBook