With the enactment of the Digital Personal Data Protection (DPDP) Act, 2023, India has firmly established its comprehensive data privacy framework. For Indian lawyers—especially those advising corporate clients, tech startups, or healthcare providers—a deep understanding of this Act is no longer optional. It is a core competency required in modern legal practice.
Here is a breakdown of what Indian lawyers need to know about the DPDP Act and how it changes the compliance landscape.
1. The Core Terminology Shift
The DPDP Act introduces specific nomenclature that lawyers must adopt in their drafting and advisory roles:
* Data Principal: The individual to whom the personal data relates (similar to "Data Subject" in GDPR).
* Data Fiduciary: The entity that determines the purpose and means of processing personal data (similar to "Data Controller").
* Data Processor: The entity processing data on behalf of a Data Fiduciary.
2. Consent is King, but with Exceptions
The bedrock of the DPDP Act is consent. Processing personal data requires free, specific, informed, unconditional, and unambiguous consent with a clear affirmative action.
Legal Advisory Action Point: Lawyers must review and redraft their clients' existing Privacy Policies and Terms of Service. "Bundled" or "blanket" consent is no longer valid.
Furthermore, the Act provides for "Certain Legitimate Uses" (replacing the concept of "deemed consent"), such as medical emergencies, state obligations, or employment purposes, where explicit consent is not required.
3. Strict Obligations for Data Fiduciaries
Advising a Data Fiduciary comes with a heavy checklist of compliance requirements:
* Notice: Fiduciaries must provide an itemized notice detailing what data is collected and why.
* Data Minimization & Accuracy: Only collect what is necessary, and ensure it remains accurate.
* Purpose Limitation & Storage Limitation: Data must not be kept longer than necessary for the specified purpose.
* Breach Notification: In the event of a personal data breach, Fiduciaries must notify the Data Protection Board of India and the affected Data Principals.
4. The Significant Data Fiduciary (SDF)
The Central Government can classify certain entities as "Significant Data Fiduciaries" based on the volume/sensitivity of data handled, risk to electoral democracy, or public order.
Advising an SDF: If your client falls into this category, they face heightened obligations, including:
* Appointing a resident Data Protection Officer (DPO). * Appointing an Independent Data Auditor. * Conducting periodic Data Protection Impact Assessments (DPIA).
5. Heavy Penalties for Non-Compliance
The DPDP Act completely steps away from criminal liabilities (like imprisonment) for data breaches, shifting entirely to massive financial penalties.
* Failure to prevent a personal data breach can result in fines up to ₹250 Crore.
* Failure to notify the Board or affected principals of a breach can result in fines up to ₹200 Crore.
As corporate counsel, ensuring that your clients have robust data security measures and breach response protocols is critical to mitigating these massive financial risks.
Conclusion
The DPDP Act fundamentally changes the way businesses operate in India. For lawyers, it presents both a challenge in updating historical practices and an immense opportunity in compliance advisory. Reviewing data flows, drafting granular consent notices, and preparing breach response frameworks are the new imperatives of corporate legal practice in 2026.