ARTICLE · 08 AUGUST 2025

Legal Podcast Episode No 3 (DPDP) (Video)

IndiaLaw LLP

Explore more from IndiaLaw LLP

DPDP Act Decoded: Navigating the Road to Enforcement" – This webinar offers a clear roadmap to compliance with India's Digital Personal Data Protection (DPDP) Act.

IndiaPrivacy

Aditi Rana

self

DPDP Act Decoded: Navigating the Road to Enforcement" – This webinar offers a clear roadmap to compliance with India's Digital Personal Data Protection (DPDP) Act. It covers key provisions like consent, data rights, breach notifications, penalties, and cross-border transfers. The session also explores AI's intersection with DPDP, global comparisons with EU regulations, and practical steps to minimize non-compliance risks. Led by expert Appurv Bhatia, it provides actionable insights for businesses to prepare ahead of enforcement.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

How To Prepare For A Data Protection Compliance Audit

Mansukhlal Hiralal & Company

DPDP Data Breach Notification In India: Timelines, Requirements And Key Compliance Considerations

King, Stubb & Kasiva

Data Retention And Deletion Under The DPDP Act: How Long Can Businesses Retain Personal Data In India?

King, Stubb & Kasiva

Cross-Border Data Transfers Under India’s DPDP Act: Rules, Restrictions And Compliance Roadmap For 2027

King, Stubb & Kasiva

Data Breach Response: Legal Steps Every Business Should Take

Mansukhlal Hiralal & Company

Read more about

Privacy
- Data Protection

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

How To Prepare For A Data Protection Compliance Audit

Businesses increasingly rely on customer information, employee records, analytics, cloud platforms and third party technology. As data use grows, organisations need more than a privacy policy. They need evidence showing how personal data is collected, used, stored, shared and protected.

Mansukhlal Hiralal & Company

DPDP Data Breach Notification In India: Timelines, Requirements And Key Compliance Considerations

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.

King, Stubb & Kasiva

Data Retention And Deletion Under The DPDP Act: How Long Can Businesses Retain Personal Data In India?

India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.

King, Stubb & Kasiva

Cross-Border Data Transfers Under India’s DPDP Act: Rules, Restrictions And Compliance Roadmap For 2027

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.

King, Stubb & Kasiva

Data Breach Response: Legal Steps Every Business Should Take

Indian businesses face a complex regulatory landscape when responding to data breaches, requiring coordination between technical containment, legal assessment, and multiple reporting obligations. Understanding the parallel timelines under CERT-In's six-hour cyber incident reporting and the DPDP Act's breach notification requirements is critical for compliance and risk management.

Mansukhlal Hiralal & Company

How Do The DPDP Rules Interact With The IT Act And Intermediary Guidelines?

India’s digital regulatory framework is multi-layered. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) sit alongside the long-standing Information Technology Act, 2000 (“IT Act”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Guidelines” or “IT Rules, 2021”).

King, Stubb & Kasiva

What Happens To Existing SPDI Rules After Full DPDP Enforcement?

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.

King, Stubb & Kasiva

Can Employers Monitor Employee Devices, Emails And Communications Under India’s DPDP Act?

The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services, and cybersecurity platforms.

King, Stubb & Kasiva

How Does The DPDP Act Regulate AI Training And Automated Decision-Making In India

The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.

King, Stubb & Kasiva

WhatsApp's Shift To Usernames: Impersonation Risk, Regulatory Pushback And The DPDP Compliance Test

WhatsApp’s proposed move away from phone-number-based identification towards a username-based system has, within days of being reported, triggered two distinct but connected reactions in India: public concern voiced by industry founders and privacy experts over impersonation and data-sharing risk, and a reported regulatory direction to Meta to pause the feature’s India rollout pending consultations.

S.S. Rana & Co.