Maheshwari & Co. Advocates & Legal Consultants

INTRODUCTION The Insolvency Bankruptcy Code (Amendment) Act, 2026[1] (hereinafter refereed as the “Act”) received the President’s assent on 6th April, 2026 and was subsequently notified by the legislative department of the Ministry of Law and Justice. It has been introduced to further amend the Insolvency and Bankruptcy Code (hereinafter referred to as the “Code”). The Code received the President’s assent on 28th May 2016. It was introduced for reorganization and insolvency resolution of corporate persons, partnership firms and individuals in a time-bound manner for maximization of values of assets of such persons, to promote entrepreneurship, availability of credit and balance the interests of all the stakeholders including alteration on the order of priority of payment of Government dues and to establish an Insolvency and Bankruptcy Board of India (“Board”), and for matters connected therewith or incidental thereto. The provisions of the Code apply to the following in relation to their insolvency, liquidation, voluntary liquidation, or bankruptcy, as the case may be: i. Companies incorporated under the Companies Act, 2013 or under any previous company law. ii. Any other company governed by any special Act for the time being. However, it shall not apply to the company wherein the provisions of this Code are inconsistent with the provisions of such Special Act. iii. Any Limited Liability Partnership incorporated under the Limited Liability Partnership Act, 2008. iv. Such other body incorporated under any law for the time being in force. v. Personal guarantors to corporate debtors vi. Partnership firms and proprietorship firms vii. Individuals, other than personas referred to in clause (v). KEY HIGHLIGHTS OF THE ACT INTRODUCED i. The Act has introduced definitions of “registered valuer” and “service provider” under Section 3 (27A) and (31A) of the Code respectively. ii. Under the Section 3, an explanation has been inserted to clarify that the “security interest” exist only if it creates a right, title, or interest or a claim to a property pursuant to an agreement or arrangement, by the act of two or more parties, and shall not include a security interest created merely by operation of any law for the time being in force. The explanation makes it clear that a security interest exists only if it arises from an agreement or arrangement between two or more parties. It excludes interests created merely by operation of law, such as statutory charges or liens, unless backed by a consensual arrangement. This ensures that “security interest” is confined to contractual or negotiated rights, aligning with the Code’s purpose of protecting consensual creditors rather than elevating statutory claims. iii. Under Section 5 of the Code, definition of “avoidance transaction” and “fraudulent or wrongful trading” has been introduced. Avoidance transactions typically involve transfers or dealings that unfairly strip value from the debtor’s estate before insolvency (e.g., preferential payments, undervalued sales). Fraudulent/wrongful trading refers to directors or managers continuing business when insolvency is inevitable, thereby worsening creditor losses. Earlier, it was difficult to hold parties accountable or initiate avoidance actions effectively. The amendment empowers resolution professionals and liquidators to act decisively. iv. Pursuant to the amendment, the process for admission of applications under sections 7, 9 and 10 have been revised. Clause 4 substitutes Section 7(5) to mandate that the Adjudicating Authority shall pass orders within prescribed timelines, and shall record reasons in writing where such timelines are exceeded. Under the earlier framework, although the Code envisaged a time bound process, in practice the Adjudicating Authority often took months to admit or reject applications, leading to uncertainty, prolonged litigation, and erosion of asset value. There was also wide discretion in considering grounds beyond the statutory requirements, which created scope for inconsistent rulings. It further clarifies that upon satisfaction of the stipulated requirements, the application must either be admitted or rejected, and no extraneous grounds shall be considered. For this purpose, a record of default filed by a financial institution with an information utility shall be deemed sufficient to establish default. Clause 8 substitutes Section 12A to regulate the withdrawal of applications admitted under Sections 7, 9, or 10, and delineates circumstances under which withdrawal shall not be permissible. Clause 9 clarifies that the moratorium shall extend to proceedings initiated or continued by a surety against the corporate debtor under a contract of guarantee. Clause 10 modifies the procedure for appointment of the interim resolution professional. v. Additionally, with respect to claims, cooperation, committee of creditors, avoidance actions, and transfer of guarantor assets. Clause 11 stipulates that the interim resolution professional shall verify claims submitted and, where necessary, determine their value. Under the original framework, the interim resolution professional’s role in verifying claims was not expressly mandated, which often led to disputes over the accuracy and valuation of creditor claims. vi. Clause 12 expands the scope of the obligation to provide assistance, extending it beyond ‘personnel’ to encompass all categories of persons connected with the corporate debtor. In other words, Clause 12 expands the duty of cooperation beyond “personnel” to all persons connected with the corporate debtor because, in practice, critical information and assistance often lie with external advisors, affiliates, or connected parties who were not technically “personnel.” This expansion closes that loophole and guarantees that the resolution professional can access all necessary support to conduct the process effectively. vii. Clause 13 provides that, in the event of liquidation, the Committee of Creditors (“CoC”) shall exercise supervisory authority over the liquidator and shall continue to function in certain ongoing liquidation proceedings. This was needed because once liquidation commenced under the earlier Code, creditor oversight diminished, leaving the liquidator with wide discretion and sometimes resulting in opacity or inefficiency. By giving the CoC supervisory authority, the amendment ensures creditor interests remain protected, enhances transparency, and maintains continuity of oversight even in liquidation. viii. Further, Clause 15 mandates that the resolution professional shall file applications in respect of avoidance transactions, or instances of fraudulent or wrongful trading. Earlier, filing such applications was discretionary, leading to inconsistent enforcement. Further, ambiguity existed whether avoidance or fraudulent trading proceedings had to conclude before resolution or liquidation could proceed. Clause 16 clarifies that such applications shall not impede the conduct of the corporate insolvency resolution process or liquidation proceedings, and that the completion of those processes shall not preclude continuation of such applications. Clause 17 introduces a new Section 28A, enabling the transfer of assets of a personal or corporate guarantor in specified circumstances, subject to requisite approvals and the distribution framework prescribed therein. ix. Clauses 18 to 20 have modified the rules relating to resolution plans and liquidation. Clause 18 introduces a new requirement mandating payment to financial creditors who do not vote in favour of the resolution plan, prescribes a minimum standard for such payment, and affirms that such distribution shall be deemed fair and equitable to those creditors. It further provides that the requirement shall not apply to certain cases already at an advanced stage, and obliges the committee of creditors to record reasons for its approval. Before the amendment of the Code, creditors who did not vote in favour of a resolution plan often received little or no payment, which raised fairness issues and led to litigation over whether such distribution was equitable. x. Clause 19 amends Section 31 to permit staged approval, whereby implementation may be sanctioned first and distribution subsequently in specified cases. It also requires that notice be given to rectify defects prior to rejection, imposes a thirty day timeline for passing orders, safeguards licenses, permits and similar grants from suspension or termination during their subsisting period where obligations are duly met, and provides for extinguishment of prior claims against the corporate debtor and its assets upon approval of the resolution plan, subject to the explanations set forth therein. This amendment has been introduced because under the earlier Code, approval was treated as a single, all or nothing stage, which often led to delays if defects were found or if distribution arrangements were complex. The amendment has introduced streamline approvals, protect business viability, reduce delays, and ensure finality of claims, thereby reinforcing both creditor confidence and debtor rehabilitation. xi. Clause 20 amends Section 33 to expand the framework governing liquidation orders, authorizes restoration of the corporate insolvency resolution process in certain circumstances prior to the passing of a liquidation order, stipulates that such restoration may occur only once, and prescribes timelines for the passing of liquidation orders. Before this amendment, once liquidation was ordered, there was no statutory mechanism to restore the corporate insolvency resolution process, even if circumstances changed or a viable resolution plan emerged late in the process. This often led to premature liquidation, loss of asset value, and reduced recovery for creditors. xii. Clause 21 amends Section 34 to provide that, upon an order of liquidation, the Adjudicating Authority shall refer the matter to the Board for recommendation of insolvency professional to be appointed as liquidator. It further stipulates that the resolution professional engaged in the corporate insolvency resolution process shall neither be appointed nor replaced as liquidator for the same corporate debtor. This has been done because before the amendment, the resolution professional who managed the corporate insolvency resolution process could also be appointed as liquidator for the same corporate debtor, which raised concerns about conflict of interest and continuity of control. Further, the amendment has empowered the CoC to replace the liquidator by a vote of sixty six per (66%) cent, subject to prescribed conditions. xiii. Under the Code, before amendment, once liquidation was ordered, the liquidator had wide discretion with limited statutory obligations to keep claims updated or pursue avoidance and wrongful trading actions. This often led to disputes, incomplete recovery, and reduced confidence among creditors. Clause 23 amends Section 35 to require the liquidator to maintain an updated list of claims, authorizes the liquidator to continue or institute proceedings in respect of avoidance transactions or fraudulent or wrongful trading, and provides that the committee of creditors shall supervise the liquidation process. xiv. Clause 24 widens the scope of Section 36(3)(f) to encompass proceedings relating to avoidance transactions, fraudulent or wrongful trading, and matters under Section 47. Under the earlier Code, Section 36(3)(f) referred more narrowly to assets subject to certain proceedings, which left ambiguity about whether the liquidator could exercise control when such actions were pending or required. This gap often led to disputes over jurisdiction and hindered recovery efforts. xv. Clause 25 omits Sections 38 to 42. Clauses 26 to 30 revise the look back provisions and related language in Sections 43, 46, 47, 49 and 50. The need for this change arose because the earlier drafting left interpretational gaps about the period within which such transactions could be challenged and the precise scope of creditor or liquidator action. xvi. Clause 28 substitutes Section 47 to permit creditors, members, or partners to apply in cases where transactions or trading have occurred but were not reported by the liquidator or resolution professional and further provides for disciplinary action where such non reporting is established since the Code stated that the responsibility for reporting avoidance transactions or fraudulent and wrongful trading rested primarily with the resolution professional or liquidator, but there was no statutory recourse if they failed to discharge this duty. xvii. Clauses 31 and 32 amend Sections 52 and 53 to regulate realization of security interests, provide for deemed relinquishment where intimation is not given within fourteen days, require agreement among secured creditors in specified cases, mandate deduction and transfer of certain costs and dues, clarify treatment of part secured debts, and prescribe distribution of government dues. Clause 33 amends Section 54 to require that an application for liquidation and dissolution be filed within one hundred and eighty days, subject to limited extension. It further provides that the committee of creditors shall decide upon pending avoidance or fraudulent transaction proceedings, or pending suits, prior to dissolution; authorizes dissolution upon such decision in certain cases; and mandates that the Adjudicating Authority shall pass dissolution orders within thirty day. xviii. Clause 34 to Clause 38 amend Sections 54A, 54C, 54F, 54L and 54N, inter alia, by lowering certain approval thresholds from sixty six per cent to fifty one (51%) per cent and effecting related procedural modifications. Previously, the Code required a two thirds majority (66%) of the committee of creditors for certain key decisions in fast track or pre pack insolvency processes. This high threshold often made it difficult to secure approvals, especially in cases where creditor participation was fragmented or where a small minority could block progress. xix. Clause 39 omits Chapter IV of Part II. Clause 40 inserts new Sections 58A to 58K, which collectively establish the framework for a creditor initiated insolvency resolution process. These provisions specify the categories of corporate debtors eligible for such process, identify the persons entitled to initiate it, prescribe the requisite approvals, and recognize the right of the corporate debtor to object. They further delineate the period for completion, the duties and powers of the resolution professional, and provide that the board of directors or partners shall continue to manage the affairs of the corporate debtor subject to the oversight of the resolution professional. xx. The provisions also set out the moratorium rules, conditions for conversion into an ordinary corporate insolvency resolution process, circumstances permitting withdrawal of the public announcement, requirements for approval of resolution plans, and the application of other provisions of the Code to this Chapter with specified modifications. xxi. Clause 49 omits Section 74, and Clause 50 omits Section 76. Section 74 addressed punishment for contravention of moratorium provisions, prescribing imprisonment or fine for officers of the corporate debtor who knowingly violated the moratorium. Section 76 dealt with punishment for fraudulent or malicious initiation of proceedings, imposing liability on persons who filed insolvency applications with dishonest intent. These provisions were considered duplicative or overlapping with other penal and enforcement mechanisms already strengthened in the Amendment Act (such as the new Section 164A on transactions defrauding creditors, and Section 183A on frivolous or vexatious proceedings). Their omission was intended to streamline the penal framework, avoid redundancy, and consolidate enforcement under more precise and updated provisions. xxii. Clause 51 inserts a new sub section (4) in Section 96, providing that the moratorium under Section 96 shall not apply where an application is filed for initiation of an insolvency resolution process in respect of a personal guarantor to a corporate debtor. xxiii. Clause 52 amends Section 99 by substituting the period of ‘ten days’ with ‘twenty one days’ in sub section (1), and by replacing the words ‘or the creditor’ with ‘and the creditor’ in sub section (10). xxiv. Clause 53 amends Section 106 to stipulate that, where no repayment plan is submitted, the resolution professional shall report accordingly and the Adjudicating Authority shall terminate the insolvency resolution process, following which the debtor or the creditors may apply for bankruptcy. It further inserts a special provision governing meetings where the repayment plan relates to a personal guarantor to a corporate debtor. xxv. Clauses 54 and 55 make consequential amendments to Sections 121 and 124. Section 121 deals with the procedure for filing bankruptcy applications. The amendment ensures consistency with the revised framework for insolvency resolution and liquidation, particularly where new timelines, duties of resolution professionals, and creditor rights have been introduced, whereas Section 124 relates to the discharge order in bankruptcy. The consequential amendment harmonizes this section with the new provisions on extinguishment of claims, treatment of guarantor assets, and avoidance proceedings, so that discharge orders do not conflict with ongoing or parallel processes. xxvi. Clause 56 inserts a new Section 164A dealing with transactions defrauding creditors, empowering the Adjudicating Authority to restore the position as it existed prior to such transactions and to protect victims, subject to the safeguards prescribed therein. xxvii. Clause 58 inserts a new Section 183A, authorizing the imposition of penalty in cases of frivolous or vexatious proceedings under this Part. It has been introduced to deter the misuse of the insolvency framework and to preserve the integrity of proceedings. Before the amendment, there was no specific statutory penalty for parties initiating frivolous or vexatious applications, which often led to unnecessary litigation, delay, and increased costs for stakeholder. xxviii. Clause 72 amends Section 242 to insert a new sub section (1A), conferring upon the Central Government the power to remove difficulties arising in giving effect to the provisions of the Amendment Act, for a period not exceeding five years from its commencement. Earlier, the Central Government issued orders for resolving implementation issues but limited that power to a period of two years from the commencement of the Code. xxix. Following Section 240A, new Sections 240B and 240C are inserted. Section 240B empowers the Central Government to establish an electronic portal for the conduct of insolvency and bankruptcy procedures under the Code. Section 240C authorizes the Central Government to prescribe the manner and conditions governing cross border insolvency proceedings, including recognition, relief, judicial cooperation, assistance, and coordination, with enabling power to adapt provisions of the Code or the Companies Act, 2013, as may be required. CONCLUSION The Insolvency and Bankruptcy Code (Amendment) Act, 2026 introduces a wide ranging set of reforms designed to strengthen the efficiency, transparency, and fairness of insolvency and liquidation proceedings in India. By revising admission and withdrawal procedures, expanding the supervisory role of creditors, clarifying treatment of guarantor assets, and streamlining resolution and liquidation frameworks, the Act seeks to ensure time bound outcomes and equitable distribution among stakeholders. The amendments also modernize the Code by lowering approval thresholds, introducing creditor initiated resolution processes, empowering the Central Government to regulate group and cross border insolvencies, and enabling electronic platforms for procedural management. Provisions addressing fraudulent transactions, frivolous proceedings, and government dues further reinforce accountability and creditor protection. Taken together, these changes reflect a deliberate legislative effort to balance creditor rights with debtor protections, enhance institutional oversight, and align India’s insolvency regime with evolving global standards. The Act thus represents a significant step toward a more robust, predictable, and internationally harmonized insolvency framework. Authors: Ms. Jyotsna Chaturvedi, Head – Corporate Practice and Navya Saxena, Associate [1] https://ibbi.gov.in/legal-framework/act

India's renewable energy sector operates at the intersection of two competing policy objectives: accelerating capacity deployment through competitive markets and protecting investor returns through regulatory mechanisms. The interplay between reverse auctions, preferential tariffs, DISCOM procurement authority, and competition law principles reveals fundamental tensions in market design that have forced regulatory recalibration. This article examines how auction mechanisms including the transition from reverse auctions to closed bidding with bucket-filling, preferential tariff regimes as ceiling prices, and DISCOM monopsony power collectively shape PPA allocation and pricing, while raising distinct competition law risks under the Competition Act, 2002. This article examines how auction mechanisms (including the transition from reverse auctions to closed bidding with bucket-filling), preferential tariff regimes as ceiling prices, and DISCOM monopsony power collectively shape PPA allocation and pricing, while raising distinct competition law risks under the Competition Act, 2002. The Evolution of Auction Design: From Reverse Auctions to Closed Bidding Until 2022, India's renewable energy procurement relied heavily on electronic reverse auctions (e-RA), where bidders matched the lowest tariff (L1) discovered in sequential rounds. The Ministry of New and Renewable Energy (MNRE) explicitly halted e-reverse auctions for wind energy in July 2022, citing "unhealthy competition" and artificially depressed tariffs that jeopardized project financial viability. This decision reflected industry concerns that aggressive competitive pressure was forcing developers to quote unsustainably low bids, creating moral hazard for project execution and long-term grid stability. The government's rationale centered on two dynamics: first, the bucket-filling methodology under reverse auctions required all participants to match the lowest discovered tariff or face retendering and project cancellations; second, this design created downward price pressure divorced from underlying project economics, as developers bid strategically to capture market share rather than price actual costs. The SECI's 2.5 GW round-the-clock (RTC) tender exemplified this risk, when Hindustan Power quoted Rs. 3.01/kWh for 250 MW and other bidders declined to match, the entire 2,500 MW tender was cancelled rather than using the bucket-filling mechanism to award remaining capacity at higher (but still competitive) bids. The Transition to Closed Bidding with Bucket-Filling Beginning in 2023, the Ministry of Power's revised Guidelines for Tariff Based Competitive Bidding Process shifted renewable energy procurement toward closed bidding with bucket-filling allocation. Under this model, various strategies were used including: Single-round bidding: Procurers invite sealed bids for total capacity without subsequent rounds. Bucket-filling allocation: Bids are ranked as L1, L2, L3, etc. The L1 bidder receives its full quoted capacity at its quoted price. L2 then receives its capacity at its quoted price, and so on until total tender capacity is allocated. 2% band allocation (recent variant): In certain configurations, only bidders quoting within L1 + 2% receive capacity, addressing concerns that excessive price variation compromises grid reliability and financial certainty. This design preserves competition as multiple bidders compete to set their own awarded quantities, while avoiding the artificial tariff compression of reverse auctions. Developers quote based on project economics rather than matching-game dynamics, yielding more realistic discovered tariffs reflecting true cost of capital and internal rates of return. The Ministry noted that closed bidding increases tender participation and reduces bid cancellations. III. Regulatory Adoption and The Dual Regime: Preferential Tariff vs. Competitive Bidding Section 63 of the Electricity Act, 2003 mandates that the Appropriate Commission (CERC or SERC) adopt tariffs discovered through "transparent process of bidding in accordance with the guidelines issued by the Central Government." The procurer must file for tariff adoption within 15 days of tariff discovery, and the Commission must examine the entire bidding process to confirm compliance with notified guidelines before adoption. This creates a two-stage filter: firstly, the procurer (SECI, NTPC, DISCOM, or intermediary) conducts transparent bidding and secondly, the regulator confirms procedural compliance. Neither stage involves discretionary re-evaluation of discovered tariff levels. The requirement that DISCOMs and REIAs file for tariff adoption under Section 63, with CERC/SERC examination of entire bidding process compliance, creates a regulatory gate. However, CERC and SERCs have consistently adopted tariffs discovered through transparent bidding without re-evaluating tariff levels. This hands-off approach reflects a policy choice to preserve bidding authority at the procurer level and avoid regulatory repricing. The gate is procedural and not substantive. The Ministry of Power guidelines mandate that procurers publicly disclose successful bidders, quoted tariffs, and tariff breakup for at least 30 days. This requirement addresses information asymmetry and enables external audit of bidding outcomes. However, disclosure does not prevent post-bid renegotiation or selective enforcement of PPA terms, particularly where bilateral bargaining resumes after regulatory approval. The Tariff Policy 2016 introduced a hierarchical procurement framework. States are directed to "endeavor to procure power from renewable energy sources through competitive bidding to keep the tariff low." However, a maximum of 35% of a state's installed generation capacity can be sourced from SERC-determined preferential tariffs. Preferential tariffs, set by the Appropriate Commission through formal tariff determination proceedings (Section 62, Electricity Act, 2003), are technology-specific benchmarks designed to ensure cost recovery while attracting investment. The Central Electricity Regulatory Commission's 2024 Renewable Energy Tariff Regulations distinguish between: Generic tariff: Applicable to a category of projects (e.g., Small Hydro, Biomass, Waste-to-Energy) with standardized assumptions about capital cost, capacity utilization, and operating expenses. Generic tariffs serve two functions: they provide revenue certainty for smaller or remote projects unsuited to competitive bidding, and they act as regulatory ceiling prices in competitive bidding, ensuring discovered tariffs do not fall below cost-recovery thresholds that would undermine project bankability. Project-specific tariff: Applied when a project's characteristics such as site-specific renewable resource, land costs, grid proximity etc. materially differ from normative assumptions, justified by applicants through detailed engineering and financial analysis.   The State Electricity Regulatory Commissions explicitly use preferential tariffs as bidding ceilings. Tamil Nadu's 2020 Order approved reverse bidding with preferential tariff as the ceiling price, preventing DISCOMs from extracting prices so low that they render projects unviable. Similarly, the Andhra Pradesh ERC set a Rs. 3.09/kWh ceiling for PM-KUSUM solar projects, acknowledging that while competitive bidding had generated lower weighted-average tariffs (Rs. 3.17/kWh), regulatory certainty required an upper bound to protect against post-bid renegotiation risk and developer financial stress. This ceiling mechanism reflects a core competition law concern: without price floors, monopsony buyers (DISCOMs) could exploit their concentrated demand to extract prices below competitive cost-recovery levels, deterring market entry and investment. The preferential tariff regime, though ostensibly a fixed-price support mechanism, also functions as a competitive bidding guardrail. DISCOM Monopsony Power and PPA Negotiation Dynamics Distribution licensees (DISCOMs) are the primary obligated buyers for renewable energy procurement, driven by Renewable Purchase Obligation (RPO) mandates under Section 86(1)(e) of the Electricity Act, 2003. Each state SERC sets RPO targets (non-solar and solar percentages) that DISCOMs must meet annually. This creates a procurement obligation, but considerable discretion in sourcing method and timing. DISCOMs, as monopsony buyers, exercise concentrated demand power. In many states, particularly those with weaker per-capita renewable resource endowment or smaller DISCOM service territories, a single DISCOM may represent 80% to 100% of near-term renewable demand. This structural imbalance creates bilateral negotiation asymmetry where developers must secure DISCOM offtake either directly or through intermediaries like SECI or NTPC. However, DISCOMs can delay or renegotiate post award. As a result, a critical market friction has emerged where DISCOMs express apprehension in signing Power Sale Agreements (PSAs) for awarded bids with distant connectivity timelines. As of September 2025, 43,942 MW of Letters of Award (LoAs) lack corresponding PSAs with end procurers, representing a 41% gap between awarded capacity and committed offtake. This gap signals DISCOM hesitation to lock in multi-year fixed obligations under uncertain supply conditions. The government's 2025 decision to scrap centralized renewable energy pricing pools and allow direct tariff negotiation between developers and buyers reflects this friction. Buyers had been reluctant to commit to pooled tariffs locked months or years before supply commencement, fearing tariff obsolescence if equipment costs or interest rates shifted. By removing centralized pooling, the government aimed to restore bilateral price discovery, allowing parties to negotiate terms reflecting real-time market conditions. Yet this shift reintroduces bilateral bargaining, where DISCOM leverage becomes pronounced. Smaller or younger developers face pressure to accept unfavorable terms such as low tariffs or flexible offtake to secure any LoA while larger developers with diversified portfolios extract better terms. This creates segmentation in tariff outcomes not predicted by competitive bidding theory. Competition Law Implications of DISCOM Market Power The Competition Commission of India's framework for renewable energy identifies several pathways through which DISCOM monopsony power can trigger anti-competitive concerns: Exclusionary contracts: PPAs requiring a DISCOM to source all or majority of renewable needs from a single developer foreclose rivals, especially in states with limited procurement windows. Minimum offtake clauses: Contracts requiring buyers to purchase minimum quantities at fixed tariffs, even as demand varies, can lock out other suppliers and reduce switching incentives. Discriminatory treatment in negotiations: If a DISCOM systematically offers unfavorable PPA terms to certain developers while accommodating others, and this reflects developer characteristics unrelated to project efficiency (e.g., developer size, location, affiliation with procurer group), it may constitute abuse of buyer dominance. Post-bid renegotiation: Serial requests by DISCOMs to reduce tariffs after LoA issuance (as observed in PM-KUSUM procurement), unless applied uniformly, signal anti-competitive rent extraction rather than efficiency-driven repricing. The CCI has shown willingness to scrutinize such conduct. The renewable energy sector's competitive risks lie less in developer collusion and more in procurer-side abuse where concentrated DISCOM demand is leveraged to suppress prices or impose onerous non-price terms. Intermediary Procurement and Risk Allocation The Solar Energy Corporation of India (SECI), NTPC Limited, NHPC Limited, and SJVN Limited act as Renewable Energy Implementing Agencies (REIAs) conducting tenders on behalf of end procurers (DISCOMs and open access consumers). REIAs issue tenders, conduct bidding, sign Power Purchase Agreements (PPAs) with winning developers, and simultaneously negotiate Power Sale Agreements (PSAs) with DISCOMs for corresponding capacity. This intermediary structure theoretically decouples developer risk from individual DISCOM credit quality as developers sign PPAs with REIAs who are generally stronger financially and backed by sovereign guarantee and not directly with potentially distressed DISCOMs. However, REIAs maintain back-to-back PPA-PSA structure; they generally do not execute PPAs until PSAs are committed. This creates a cascading constraint where if DISCOMs delay or refuse PSA signatures, LoA issuance to developers stalls, and developers face indefinite uncertainty. As of December 2025, government press statements indicate that REIAs are undertaking due diligence on unsigned PSAs, categorizing LoAs by likelihood of PSA execution and considering selective cancellation of awards with "minimal or no prospects" of PSA signature. This triage approach, while pragmatic, shifts risk back to developers awaiting PSA clarity and potentially creates incentive for developers to accept lower tariffs to prioritize PSA execution. VII. Auction Design and Competition Law: Structural Risks Closed bidding preserves collusion risks present in all auctions. Competitors can communicate tariff expectations, agree to bid in defined bands, or employ coordination mechanisms through shared OEMs, advisors, or financing partners acting as "hub-and-spoke" information conduits. The MNRE's removal of e-reverse auction complexity by eliminating sequential matching dynamics, may actually reduce apparent collusion opportunities, but collusion in sealed-bid single-round auctions remains viable if coordination mechanisms are disciplined. Joint venture or consortium bids reduce project risk and can reflect genuine efficiency as they are more technology complementary, have increased risk-pooling as well as capital access. However, they become problematic if used as cover to eliminate competition between otherwise independent bidders. The CCI focuses on whether consortium arrangements reflect substantive efficiency or merely provide coordination camouflage. Wind and solar developers depend on turbine manufacturers and module suppliers. Exclusive supply arrangements between developers and OEMs, or preferred-partner agreements, can foreclose rival developers' access to critical inputs if the OEM holds dominant market position in the region. Similarly, bundled O&M contracts tied to equipment sales limit post-sales competition in maintenance and spare parts. VIII. Policy Tensions and Remaining Ambiguities Preferential Tariff vs. Competitive Tariff Hierarchy: The Tariff Policy's 35% preferential tariff cap theoretically limits DISCOM reliance on fixed-rate renewable contracts. However, states interpret this cap variably. Some apply it only to solar; others aggregate all technologies. Regulatory inconsistency creates procurement unpredictability. Reverse Auction Discontinuation and Entry Effects: The government's shift away from e-reverse auctions was justified on grounds of project viability, but it may also reduce competitive pressure on tariff discovery. Closed bidding with bucket-filling produces price outcomes determined by each bidder's cost estimate, not by sequential matching. This could yield higher equilibrium tariffs if bid competition is weaker under closed structures. PSA Execution Timelines and Stranded Risk: The growing gap between LoA and PSA issuance signals that capacity allocation is outpacing offtake commitment. Developers awarded capacity with multi-year delays to grid connectivity face stranded investment risk. Regulators have proposed phased LoA cancellation, but this creates retroactive uncertainty. Conclusion India's renewable energy sector exemplifies a market in regulatory transition. Auction design has migrated from reverse auctions toward closed bidding to protect project economics; preferential tariffs serve as regulatory ceilings in competitive bidding; and DISCOM monopsony power operates through post-award negotiation rather than formal market power abuse. Competition law risks are real but asymmetric: developer collusion in auctions is prosecutable but less common; DISCOM leverage in PPA negotiation is structural and harder to police without cartelization evidence. The interplay between auction design, tariff ceilings, and DISCOM procurement authority reveals no equilibrium yet. Government efforts to unlock stranded capacity through direct negotiation and removal of centralized pooling shift risk allocation toward developers, potentially offsetting competitive bidding gains. Regulators and the CCI will need to monitor whether this rebalancing produces efficiency or merely shifts monopsony extraction from tariff suppression to non-price PPA terms. Ultimately, the sector's maturation depends less on auction mechanics than on DISCOM financial health and credible RPO enforcement. If DISCOMs remain cash-constrained and RPO compliance is unenforced, no auction design or preferential tariff regime will ensure sustained renewable capacity growth. Authored by:  Mr. Akhand Pratap Singh Chauhan, Partner References: https://www.pv-tech.org/india-government-stops-e-reverse-auctions-following-competition-fears/ https://windinsider.com/2022/07/18/mnre-takes-in-principle-decision-to-stop-e-reverse-auction-of-wind-energy-projects/ https://ieefa.org/sites/default/files/2023-03/Renewable Energy Tenders Issuance in India not in tandem goverment targets-Feb2023.pdf https://www.argus-p.com/updates/updates/ministry-of-power-notifies-guidelines-for-tariff-based-bidding-to-procure-power-from-grid-connected-hybrid-projects/ https://cercind.gov.in/2025/orders/254-AT-2025.pdf https://cercind.gov.in/2025/orders/223-AT-2024.pdf https://ecopurus.com/blogs/what-is-the-electricity-act-2003-key-provisions-for-renewable-energy-in-india/ https://india-re-navigator.com/public/tender_uploads/utility_policy-5e8ad15f58128.pdf https://www.reconnectenergy.com/analysis-of-amendments-in-national-tariff-policy/ https://cercind.gov.in/2024/draft_reg/RE-Tariff-Regulations-EM.pdf https://mercomindia.com/aperc-approves-1-16-gw-solar-procurement-with-₹3-09-kwh-tariff-cap https://www.tnerc.tn.gov.in/PressRelease/files/PR-120320211457Eng.pdf https://www.sunshellpower.com/renewable-power-purchase-obligation/ https://www.peda.gov.in/assets/media/rpo/1.pdf https://www.pspcl.in/media/pdf/10009/format-rpo-protocol-110119.pdf https://www.pib.gov.in/PressReleasePage.aspx?PRID=2186235 https://www.eqmagpro.com/india-ends-centralized-renewable-tariff-pools-to-unlock-stalled-green-energy-projects-eq/ https://www.reconnectenergy.com/india-scraps-central-renewable-energy-pricing-pools-a-push-for-market-linked-power-deals/ https://ksandk.com/tax/competition-law-risks-for-renewable-energy-firms-india/ https://sansad.in/getFile/loksabhaquestions/annex/186/AU2762_WuQarf.pdf

In India, the framework for insolvency and bankruptcy resolution is primarily governed by the Insolvency and Bankruptcy Code, 2016 (“the Code” or “IBC”). The said Code is a comprehensive legislation aimed at consolidating and amending existing laws relating to insolvency resolution of companies, limited liability entities, partnerships, and individuals. The Code introduced a paradigm shift from a debtor-in-possession to a creditor-in-control model. Its objective is to ensure timely resolution of distressed assets, promote entrepreneurship, and balance the interests of all stakeholders. It provides a time bound resolution process wherein the management of the debtor company is transferred to an insolvency professional under the supervision of the National Company Law Tribunal (“NCLT”). However, as Indian corporations increasingly expand across borders and foreign investors acquire stakes in Indian entities, the challenge of dealing with cross border insolvency, where the debtor or its assets and creditors are situated in multiple jurisdictions, has become increasingly significant. Indian Courts, on several occasions, declined to recognize foreign insolvency proceedings due to the absence of a formal cross border insolvency framework. For instance in the case of Mahmood Hussain Khan v. Madam Canisia Ceizar[1], the Telangana High Court acknowledged the existence of foreign insolvency proceedings but refrained from granting relief, highlighting the lack of a statutory mechanism for such recognition. The Hon’ble Court recognized aspects of Swiss insolvency proceedings concerning the sale of Indian properties. It was held that such foreign proceedings could be given effect in India for specific matters, including property sales, thereby providing a legal basis for cross border cooperation. Similarly, in October 2024, the Calcutta High Court in Glas Trust Corporation v. BYJU Raveendran & Ors.[2], the Hon’ble Court held that without a comprehensive cross-border insolvency framework Indian courts do not recognize or enforce moratorium orders to stay ongoing countries, such as the US, and thus, are not obligated to stay ongoing suits due to such foreign proceedings. These decisions illustrate the cautious approach adopted by Indian courts in the absence of a statutory mechanism, highlighting the need for a comprehensive legal framework. At present, India does not have a fully developed legal framework to address cross border insolvency issues comprehensively. Nevertheless, Section 234 and 235 of the IBC provide a limited mechanism for international cooperation. Section 234 empowers the Central Government to enter into bilateral agreements with foreign countries to enforce the provisions of the IBC in relation to assets or debtors situated outside India. Section 235 allows the resolution professional or liquidator to make an application to the Hon’ble NCLT seeking a letter of request to a foreign court or authority for evidence taking or action relating to the assets of the debtor located abroad. Despite their inclusion, these provisions remain largely unimplemented due to the absence of bilateral treaties or reciprocal arrangements. Consequently, Indian courts rely on judicial comity and cooperation in cross border cases. Notwithstanding these limitations, Indian courts and foreign jurisdictions have begun to recognize cross border insolvency proceedings. In the landmark case of Jet Airways (India) Limited (Offshore Regional Hub) v. State Bank of India & Anr.[3], the Hon’ble National Company Law Appellate Tribunal answered whether separate proceeding(s) in corporate insolvency resolution process against common debtor can proceed in two different countries, one having no territorial jurisdiction over the other.  The Hon’ble tribunal recognized parallel insolvency proceedings in the Netherlands and permitted the Dutch administrator to participate in the Committee of Creditor’s meetings as an observer. This decision, though not rooted in explicit statutory authority, marked a significant step towards acknowledging cross border cooperation. Another significant milestone in India’s cross border insolvency jurisprudence was when the US Bankruptcy Code for the District of Delaware recognized the insolvency proceedings of SBI v. SEL Manufacturing Company Limited[4] pending before the NCLT, Chandigarh Bench, as a foreign main proceeding under Section 1502(40) of the US Bankruptcy Code, marking the first recognition of the IBC in the US. The Hon’ble Court held that recognition did not violate US public policy and granted the foreign representatives and foreign debtor reliefs under Section 1520, protecting assets and creditor’s interest. This recognition facilitates cross border asset recovery, particularly for Indian banks’s NPAs, while ensuring relief aligns with US bankruptcy principles. In a recent case of the Hon’ble Delhi High Court on Toshiaki Aiba as Bankruptcy Trustee v. Vipan Kumar Sharma[5], the High Court has considered India’s Jurisdiction to enforce foreign bankruptcy and insolvency orders. The Hon’ble Court held that “it is contended on behalf of the defendants that Japan is not a reciprocating territory in respect of Section 44A of the CPC, so there cannot be any proceedings for execution of the decree of a Japanese Court. 18. In the opinion of this Court and as stated above, by the way of the present suit, the plaintiff is not seeking execution of the decree of the Japanese Court. The suit has been filed to administer the suit properties of the bankrupt defendant no. 1 towards realization of monies. Therefore, Section 44A of the CPC would have no application. In this regard, reference may be made to Sections 13 and 14 of the CPC, which deal with foreign judgments” Further, In Re Compuage Infocom Ltd.[6], the Singapore High Court has recognized the Corporate Insolvency Resolution Process (“CIRP”) of an Indian company under the IBC as a foreign main proceeding. The Hon’ble Court acknowledged the Indian Resolution Professional as a foreign representative and treated the NCLT as the foreign court, allowing the Indian insolvency proceedings to be given effect in Singapore. This landmark decision illustrates that Indian insolvency proceedings can obtain recognition abroad, facilitating cross border administration of assets and providing a framework for cooperation between jurisdictions in insolvency matters. India’s globalization and the growing participation of creditors from across the globe in Indian insolvency cases highlights the need of cross border insolvency framework. Hence, taking in account of such matters, the Insolvency Law Committee (“Committee”), on October 2018, recommended the adoption of a dedicated framework based on the UNCITRAL Model Law (“Model Law”) on Cross Border Insolvency, 1997[7], known as Draft Law on cross border insolvency[8]. DRAFT LAW The Committee, in its report, recommended adoption of the Model Law with certain modifications. The proposed draft is also called as “draft Part Z” (hereinafter referred to as “Draft Law” or “Part Z”). It is pertinent to note that certain amendments in the provisions of the IBC are necessary to include draft Part Z in the Code. For instance, section 234 and 235 may be amended to exclude corporate debtors; Section 60 may be amended to allow transfer of domestic proceedings to the Adjudicating Authority notified under the draft Part Z in relevant matters, the inspection and investigating powers of the Insolvency and Bankruptcy Board of India (hereinafter referred to as “IBBI”) may need to be amended to include a suitable mechanism for investigation and adjudication of penalties against foreign representatives, section 196 may be amended to include regulation of foreign representatives within the functions of the IBBI; and additional rule and regulation making power will need to be incorporated in sections 239 and 240, respectively; the 11th Schedule may be amended based on the decision to amend 15 section 375(3)(b) of the Companies Act (hereinafter referred to as “2013 Act”), lastly, preamble to the Code may be amended to reflect inclusion of cross-border insolvency under the Code. Suitable amendments to subordinate legislations under the Code may also be required. OBJECTIVES OF DRAFT PART Z The objectives specified in the report provided by the Committee mirror the core principles of the Model Law but are contextualized for India’s institutional environment. Recognition of Foreign Insolvency Proceedings – To enable foreign court orders or foreign insolvency administrators to seek recognition in India. Relief and Assistance – To grant domestic relief on recognition, for instance moratorium, asset control to facilitate coordination Access and Participation – To allow foreign representatives and creditors direct access, subject to controls, to Indian courts and proceedings. Cooperation & Communication – To promote direct or guided collaboration between Indian courts, foreign courts, and insolvency professionals. Coordination of Concurrent Proceedings – To ensure that insolvency matters are harmonized to avoid conflicts, duplication, and inequitable outcomes. Protection of Domestic Public Policy – To preserve a “public policy” exception to deny recognition or relief that is manifestly contrary to Indian policy. CONCLUSION The Insolvency and Bankruptcy Code, 2016 (“IBC”) has transformed India’s insolvency landscape, introducing a time-bound, creditor-driven framework to resolve corporate, partnership, and individual insolvencies. By transferring control from debtors to insolvency professionals under the supervision of the NCLT, the Code ensures efficient management of distressed assets while balancing stakeholder interests. With the globalization of Indian businesses and the involvement of foreign creditors, cross-border insolvency has emerged as a critical challenge. Indian courts have historically taken a cautious approach, sometimes recognizing foreign proceedings partially, as in Mahmood Hussain Khan v. Madam Canisia Ceizar, or declining recognition altogether, as seen in Glas Trust Corporation v. BYJU Raveendran & Ors. However, positive developments as seen in landmark cases like Jet Airways v. State Bank of India, facilitating parallel proceedings in the Netherlands, and SBI v. SEL Manufacturing Co. Ltd. which included recognition of IBC under the U.S. Bankruptcy Code, demonstrate growing judicial willingness to facilitate cross-border cooperation and asset recovery. Cases like Toshiaki Aiba v. Vipan Kumar Sharma and Re Compuage Infocom Ltd. further underscore that Indian insolvency proceedings are increasingly recognized abroad. To address the absence of a formal cross-border framework, the Insolvency Law Committee recommended the adoption of a dedicated regime based on the UNCITRAL Model Law (“Draft Part Z”). Its objectives include recognition of foreign proceedings, provision of relief such as moratoriums, participation rights for foreign representatives, coordination of concurrent proceedings, and protection of domestic public policy. Once operationalized, Draft Part Z promises to align India with international standards, facilitate efficient cross-border asset recovery, and strengthen India as a predictable jurisdiction for global commerce. In essence, while challenges remain, the combination of judicial developments and a prospective statutory framework positions India on a path toward a robust and globally compatible cross-border insolvency regime. [1] CCCA No.47 of 2021 [2] Civil Appeal No. 9986 of 2024 [3] Company Appeal (AT) (Insolvency) No. 707 of 2019 [4] CP (IB) No. 114/Chd/Pb/2017, National Company Law Tribunal, Chandigarh. [5] 2022 SCC OnLine Del 1260 [6] (2025) SGHC 49 [7] https://uncitral.un.org/sites/uncitral.un.org/files/media-documents/uncitral/en/insolvency-e.pdf [8] https://ibbi.gov.in/uploads/resources/Report_on_Cross%20Border_Insolvency.pdf Authored by Ms. Jyotsna Chaturvedi, Head – Corporate Practice and Ms. Navya Saxena, Associate

Introduction The Digital Personal Data Protection Act, 2023 (DPDP Act) represents India’s comprehensive response to the pressing need for digital privacy protection in an increasingly data-driven economy. Enacted on 11 August 2023 following Parliamentary approval, the DPDP Act establishes a citizen-centric legal framework that balances individual privacy rights with the legitimate need for lawful data processing. The subsequent notification of the Digital Personal Data Protection Rules, 2025 on 14 November 2025 marks the transition from legislative intent to operational reality, providing the practical implementation framework that organizations must now navigate.[1] This article examines the DPDP Act’s core architecture, traces its evolutionary path from enactment to current stage, and provides clarity on the compliance obligations and timelines that organizations face in 2025 and beyond. Legislative Framework, Evolution, and Core Principles Historical Evolution: From IT Act to DPDP Act[2] India’s journey toward comprehensive data protection spans nearly two decades. The Information Technology Act, 2000 served as the foundational digital law but provided scant privacy protection, with only Sections 43A and 72A addressing sensitive personal data security. This inadequacy became increasingly evident as digital transactions and data misuse escalated. The constitutional turning point arrived with the Supreme Court’s landmark 2017 judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, which recognized privacy as a fundamental right under Article 21 of the Constitution. This decision provided constitutional grounding for comprehensive data protection legislation and established the proportionality test for any restrictions on privacy rights. Following this constitutional affirmation, the Government appointed the Justice B.N. Srikrishna Committee (2017), which recommended a rights-based framework emphasizing responsibility, consent, and data localization. This committee’s recommendations influenced the development of the Personal Data Protection (PDP) Bill, 2019. However, the PDP Bill faced substantial parliamentary scrutiny; the Joint Parliamentary Committee proposed 81 amendments, citing concerns over robust data localization requirements and expansive government powers under Section 35. The PDP Bill was consequently withdrawn in 2022. The Government then introduced the Digital Personal Data Protection (DPDP) Bill, 2022, which adopted a more balanced and business-friendly approach while maintaining stringent privacy protection. This revised approach reflected stakeholder feedback emphasizing practical compliance and innovation enablement. The DPDP Bill was finally enacted as the Digital Personal Data Protection Act, 2023 on 11 August 2023, establishing India’s modern data protection regime. Seven Foundational Principles[3] The DPDP Act rests on seven core principles that govern all data processing activities: Consent and Transparency: Data processing requires affirmative, informed consent; processing purposes must be transparent. Purpose Limitation: Personal data shall be used only for the specific purposes for which consent was obtained. Data Minimisation: Only necessary personal data shall be collected and processed. Accuracy: Data fiduciaries must ensure data is accurate and complete, particularly where processing will affect the individual. Storage Limitation: Personal data shall be retained only for the period necessary to serve its purpose. Security Safeguards: Reasonable technical and organisational security measures must be implemented. Accountability: Data fiduciaries bear demonstrable responsibility for compliance. The Act deliberately adopts the SARAL approach: Simple, Accessible, Rational, and Actionable. It uses plain language and avoids legal complexity, enabling both individuals and businesses to understand their rights and obligations without specialized legal interpretation. Key Stakeholders and Their Roles Data Principal[4] A Data Principal is the individual to whom personal data relates. For minors or persons with disabilities unable to make independent decisions, the lawful parent or guardian acts as the Data Principal. This recognition ensures vulnerable populations receive adequate protection while allowing lawful guardians to exercise rights on their behalf. Data Fiduciary[5] A Data Fiduciary is any entity—public or private—that decides why and how personal data is processed, either independently or jointly with others. Retailers, platforms, financial institutions, healthcare providers, and government agencies collecting personal data all qualify as Data Fiduciaries. Data Processor[6] A Data Processor is an entity that processes personal data on behalf of a Data Fiduciary under a valid contract and solely for activities related to providing goods or services to Data Principals. Data Fiduciaries remain fully responsible for Data Processor compliance; any failure by the Data Processor does not absolve the Data Fiduciary of its obligations under the Act. Significant Data Fiduciaries (SDFs) A subset of Data Fiduciaries designated as Significant Data Fiduciaries under Section 10 faces heightened obligations. The Central Government classifies entities as SDFs based on illustrative criteria including:[7] Processing personal data of 10 million or more Data Principals Large-scale processing of financial, health, or biometric data Platforms with systemic societal impact (social networks, digital banks) Risks to national security, electoral democracy, or state security SDFs must appoint an India-based Data Protection Officer (DPO) who represents the SDF for DPDP compliance and serves as the primary grievance redressal contact. The DPO must report directly to the Board of Directors or equivalent governing body. Additionally, SDFs must engage independent data auditors and conduct annual Data Protection Impact Assessments (DPIAs) that outline the purpose of processing, Data Principal rights, and a comprehensive assessment and mitigation of related risks.[8] Consent Manager[9] The Consent Manager is a new regulatory intermediary introduced by the DPDP Rules. Acting as a fiduciary to the Data Principal, the Consent Manager provides a single, transparent, and interoperable platform through which individuals can give, manage, review, and withdraw consent across multiple Data Fiduciaries from a unified interface. The Consent Manager serves as a critical accountability layer between Data Fiduciaries and Data Principals, ensuring neutral and transparent consent administration. Consent Managers must be companies incorporated in India with a minimum net worth of ₹2 crore, demonstrating sufficient technical, operational, and financial capacity. They must register with the Data Protection Board and comply with stringent obligations including neutrality (avoiding conflicts of interest), data integrity, audit trails, and grievance handling.[2] The Board may initiate inquiries and impose penalties on Consent Managers for violations of registration conditions or fiduciary duties. Data Protection Board of India The Data Protection Board of India (DPBI), a four-member independent body established under the Act, functions as the central enforcement and adjudicatory mechanism.[10] The Board, with its head office in the National Capital Region, investigates complaints, ensures compliance, and determines appropriate remedial actions. Board members must possess integrity and expertise in data governance, law, dispute resolution, information and communication technology, or the digital economy, with at least one member being a legal expert. A key feature of the DPDP Rules is the Board’s digital-first infrastructure: citizens can file complaints online, track cases through a dedicated portal and mobile application, and receive faster decisions. The Board possesses powers to investigate data breaches, conduct inquiries, direct remedial actions, and impose substantial penalties.[3] Appeals against Board decisions are heard by the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which functions entirely through digital means and issues decisions within six months where possible.[11] Rights of Data Principals The DPDP Act grants individuals comprehensive rights to control their personal data:[12] Right Scope Right to Consent or Refuse Full discretion to allow or deny data use; ability to withdraw consent at any time; withdrawal process as simple as giving consent Right to Know Access to information about data collected, collection purpose, and usage manner; know who data is shared with (except lawfully authorized agencies) Right to Access Obtain a summary of personal data held by the Data Fiduciary; know all disclosures made; request any other information about processing Right to Correct Request correction of inaccurate or incomplete data; request updates for changed details (address, contact information) Right to Erase Request removal of personal data in prescribed circumstances; mandatory erasure upon consent withdrawal or purpose fulfillment Right to Nominate Appoint another individual to exercise rights on their behalf (in case of death or incapacity from unsoundness of mind or physical infirmity) Right to Grievance Redressal Seek redressal from Data Fiduciary or Consent Manager for non-compliance; must exhaust internal mechanisms before escalating to the Data Protection Board Response Timeline Data Fiduciaries must respond to all requests within 90 days Duties of Data Principals While granting extensive rights, the Act also imposes reciprocal duties on Data Principals to ensure responsible exercise of these rights:[13] Compliance with Laws: Data Principals must comply with all applicable laws while exercising rights under the Act. No Impersonation: Must not impersonate another person when providing personal data. No Suppression of Material Information: Must not hide or suppress important information while providing data for official documents or government-issued identification. No False Grievances: Must not file false or frivolous complaints with a Data Fiduciary or the Data Protection Board. Authentic Information for Corrections: When requesting correction or erasure, must provide only verifiably authentic information. Phased Implementation Timeline and Current Stage[14] Timeline Overview The DPDP Rules introduce a carefully structured 18-month phased compliance period, reflecting the Government’s recognition that organizations require time to redesign systems, retrain personnel, and implement compliance infrastructure.[15] The timeline comprises three distinct stages:[16] Stage 1: Immediate Effect (13 November 2025) - Data Protection Board of India formally established and operational with head office in NCR - Digital complaint portal and mobile application launched - Rule 4 provisions relating to Board appointment, functioning, and digital office activated - Board’s enforcement and investigative powers operational - Institutional framework for enforcement activated - Old SPDI Rules, 2011 continue to remain in force for 18 more months, ensuring no compliance vacuum - Compliance action required: Organizations should begin data mapping, governance assessment, and preparation of consent redesign Stage 2: One Year from Notification (13 November 2026) - Consent Manager registration commences under Rule 4 - Consent Managers must register with DPBI and meet stringent registration conditions - Obligations for Consent Managers detailed in Schedule I of the Rules take effect - Neutrality, data integrity, and grievance handling obligations become operative - Compliance action required: Data Fiduciaries should finalize Consent Manager selection and initiate integration planning; SDFs must appoint Data Protection Officers Stage 3: Eighteen Months from Notification (13 May 2027) - Full operational compliance obligations come into force - Notice requirements become mandatory (standalone, clear, in prescribed languages) - Breach notification requirements (72-hour timeline) apply with detailed reporting to DPBI - All data principal rights and corresponding fiduciary obligations become enforceable - Data Protection Impact Assessments and data audits mandatory for SDFs - Penalties commence for violations - Final deadline: All organizations must achieve compliance by this date. Current Status (As of January 2026) As of January 2026, India stands at the inception of Stage 1. The Data Protection Board of India has been formally established and is operationalizing its digital infrastructure with head office in NCR. Organizations are currently in the critical planning and preparation phase. While technical penalties have not yet commenced, the regulatory framework is active, and the Board is building capacity for enforcement. The continued operation of the older SPDI Rules 2011 for an additional 18 months ensures there is no compliance vacuum during the transition. This 18-month window is not a grace period but a narrow transition period during which compliance obligations crystallize progressively. Compliance Obligations and Consent Framework Procedure for Data Collection and Notice Requirements (Rule 3)[17] Effective from 13 May 2027, Data Fiduciaries must provide a standalone, clear consent notice separate from other terms and conditions. This notice must: Use plain language in English or any of the 22 scheduled languages (Eighth Schedule of the Constitution) Be clear, independent, and self-contained—not buried within lengthy privacy policies Itemize categories of personal data collected Specify the exact purpose for processing Explain data retention periods Detail disclosure practices and identify recipients Provide information on Data Principal rights, including withdrawal of consent Include contact details of the Data Protection Officer or authorized person Provide information on rights and grievance redressal mechanisms Data Fiduciaries must retain records of notices given and issue revised notices if there are alterations in the purpose or means of data processing. Even if prior consent was received before Act implementation, new notices with complete information must be provided.[3] Consent Standards: Free, Specific, Informed, and Unambiguous (FSIU)[18] Critically, consent must be Free, Specific, Informed, and Unambiguous (FSIU) under Section 6 of the Act. This standard precludes: - Pre-ticked consent boxes - Bundled consent for multiple purposes (e.g., requesting consent for both health data and contact list when only health data is necessary) - Difficult or obscured opt-out mechanisms - Implicit consent through silence - Conditional consent (e.g., requiring waiver of complaint rights to the Data Protection Board) Any consent obtained in violation of the Act or other laws is considered invalid to that extent. For example, if an insurance company requests consent to waive Data Principal rights to complain to the Board, that portion is void. Verifiable Consent for Children[19] The final DPDP Rules introduce enhanced standards for processing children’s and vulnerable persons’ data: Mandatory Verifiable Consent: Before processing a child’s personal data or data of an individual with a disability, a Data Fiduciary must obtain verifiable consent from the child’s parent or the lawful guardian. This is “a stronger, more operationally enforceable standard” than earlier draft provisions.[20] Authentication Process: Verification may involve: - Examination of trustworthy identity and age information available to the Fiduciary - Documentation and digital authentication systems - Prescribed verification protocols - Virtual tokens provided by legally recognized bodies (e.g., Digital Locker service providers) - Technical and organizational measures sufficient to enable parent/guardian consent verification Prohibited Processing: Data Fiduciaries are strictly prohibited from: - Processing children’s data in ways that have a detrimental effect on their well-being - Engaging in tracking, behavioural monitoring, or targeted advertising directed at children - Using children’s data in ways that manipulate or exploit them through personalized content Exemptions: The Central Government may exempt a Data Fiduciary from obtaining parental consent and from restrictions on tracking if satisfied that the Data Fiduciary processes children’s data in a verifiably safe manner, subject to government notification. Data Fiduciary Obligations (Section 8 and rules)[21] [22] All Data Fiduciaries must: Maintain Privacy Policies: Publish accessible privacy policies detailing: - Data handling practices and type of data collected - Purposes of collection and usage - Disclosure practices and potential recipients - Security measures implemented - Data retention periods - Individual rights and grievance redressal mechanisms Policies must be consistent with IT Rules 2011 frameworks that organizations already maintain, providing continuity during transition. Implement Reasonable Security Measures: Adopt documented information security programs with technical and organizational safeguards commensurate with the sensitivity of data: - Technical measures: Encryption, masking, obfuscation, virtual tokens for securing confidentiality, integrity, and availability - Access controls: Compelling access controls limiting unauthorized access - Surveillance and logging: Regular surveillance of computer facilities with periodic logging of activity to detect unauthorized access and enable investigation - Data backup and business continuity: Regular data backups; logs and personal data retention for minimum one year - Standards compliance: International Standard ISO/IEC 27001 or Board-approved sectoral codes Upon data breaches, fiduciaries must demonstrate that implemented safeguards were adequate. Contractually, Data Fiduciaries must ensure Data Processors are equally bound by similar safeguards. Breach Notification: Data Fiduciaries must notify DPBI and affected individuals following a structured process: - Immediate Intimation to Data Principals: Prompt notification in clear, concise, plain manner through registered mode of communication (user account, email, mobile number) including: - Nature, extent, timing, and location of the breach - Likely consequences for the individual - Mitigation measures being taken - Personal safety measures the individual can adopt - Contact details of responsible person for queries - Initial Report to DPBI: Immediately upon becoming aware, with basic breach description - Detailed Report within 72 Hours: Comprehensive report including: - Details of all notifications sent to affected Data Principals - Detailed breach information, circumstances, and reasons - Risk mitigation measures taken or proposed - Identity of responsible person (if known) - Remedial actions to prevent future incidents Maintain Records: Keep logs of consent, processing activities, breach-related documentation, and audit trails for at least one year, subject to sectoral requirements. These logs must be reliable and permit reconstruction of breach events. Grievance Redressal: Establish mechanisms enabling individuals to: - Exercise data principal rights with 90-day response timelines - Lodge complaints regarding non-compliance - Receive redressal within prescribed timeframes Data Principals must exhaust internal grievance redressal mechanisms before escalating to the Data Protection Board. Representative Appointment and Data Protection Officer Role Significant Data Fiduciaries[23] must appoint an India-based representative designated as a Data Protection Officer (DPO) responsible for: - Representing the SDF in DPDP compliance matters - Serving as the point of contact for grievance redressal - Reporting to the Board of Directors or governing body - Acting as liaison with the Data Protection Board - Ensuring the organization’s compliance with all Act provisions For organizations engaged in significant data collection, the appointment of both a Data Protection Officer and engagement with a Consent Manager ensures dual accountability mechanisms: the DPO provides internal governance and grievance redressal, while the Consent Manager, if engaged externally,  ensures neutral, independent consent administration. Cross-Border Data Transfers[24] The DPDP Act and Rules adopt a balanced approach to cross-border transfers—not a blanket ban, but a structured framework. The Central Government can restrict the transfer of personal data outside India by Data Fiduciaries through formal notifications under Section 16, subject to specific conditions. This power is used to protect national interests or data security. However, if existing Indian laws require stricter protection or local storage, those rules take precedence over general cross-border transfer provisions. Companies involved in global data processing must: - Reassess data flows and localization commitments - Ensure contractual protections mirror the protection standards required by Indian law - Monitor Government notifications restricting transfers to specific jurisdictions Data Localization and Algorithmic Compliance for SDFs Significant Data Fiduciaries must ensure:[25] - Algorithmic Compliance: Any algorithmic software used for data processing respects the rights of Data Principals - Data Localization: Personal data and traffic data, as defined by the Central Government, remain in India and are processed domestically according to Government guidelines Key Developments Since Notification (November 2025)[26] Critical Change: Right to Information (RTI) Act Amendment A major recent development involves amendment to the Right to Information Act, 2005. The DPDP Act revision of Section 8(1)(j) of the RTI Act reflects the Supreme Court’s Puttaswamy judgment affirming privacy as fundamental. The revision introduces a significant shift: “Personal information” is now a ground to REJECT disclosure outright. In earlier iterations, personal information could be disclosed if the public interest in disclosure outweighed privacy concerns. This change means: - Information considered “personal” cannot be disclosed under RTI requests - Earlier public interest exception permitting disclosure has been removed - The amendment strengthens privacy protection by creating a more categorical privacy protection - This sets up a future policy dialogue on transparency versus sovereign requirements and privacy protection This represents one of the most privacy-protective aspects of the new regime and marks a significant shift toward categorical privacy protection over selective balancing. Public Consultation Success[27] The DPDP Rules followed extensive nationwide consultations conducted by the Ministry of Electronics and Information Technology in Delhi, Mumbai, Guwahati, Kolkata, Hyderabad, Bengaluru, and Chennai. The consultation process received 6,915 inputs from startups, MSMEs, industry bodies, civil society, and government departments, demonstrating robust stakeholder engagement. These contributions materially shaped refinements in the final Rules, particularly regarding Consent Manager registration conditions and relief provisions for small organizations. New “User Account” Definition The final Rules introduce a new definition of “User Account”[28] that significantly impacts breach notification and data processing interpretation. A user account now includes any identifier such as: - Email address - Mobile number - Username or handle - Any credential used to access a platform Consent Manager Regulatory Framework[29] The 2025 Rules introduce a highly regulated Consent Manager ecosystem with stringent eligibility conditions: Incorporation: Must be a company incorporated in India Net Worth: Minimum ₹2 crore Capacity: Documented technical, operational, and financial capacity Platform: Certified interoperable platform meeting DPBI standards Neutrality: Must avoid conflicts of interest with Data Fiduciaries Record Retention: 7-year minimum retention of consent records Audits: Regular independent audit of technical and organisational controls Consent Managers effectively become quasi-regulatory entities with fiduciary responsibilities to Data Principals, subject to DPBI oversight, inquiry, and potential suspension or cancellation of registration. Government Data Request Restrictions[30] A significant privacy protection measure prohibits Data Fiduciaries from notifying individuals when the Government seeks access to their personal data. This raises practical and contractual challenges: Many platforms currently disclose government requests as part of transparency commitments Terms of service may require revision to avoid non-compliance Sets up future policy dialogue on transparency versus sovereign requirements Likely to be a focal point of industry engagement in the months ahead Penalties and Enforcement[31] [32] The DPDP Act establishes substantial financial penalties for non-compliance, scaled by violation severity, with the Board exercising discretion based on multiple factors: Violation Category Maximum Penalty Failure to maintain reasonable security safeguards ₹250 crore (~USD 30 million) Failure to notify breach to DPBI/Data Principals; violations re: children’s data; tracking and behavioral monitoring of children ₹200 crore (~USD 24 million) Any other violation of the Act or Rules ₹50 crore Penalty Determination Factors: The Board considers: - Level of seriousness and gravity of violation - Kind of personal data involved (sensitivity level) - Economic advantage gained or loss prevented - Attempts made to mitigate the violation - Overall impact of penalty on the subject entity Scope of Penalties: Fines may be levied against: - Data Fiduciaries (primary entity) - Consent Managers (for registration condition violations or failure to meet obligations) - Intermediaries (for refusing to block access to data as ordered by Central Government) Important Limitation: Individuals are NOT granted the right to claim compensation for damages, which may reduce litigation incentives but places primary enforcement burden on the Board. Commencement: These penalties apply only from 13 May 2027 onward. However, organizations that delay compliance face compounding risks: remedial costs escalate as data systems require urgent overhaul under pressure, and regulatory relationships may be prejudiced by evident non-preparation during the 18-month transition window. Exemptions and Special Cases[33] The DPDP Act provides exemptions in specific circumstances: Processing Exemptions: - Enforcement of legal rights by courts or regulators - Judicial or supervisory tasks by courts or regulators - Law enforcement activities - Cross-border contractual obligations - Mergers, demergers, or insolvency-related assessments State Instrumentality Exemptions: - Processing for national security, sovereignty, or state security - Processing for public order - Research, archiving, or statistical purposes (if no decision specific to a Data Principal is made) Entity-level Relief: - Recognized startups may be exempted from specific compliance obligations based on size and nature of data processed - Government may, within five years, exempt specific classes of Data Fiduciaries from any provisions through official notification Non-applicability to State Processing: - Certain provisions do not apply to state processing where no decision affecting the Data Principal is involved   Conclusion The Act is founded on the constitutional definition of privacy as a human right and establishes a consent model that prioritizes transparency, accountability, and user control over personal data. It fills the legislative gap left by the IT Act of 2000 and puts India’s data protection policies on par with the world. The obligations placed on Data Fiduciaries like adoption of strong technical measures and ensuring data minimization and legitimate processing, are an indication of the government’s intent to foster privacy and innovation both. While the Act grants people the right to access, correct, and delete their data, it also aims to balance such rights, national interest, and ease of doing business.[34] The Digital Personal Data Protection Act and the 2025 Rules represent India’s definitive commitment to building a trustworthy, innovation-friendly digital ecosystem. By placing individuals at the center of the framework while creating clear, proportionate obligations for organizations, the legislation balances privacy protection with economic growth imperatives. The phased 18-month implementation timeline reflects pragmatic policy design, acknowledging that systemic compliance requires time but that the statutory deadline of 13 May 2027. The evolution from the IT Act 2000, through multiple legislative iterations, to the DPDP Act reflects India’s maturation as a digital economy demanding world-class privacy protection. The amendments to the IT Act, the stringent breach notification timelines, the children’s data protections, and the Consent Manager framework all signal a shift toward practical, outcome-based regulation prioritizing individual rights and organizational accountability.   Author: Mr. Ketan Joshi, Associate Partner  [1] Press Release:Press Information Bureau [2] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [3] Press Information Bureau, “DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use,” Government of India, 17 November 2025 - doc20251117695301.pdf [4] ibid [5] ibid [6] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [7] DPDP Rules, 2025: Significant Data Fiduciaries and Data Transfers [8] https://www.legal500.com/developments/thought-leadership/48168/ [9] DPDP Rules 2025: Guidance to DPDP Act implementation [10] Press Release:Press Information Bureau [11] https://www.legal500.com/developments/thought-leadership/48168/ [12] Press Information Bureau, “DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use,” Government of India - doc20251117695301.pdf [13] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [14] c56ceae6c383460ca69577428d36828b.pdf [15] Press Release:Press Information Bureau [16] DPDP Act Compliance Guide 2025 [17] Rule 3 of Digital Personal Data Protection Act, 2023 DPDP Rules 2025 [18] Digital Personal Data Protection Act, 2023 DPDPA SECTION 6 WITH INTERPRETATION [19] Rule 10 of Digital Personal Data Protection Act, 2023 DPDP Rules 2025 [20]https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf [21] DATA FIDUCIARY OBLIGATIONS in The Digital Personal Data Protection Act, 2023. DPPA AND INTERPRETATION 8 [22] Rule 6 of Digital Personal Data Protection Act, 2023 DPDP Rules 2025 [23] Digital Personal Data Protection Act, 2023 DPDPA SECTION 10 WITH INTERPRETATION [24] Digital Personal Data Protection Act, 2023 DPDPA SECTION 16 WITH INTERPRETATION [25] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [26] doc20251117695301.pdf [27] Press Release:Press Information Bureau [28] Rule 2 of Digital Personal Data Protection Rules, 2025 (DPDP Rules 2025) under DPDPA 2023 [29] DPDP Rules 2025: Guidance to DPDP Act implementation [30] Digital Personal Data Protection Act, 2023 DPDPA SECTION 17 WITH INTERPRETATION [31] doc20251117695301.pdf [32] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [33] Digital Personal Data Protection Act, 2023 DPDPA SECTION 17 WITH INTERPRETATION [34] https://www.legal500.com/developments/thought-leadership/48168/

Introduction The Digital Personal Data Protection Act, 2023 (DPDP Act) represents India’s comprehensive response to the pressing need for digital privacy protection in an increasingly data-driven economy. Enacted on 11 August 2023 following Parliamentary approval, the DPDP Act establishes a citizen-centric legal framework that balances individual privacy rights with the legitimate need for lawful data processing. The subsequent notification of the Digital Personal Data Protection Rules, 2025 on 14 November 2025 marks the transition from legislative intent to operational reality, providing the practical implementation framework that organizations must now navigate.[1] This article examines the DPDP Act’s core architecture, traces its evolutionary path from enactment to current stage, and provides clarity on the compliance obligations and timelines that organizations face in 2025 and beyond. Legislative Framework, Evolution, and Core Principles Historical Evolution: From IT Act to DPDP Act[2] India’s journey toward comprehensive data protection spans nearly two decades. The Information Technology Act, 2000 served as the foundational digital law but provided scant privacy protection, with only Sections 43A and 72A addressing sensitive personal data security. This inadequacy became increasingly evident as digital transactions and data misuse escalated. The constitutional turning point arrived with the Supreme Court’s landmark 2017 judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, which recognized privacy as a fundamental right under Article 21 of the Constitution. This decision provided constitutional grounding for comprehensive data protection legislation and established the proportionality test for any restrictions on privacy rights. Following this constitutional affirmation, the Government appointed the Justice B.N. Srikrishna Committee (2017), which recommended a rights-based framework emphasizing responsibility, consent, and data localization. This committee’s recommendations influenced the development of the Personal Data Protection (PDP) Bill, 2019. However, the PDP Bill faced substantial parliamentary scrutiny; the Joint Parliamentary Committee proposed 81 amendments, citing concerns over robust data localization requirements and expansive government powers under Section 35. The PDP Bill was consequently withdrawn in 2022. The Government then introduced the Digital Personal Data Protection (DPDP) Bill, 2022, which adopted a more balanced and business-friendly approach while maintaining stringent privacy protection. This revised approach reflected stakeholder feedback emphasizing practical compliance and innovation enablement. The DPDP Bill was finally enacted as the Digital Personal Data Protection Act, 2023 on 11 August 2023, establishing India’s modern data protection regime. Seven Foundational Principles[3] The DPDP Act rests on seven core principles that govern all data processing activities: Consent and Transparency: Data processing requires affirmative, informed consent; processing purposes must be transparent. Purpose Limitation: Personal data shall be used only for the specific purposes for which consent was obtained. Data Minimisation: Only necessary personal data shall be collected and processed. Accuracy: Data fiduciaries must ensure data is accurate and complete, particularly where processing will affect the individual. Storage Limitation: Personal data shall be retained only for the period necessary to serve its purpose. Security Safeguards: Reasonable technical and organisational security measures must be implemented. Accountability: Data fiduciaries bear demonstrable responsibility for compliance. The Act deliberately adopts the SARAL approach: Simple, Accessible, Rational, and Actionable. It uses plain language and avoids legal complexity, enabling both individuals and businesses to understand their rights and obligations without specialized legal interpretation. Key Stakeholders and Their Roles Data Principal[4] A Data Principal is the individual to whom personal data relates. For minors or persons with disabilities unable to make independent decisions, the lawful parent or guardian acts as the Data Principal. This recognition ensures vulnerable populations receive adequate protection while allowing lawful guardians to exercise rights on their behalf. Data Fiduciary[5] A Data Fiduciary is any entity—public or private—that decides why and how personal data is processed, either independently or jointly with others. Retailers, platforms, financial institutions, healthcare providers, and government agencies collecting personal data all qualify as Data Fiduciaries. Data Processor[6] A Data Processor is an entity that processes personal data on behalf of a Data Fiduciary under a valid contract and solely for activities related to providing goods or services to Data Principals. Data Fiduciaries remain fully responsible for Data Processor compliance; any failure by the Data Processor does not absolve the Data Fiduciary of its obligations under the Act. Significant Data Fiduciaries (SDFs) A subset of Data Fiduciaries designated as Significant Data Fiduciaries under Section 10 faces heightened obligations. The Central Government classifies entities as SDFs based on illustrative criteria including:[7] Processing personal data of 10 million or more Data Principals Large-scale processing of financial, health, or biometric data Platforms with systemic societal impact (social networks, digital banks) Risks to national security, electoral democracy, or state security SDFs must appoint an India-based Data Protection Officer (DPO) who represents the SDF for DPDP compliance and serves as the primary grievance redressal contact. The DPO must report directly to the Board of Directors or equivalent governing body. Additionally, SDFs must engage independent data auditors and conduct annual Data Protection Impact Assessments (DPIAs) that outline the purpose of processing, Data Principal rights, and a comprehensive assessment and mitigation of related risks.[8] Consent Manager[9] The Consent Manager is a new regulatory intermediary introduced by the DPDP Rules. Acting as a fiduciary to the Data Principal, the Consent Manager provides a single, transparent, and interoperable platform through which individuals can give, manage, review, and withdraw consent across multiple Data Fiduciaries from a unified interface. The Consent Manager serves as a critical accountability layer between Data Fiduciaries and Data Principals, ensuring neutral and transparent consent administration. Consent Managers must be companies incorporated in India with a minimum net worth of ₹2 crore, demonstrating sufficient technical, operational, and financial capacity. They must register with the Data Protection Board and comply with stringent obligations including neutrality (avoiding conflicts of interest), data integrity, audit trails, and grievance handling.[2] The Board may initiate inquiries and impose penalties on Consent Managers for violations of registration conditions or fiduciary duties. Data Protection Board of India The Data Protection Board of India (DPBI), a four-member independent body established under the Act, functions as the central enforcement and adjudicatory mechanism.[10] The Board, with its head office in the National Capital Region, investigates complaints, ensures compliance, and determines appropriate remedial actions. Board members must possess integrity and expertise in data governance, law, dispute resolution, information and communication technology, or the digital economy, with at least one member being a legal expert. A key feature of the DPDP Rules is the Board’s digital-first infrastructure: citizens can file complaints online, track cases through a dedicated portal and mobile application, and receive faster decisions. The Board possesses powers to investigate data breaches, conduct inquiries, direct remedial actions, and impose substantial penalties.[3] Appeals against Board decisions are heard by the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which functions entirely through digital means and issues decisions within six months where possible.[11] Rights of Data Principals The DPDP Act grants individuals comprehensive rights to control their personal data:[12] Right Scope Right to Consent or Refuse Full discretion to allow or deny data use; ability to withdraw consent at any time; withdrawal process as simple as giving consent Right to Know Access to information about data collected, collection purpose, and usage manner; know who data is shared with (except lawfully authorized agencies) Right to Access Obtain a summary of personal data held by the Data Fiduciary; know all disclosures made; request any other information about processing Right to Correct Request correction of inaccurate or incomplete data; request updates for changed details (address, contact information) Right to Erase Request removal of personal data in prescribed circumstances; mandatory erasure upon consent withdrawal or purpose fulfillment Right to Nominate Appoint another individual to exercise rights on their behalf (in case of death or incapacity from unsoundness of mind or physical infirmity) Right to Grievance Redressal Seek redressal from Data Fiduciary or Consent Manager for non-compliance; must exhaust internal mechanisms before escalating to the Data Protection Board Response Timeline Data Fiduciaries must respond to all requests within 90 days Duties of Data Principals While granting extensive rights, the Act also imposes reciprocal duties on Data Principals to ensure responsible exercise of these rights:[13] Compliance with Laws: Data Principals must comply with all applicable laws while exercising rights under the Act. No Impersonation: Must not impersonate another person when providing personal data. No Suppression of Material Information: Must not hide or suppress important information while providing data for official documents or government-issued identification. No False Grievances: Must not file false or frivolous complaints with a Data Fiduciary or the Data Protection Board. Authentic Information for Corrections: When requesting correction or erasure, must provide only verifiably authentic information. Phased Implementation Timeline and Current Stage[14] Timeline Overview The DPDP Rules introduce a carefully structured 18-month phased compliance period, reflecting the Government’s recognition that organizations require time to redesign systems, retrain personnel, and implement compliance infrastructure.[15] The timeline comprises three distinct stages:[16] Stage 1: Immediate Effect (13 November 2025) - Data Protection Board of India formally established and operational with head office in NCR - Digital complaint portal and mobile application launched - Rule 4 provisions relating to Board appointment, functioning, and digital office activated - Board’s enforcement and investigative powers operational - Institutional framework for enforcement activated - Old SPDI Rules, 2011 continue to remain in force for 18 more months, ensuring no compliance vacuum - Compliance action required: Organizations should begin data mapping, governance assessment, and preparation of consent redesign Stage 2: One Year from Notification (13 November 2026) - Consent Manager registration commences under Rule 4 - Consent Managers must register with DPBI and meet stringent registration conditions - Obligations for Consent Managers detailed in Schedule I of the Rules take effect - Neutrality, data integrity, and grievance handling obligations become operative - Compliance action required: Data Fiduciaries should finalize Consent Manager selection and initiate integration planning; SDFs must appoint Data Protection Officers Stage 3: Eighteen Months from Notification (13 May 2027) - Full operational compliance obligations come into force - Notice requirements become mandatory (standalone, clear, in prescribed languages) - Breach notification requirements (72-hour timeline) apply with detailed reporting to DPBI - All data principal rights and corresponding fiduciary obligations become enforceable - Data Protection Impact Assessments and data audits mandatory for SDFs - Penalties commence for violations - Final deadline: All organizations must achieve compliance by this date. Current Status (As of January 2026) As of January 2026, India stands at the inception of Stage 1. The Data Protection Board of India has been formally established and is operationalizing its digital infrastructure with head office in NCR. Organizations are currently in the critical planning and preparation phase. While technical penalties have not yet commenced, the regulatory framework is active, and the Board is building capacity for enforcement. The continued operation of the older SPDI Rules 2011 for an additional 18 months ensures there is no compliance vacuum during the transition. This 18-month window is not a grace period but a narrow transition period during which compliance obligations crystallize progressively. Compliance Obligations and Consent Framework Procedure for Data Collection and Notice Requirements (Rule 3)[17] Effective from 13 May 2027, Data Fiduciaries must provide a standalone, clear consent notice separate from other terms and conditions. This notice must: Use plain language in English or any of the 22 scheduled languages (Eighth Schedule of the Constitution) Be clear, independent, and self-contained—not buried within lengthy privacy policies Itemize categories of personal data collected Specify the exact purpose for processing Explain data retention periods Detail disclosure practices and identify recipients Provide information on Data Principal rights, including withdrawal of consent Include contact details of the Data Protection Officer or authorized person Provide information on rights and grievance redressal mechanisms Data Fiduciaries must retain records of notices given and issue revised notices if there are alterations in the purpose or means of data processing. Even if prior consent was received before Act implementation, new notices with complete information must be provided.[3] Consent Standards: Free, Specific, Informed, and Unambiguous (FSIU)[18] Critically, consent must be Free, Specific, Informed, and Unambiguous (FSIU) under Section 6 of the Act. This standard precludes: - Pre-ticked consent boxes - Bundled consent for multiple purposes (e.g., requesting consent for both health data and contact list when only health data is necessary) - Difficult or obscured opt-out mechanisms - Implicit consent through silence - Conditional consent (e.g., requiring waiver of complaint rights to the Data Protection Board) Any consent obtained in violation of the Act or other laws is considered invalid to that extent. For example, if an insurance company requests consent to waive Data Principal rights to complain to the Board, that portion is void. Verifiable Consent for Children[19] The final DPDP Rules introduce enhanced standards for processing children’s and vulnerable persons’ data: Mandatory Verifiable Consent: Before processing a child’s personal data or data of an individual with a disability, a Data Fiduciary must obtain verifiable consent from the child’s parent or the lawful guardian. This is “a stronger, more operationally enforceable standard” than earlier draft provisions.[20] Authentication Process: Verification may involve: - Examination of trustworthy identity and age information available to the Fiduciary - Documentation and digital authentication systems - Prescribed verification protocols - Virtual tokens provided by legally recognized bodies (e.g., Digital Locker service providers) - Technical and organizational measures sufficient to enable parent/guardian consent verification Prohibited Processing: Data Fiduciaries are strictly prohibited from: - Processing children’s data in ways that have a detrimental effect on their well-being - Engaging in tracking, behavioural monitoring, or targeted advertising directed at children - Using children’s data in ways that manipulate or exploit them through personalized content Exemptions: The Central Government may exempt a Data Fiduciary from obtaining parental consent and from restrictions on tracking if satisfied that the Data Fiduciary processes children’s data in a verifiably safe manner, subject to government notification. Data Fiduciary Obligations (Section 8 and rules)[21] [22] All Data Fiduciaries must: Maintain Privacy Policies: Publish accessible privacy policies detailing: - Data handling practices and type of data collected - Purposes of collection and usage - Disclosure practices and potential recipients - Security measures implemented - Data retention periods - Individual rights and grievance redressal mechanisms Policies must be consistent with IT Rules 2011 frameworks that organizations already maintain, providing continuity during transition. Implement Reasonable Security Measures: Adopt documented information security programs with technical and organizational safeguards commensurate with the sensitivity of data: - Technical measures: Encryption, masking, obfuscation, virtual tokens for securing confidentiality, integrity, and availability - Access controls: Compelling access controls limiting unauthorized access - Surveillance and logging: Regular surveillance of computer facilities with periodic logging of activity to detect unauthorized access and enable investigation - Data backup and business continuity: Regular data backups; logs and personal data retention for minimum one year - Standards compliance: International Standard ISO/IEC 27001 or Board-approved sectoral codes Upon data breaches, fiduciaries must demonstrate that implemented safeguards were adequate. Contractually, Data Fiduciaries must ensure Data Processors are equally bound by similar safeguards. Breach Notification: Data Fiduciaries must notify DPBI and affected individuals following a structured process: - Immediate Intimation to Data Principals: Prompt notification in clear, concise, plain manner through registered mode of communication (user account, email, mobile number) including: - Nature, extent, timing, and location of the breach - Likely consequences for the individual - Mitigation measures being taken - Personal safety measures the individual can adopt - Contact details of responsible person for queries - Initial Report to DPBI: Immediately upon becoming aware, with basic breach description - Detailed Report within 72 Hours: Comprehensive report including: - Details of all notifications sent to affected Data Principals - Detailed breach information, circumstances, and reasons - Risk mitigation measures taken or proposed - Identity of responsible person (if known) - Remedial actions to prevent future incidents Maintain Records: Keep logs of consent, processing activities, breach-related documentation, and audit trails for at least one year, subject to sectoral requirements. These logs must be reliable and permit reconstruction of breach events. Grievance Redressal: Establish mechanisms enabling individuals to: - Exercise data principal rights with 90-day response timelines - Lodge complaints regarding non-compliance - Receive redressal within prescribed timeframes Data Principals must exhaust internal grievance redressal mechanisms before escalating to the Data Protection Board. Representative Appointment and Data Protection Officer Role Significant Data Fiduciaries[23] must appoint an India-based representative designated as a Data Protection Officer (DPO) responsible for: - Representing the SDF in DPDP compliance matters - Serving as the point of contact for grievance redressal - Reporting to the Board of Directors or governing body - Acting as liaison with the Data Protection Board - Ensuring the organization’s compliance with all Act provisions For organizations engaged in significant data collection, the appointment of both a Data Protection Officer and engagement with a Consent Manager ensures dual accountability mechanisms: the DPO provides internal governance and grievance redressal, while the Consent Manager, if engaged externally,  ensures neutral, independent consent administration. Cross-Border Data Transfers[24] The DPDP Act and Rules adopt a balanced approach to cross-border transfers—not a blanket ban, but a structured framework. The Central Government can restrict the transfer of personal data outside India by Data Fiduciaries through formal notifications under Section 16, subject to specific conditions. This power is used to protect national interests or data security. However, if existing Indian laws require stricter protection or local storage, those rules take precedence over general cross-border transfer provisions. Companies involved in global data processing must: - Reassess data flows and localization commitments - Ensure contractual protections mirror the protection standards required by Indian law - Monitor Government notifications restricting transfers to specific jurisdictions Data Localization and Algorithmic Compliance for SDFs Significant Data Fiduciaries must ensure:[25] - Algorithmic Compliance: Any algorithmic software used for data processing respects the rights of Data Principals - Data Localization: Personal data and traffic data, as defined by the Central Government, remain in India and are processed domestically according to Government guidelines Key Developments Since Notification (November 2025)[26] Critical Change: Right to Information (RTI) Act Amendment A major recent development involves amendment to the Right to Information Act, 2005. The DPDP Act revision of Section 8(1)(j) of the RTI Act reflects the Supreme Court’s Puttaswamy judgment affirming privacy as fundamental. The revision introduces a significant shift: “Personal information” is now a ground to REJECT disclosure outright. In earlier iterations, personal information could be disclosed if the public interest in disclosure outweighed privacy concerns. This change means: - Information considered “personal” cannot be disclosed under RTI requests - Earlier public interest exception permitting disclosure has been removed - The amendment strengthens privacy protection by creating a more categorical privacy protection - This sets up a future policy dialogue on transparency versus sovereign requirements and privacy protection This represents one of the most privacy-protective aspects of the new regime and marks a significant shift toward categorical privacy protection over selective balancing. Public Consultation Success[27] The DPDP Rules followed extensive nationwide consultations conducted by the Ministry of Electronics and Information Technology in Delhi, Mumbai, Guwahati, Kolkata, Hyderabad, Bengaluru, and Chennai. The consultation process received 6,915 inputs from startups, MSMEs, industry bodies, civil society, and government departments, demonstrating robust stakeholder engagement. These contributions materially shaped refinements in the final Rules, particularly regarding Consent Manager registration conditions and relief provisions for small organizations. New “User Account” Definition The final Rules introduce a new definition of “User Account”[28] that significantly impacts breach notification and data processing interpretation. A user account now includes any identifier such as: - Email address - Mobile number - Username or handle - Any credential used to access a platform Consent Manager Regulatory Framework[29] The 2025 Rules introduce a highly regulated Consent Manager ecosystem with stringent eligibility conditions: Incorporation: Must be a company incorporated in India Net Worth: Minimum ₹2 crore Capacity: Documented technical, operational, and financial capacity Platform: Certified interoperable platform meeting DPBI standards Neutrality: Must avoid conflicts of interest with Data Fiduciaries Record Retention: 7-year minimum retention of consent records Audits: Regular independent audit of technical and organisational controls Consent Managers effectively become quasi-regulatory entities with fiduciary responsibilities to Data Principals, subject to DPBI oversight, inquiry, and potential suspension or cancellation of registration. Government Data Request Restrictions[30] A significant privacy protection measure prohibits Data Fiduciaries from notifying individuals when the Government seeks access to their personal data. This raises practical and contractual challenges: Many platforms currently disclose government requests as part of transparency commitments Terms of service may require revision to avoid non-compliance Sets up future policy dialogue on transparency versus sovereign requirements Likely to be a focal point of industry engagement in the months ahead Penalties and Enforcement[31] [32] The DPDP Act establishes substantial financial penalties for non-compliance, scaled by violation severity, with the Board exercising discretion based on multiple factors: Violation Category Maximum Penalty Failure to maintain reasonable security safeguards ₹250 crore (~USD 30 million) Failure to notify breach to DPBI/Data Principals; violations re: children’s data; tracking and behavioral monitoring of children ₹200 crore (~USD 24 million) Any other violation of the Act or Rules ₹50 crore Penalty Determination Factors: The Board considers: - Level of seriousness and gravity of violation - Kind of personal data involved (sensitivity level) - Economic advantage gained or loss prevented - Attempts made to mitigate the violation - Overall impact of penalty on the subject entity Scope of Penalties: Fines may be levied against: - Data Fiduciaries (primary entity) - Consent Managers (for registration condition violations or failure to meet obligations) - Intermediaries (for refusing to block access to data as ordered by Central Government) Important Limitation: Individuals are NOT granted the right to claim compensation for damages, which may reduce litigation incentives but places primary enforcement burden on the Board. Commencement: These penalties apply only from 13 May 2027 onward. However, organizations that delay compliance face compounding risks: remedial costs escalate as data systems require urgent overhaul under pressure, and regulatory relationships may be prejudiced by evident non-preparation during the 18-month transition window. Exemptions and Special Cases[33] The DPDP Act provides exemptions in specific circumstances: Processing Exemptions: - Enforcement of legal rights by courts or regulators - Judicial or supervisory tasks by courts or regulators - Law enforcement activities - Cross-border contractual obligations - Mergers, demergers, or insolvency-related assessments State Instrumentality Exemptions: - Processing for national security, sovereignty, or state security - Processing for public order - Research, archiving, or statistical purposes (if no decision specific to a Data Principal is made) Entity-level Relief: - Recognized startups may be exempted from specific compliance obligations based on size and nature of data processed - Government may, within five years, exempt specific classes of Data Fiduciaries from any provisions through official notification Non-applicability to State Processing: - Certain provisions do not apply to state processing where no decision affecting the Data Principal is involved Conclusion The Act is founded on the constitutional definition of privacy as a human right and establishes a consent model that prioritizes transparency, accountability, and user control over personal data. It fills the legislative gap left by the IT Act of 2000 and puts India’s data protection policies on par with the world. The obligations placed on Data Fiduciaries like adoption of strong technical measures and ensuring data minimization and legitimate processing, are an indication of the government’s intent to foster privacy and innovation both. While the Act grants people the right to access, correct, and delete their data, it also aims to balance such rights, national interest, and ease of doing business.[34] The Digital Personal Data Protection Act and the 2025 Rules represent India’s definitive commitment to building a trustworthy, innovation-friendly digital ecosystem. By placing individuals at the center of the framework while creating clear, proportionate obligations for organizations, the legislation balances privacy protection with economic growth imperatives. The phased 18-month implementation timeline reflects pragmatic policy design, acknowledging that systemic compliance requires time but that the statutory deadline of 13 May 2027. The evolution from the IT Act 2000, through multiple legislative iterations, to the DPDP Act reflects India’s maturation as a digital economy demanding world-class privacy protection. The amendments to the IT Act, the stringent breach notification timelines, the children’s data protections, and the Consent Manager framework all signal a shift toward practical, outcome-based regulation prioritizing individual rights and organizational accountability. [1] Press Release:Press Information Bureau [2] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [3] Press Information Bureau, “DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use,” Government of India, 17 November 2025 - doc20251117695301.pdf [4] ibid [5] ibid [6] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [7] DPDP Rules, 2025: Significant Data Fiduciaries and Data Transfers [8] https://www.legal500.com/developments/thought-leadership/48168/ [9] DPDP Rules 2025: Guidance to DPDP Act implementation [10] Press Release:Press Information Bureau [11] https://www.legal500.com/developments/thought-leadership/48168/ [12] Press Information Bureau, “DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use,” Government of India - doc20251117695301.pdf [13] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [14] c56ceae6c383460ca69577428d36828b.pdf [15] Press Release:Press Information Bureau [16] DPDP Act Compliance Guide 2025 [17] Rule 3 of Digital Personal Data Protection Act, 2023 DPDP Rules 2025 [18] Digital Personal Data Protection Act, 2023 DPDPA SECTION 6 WITH INTERPRETATION [19] Rule 10 of Digital Personal Data Protection Act, 2023 DPDP Rules 2025 [20]https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf [21] DATA FIDUCIARY OBLIGATIONS in The Digital Personal Data Protection Act, 2023. DPPA AND INTERPRETATION 8 [22] Rule 6 of Digital Personal Data Protection Act, 2023 DPDP Rules 2025 [23] Digital Personal Data Protection Act, 2023 DPDPA SECTION 10 WITH INTERPRETATION [24] Digital Personal Data Protection Act, 2023 DPDPA SECTION 16 WITH INTERPRETATION [25] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [26] doc20251117695301.pdf [27] Press Release:Press Information Bureau [28] Rule 2 of Digital Personal Data Protection Rules, 2025 (DPDP Rules 2025) under DPDPA 2023 [29] DPDP Rules 2025: Guidance to DPDP Act implementation [30] Digital Personal Data Protection Act, 2023 DPDPA SECTION 17 WITH INTERPRETATION [31] doc20251117695301.pdf [32] NAVIGATING THE DIGITAL DATA REGIME: AN ANALYSIS OF THE DPDP ACT & DPDP RULES 2025 – Legal Developments [33] Digital Personal Data Protection Act, 2023 DPDPA SECTION 17 WITH INTERPRETATION [34] https://www.legal500.com/developments/thought-leadership/48168/

The Indian system of recognizing and enforcing foreign judgments and arbitral awards is constituted by Sections 13-14 of the Code of Civil Procedure (CPC), 1908[1], as far as judgments are concerned, and Sections 44-52 of the Arbitration and Conciliation (A&C) Act, 1996[2], as far as awards under the New York Convention are concerned.  India has a well-developed legal framework, but it is fraught with many challenges, among them being the problem of jurisdiction fragmentation, rigidity of reciprocity, and loose interpretation of public policy, which culminate in the unpredictability and ineffectiveness of cross-border dispute resolution. The Dual Framework: Reciprocity and Recognition The two-tier reciprocity-based enforcement system still exists in India. Only 13 territories are given notice of recognition of foreign judgments, as opposed to approximately 50 territories of foreign arbitral awards. The newest territory to receive notification of the award is Mauritius in 2015; a ten-year hiatus shows sluggishness in administration. This asymmetry creates serious barriers: where judgements given by non-reciprocating territories require new suits, with the foreign judgement merely evidence, judgements given by reciprocating territories are simply enforced under Section 44A (CPC).[3] According to section 13 (CPC), the judgement made in foreign countries cannot be challenged unless one of the six things occurs: (i) the court lacks the right to hear the case; (ii) the judgement is not made on the merits of the case; (iii) the misuse of international law; (iv) the breach of natural justice; (v) fraud; or (vi) contravention of Indian law.[4] Section 14 is based on the assumption that the court is permitted to make a decision, but the mentioned exceptions make judging creditors more difficult and less predictable.[5] The need to have reciprocity, discretionary government business that does not have a fixed deadline or any specific requirement, makes it extremely difficult to transform India into a reliable settlement business when it comes to international disputes. Public Policy and the Jurisprudential Evolution In the case known as Renusagar Power v. General Electric (1993), the Supreme Court, in its landmark decision, defined public policy very strictly, believing that such a policy could be implemented only when it was against the basic interests of India, justice, or morality.[6] This was recognized internationally as a good example and went along with the simple approach of the New York Convention. But ONGC Ltd. v. Saw Pipes Ltd. (2003) altered this line of thinking. ONGC appealed against an arbitral award in a bid to reestablish substantive merit review and argued that it was shocking to the conscience and patently illegal.[7] The Court adopted a wider perspective of the public policy, which could be intervened in terms of illegality. This was altogether contrary to the pro-enforcement bias of the Convention. To prevent destabilisation, the Supreme Court in Ssangyong Engineering & Construction Co. v. National Highways Authority (2019) reiterated the narrow Renusagar meaning of the foreign awards in Section 48(2)(b). The Court indicated that the omission of patent illegality (since the 2015 Amendment to provide it where domestic arbitration is awarded pursuant to Section 34(2A) was accidental to ensure that India remained a good venue to conduct arbitration.[8]  The difference remains a legal issue, yet it demonstrates that the lawmakers still intended to refer to the law when creating the New York Convention in the law. The 2019 ruling in Vijay Karia v. Prysmian developed the theory believing that the technical breach of the foreign exchange laws does not necessarily mean that the enforcement cannot be made unless they are directly contradictory to the core policy.[9] Judges have taken a more advanced pro-enforcement position as it is evident in their recognition that international business transactions cannot be avoided. Recognition of Foreign Judgments in Family Law The most appropriate example of the conflicts between the philosophy of reciprocity and the constitutional right to personal law is marital disputes. The personal law system, which is based on Articles 25-28 of the Constitution, is what complicates the process of recognizing divorce and custody orders made in other countries in India. Foreign divorce decrees that satisfy the requirements that are set under Section 13 are generally recognizable as decided by the Supreme Court.[10] Ex parte decrees, however, have their own problems, especially in instances where the respondents had not been approached or surrendered to jurisdiction. Indian courts may deny recognition in custody cases in cases where they believe that it would not be in the best interest of the child according to Indian standards. Despite the safeguarding role of this judicially developed override, it poses an uncertainty to the NRI parties that seek foreign contracts. Jurisdictional issues have only worsened because of the rise in NRI suits; Indian courts are presently claiming matrimonial jurisdiction where both parties are outside the country, with the principles of domicile or solemnization of a marriage as the arguments.[11] Emerging Issues Concurrent Jurisdiction and Conflicting Judgments: Section 10 (CPC) permits the concomitant action in Indian and foreign courts.[12] Though the Indian courts have the right in principle to stay proceedings using the doctrine of forum non conveniens, they rarely do so and demand evidence of either grave injustice or oppressive circumstances. This high threshold enables the existence of parallel proceedings, and it may consequently escalate the cost of litigation. Evidentiary Verification Challenges: The e-commerce, cyber-torts, and international e-data transfer issues challenge the traditional notions of jurisdiction in the digital era. Section 14 with the presumption of competence, is not enough to determine the existence of digital notices being in the due process or the existence of online behaviour in creating a jurisdictional contact. Owing to the lack of a defined procedure for assessing the validity of digital evidence, Indian jurisprudence is vulnerable to false allegations. Non-Reciprocating Territories: In the Government of India v. Vedanta Limited (2020), the court established a 3-year statute of limitations to invoke enforcement petitions under Article 137 of the Limitations Act.[13] It is not exactly known when the accrual will take place; however, where awards are offered by remote arbitrators, or in a foreign language, or where secrecy conditions are added. The jurisprudential evolution of the requirement of a sufficient cause of delay condonation has not emerged yet. Patent Illegality Asymmetry: The 2015 Amendment, which deliberately leaves out the enforcement of foreign awards (Section 48) and introduces the illegality of patent domestic awards (Section 34(2A)), leads to the incoherence of its doctrines.[14] This difference may frustrate the intention by India to become a regional arbitration center because it will prompt it to manipulate the forums and deter any foreign party from choosing India as the arbitration venue. Constitutional Dimensions and Sovereignty The Indian Constitution adds complexity to the matter. The implementation of a foreign judgment can come into conflict with the declaration of the Fundamental Rights enforceable against the State under Part III (Articles 12-35).[15] Foreign judgments so disobedient to constitutional protectors as discrimination or infringement of freedom may be rejected on section 13(f) or public policy grounds.  The point at which constitutionalism and recognition become one, exactly, however, is not well understood. It has not been determined how to calculate whether the enforcement of foreign judgments constitutes a significant enough violation of the Constitution to justify non-recognition.  The extraterritorial application of Indian regulatory standards by foreign judgments also raises sovereignty concerns.  It remains ambiguous whether the distinction between lawful disputes and unlawful extraterritorialization is crossed, even with the ruling of the Vijay Karia case in favour of global commercial efficacy and not rigid regulatory protection.[16] Comparative Perspectives Comparative analysis indicates that India is rather weak in comparison to others. All three, UK, Singapore, and the US, are presumptively pro-enforcement regimes that have very limited grounds of refusal and significantly restricted appellate review.[17] Significantly, such jurisdictions have come to be known as well for foreseeable and light-touch types of jurisprudence, and have aimed to host international dispute resolution business. The reciprocity requirement of India, the frequent expansionism of the Indian public policy in the face of retrenchment, and the fragmentation of the jurisdictions provide an environment that is perceived to be less predictable than that of the peer jurisdictions.[18] This has a massive implication on the Indian effort to embrace international dispute resolution and the enforcement of Indian judgments across borders. Recommendations for Reform Legislative Reforms: (i) Specify methods to be followed in notifying of any additional reciprocating territories; (ii) A uniform code of Principles of Private International Law must be enacted.[19] (iii) Provide definitions of levels of public policy tiers, one of constitutional principle, which may not be recognized and enforced, and another of regulatory norm, where enforcement will proceed. (iv) Cross-border expertise in special commercial courts. Judicial Reforms: (i) Consolidate fragmented jurisprudence on forum non conveniens and issue preclusion. (ii) Develop standardized digital evidence protocols. (iii) Establish principled constitutional dialogue regarding fundamental rights' intersection with recognition. International Engagement: India ought to have ratified the Convention on Choice of Court Agreements, 2005[20], and engaging in international harmonization of instruments would bring it to the par with the international best practice. Indicatively, cross-border enforceability would be greatly enhanced by expanding huge portions of reciprocating territories with large trading partners-such as the United States. Conclusion The system that regulates the enforcement of foreign judgments and awards in India is not only doctrinally sophisticated but also largely inefficient. Principled tests as laid down by the basic enabling statutes and Supreme Court jurisprudence, i.e., Renusagar and Ssangyong, are highly in line with the international best practice. Predictability and efficiency are sucked out by reciprocity rigidity, constitutional grey areas, concurrency, and technological issues. As a regional arbitration center, India rationally requires systematic reforms in the spheres of legislative clarity, perfection by the judicial body, institutional facilities, and international institutions relations. In the course of such reforms, it is possible to maintain constitutional safeguards and internal legal autonomy in India, and this will help it to become more competitive within the world commercial dispute resolution environment and make a positive contribution to enhancing cross-border commercial confidence. [1] Code of Civil Procedure, 1908, §§ 13–14 (India). [2] Arbitration & Conciliation Act, 1996, §§ 44–52 (India). [3] Code of Civil Procedure, 1908, § 44A (India). [4] Code of Civil Procedure, 1908, § 13 (India). [5] Code of Civil Procedure, 1908, § 13 (India). [6] Renusagar Power Co. Ltd. v. Gen. Elec. Co., (1994) Supp. (1) SCC 644 (India). [7] Oil & Nat. Gas Corp. Ltd. v. Saw Pipes Ltd., (2003) 5 SCC 705 (India). [8] Ssangyong Eng’g & Constr. Co. Ltd. v. Nat’l Highways Auth. of India, (2019) 15 SCC 131 (India). [9] Vijay Karia v. Prysmian Cavi e Sistemi SRL, (2020) 11 SCC 1 (India). [10] Code of Civil Procedure, 1908, § 13 (India). [11] Satya v. Teja Singh, (1975) 1 SCC 120 (India). [12] Code of Civil Procedure, 1908, § 10 (India). [13] Gov’t of India v. Vedanta Ltd., (2020) 10 SCC 1 (India). [14] Arbitration & Conciliation Act, 1996, §§ 34(2A) & § 48 (India). [15] India Const. arts. 12–28. [16] Vijay Karia, (2020) 11 SCC 1. [17] Restatement (Third) of Foreign Relations Law § 482 (Am. L. Inst. 1987); Foreign Judgments (Reciprocal Enforcement) Act 1933 (U.K.). [18] Saw Pipes, (2003) 5 SCC 705. [19] See generally Gary Born, International Commercial Arbitration (3d ed. 2021). [20] Hague Convention on Choice of Court Agreements, June 30, 2005, 44 I.L.M. 1294. Author: Mr. Akhand Pratap Singh Chauhan, Partner

Abstract Cryptocurrencies and digital assets are now embedded within the corporate balance sheets, investment portfolios, and individual wealth. Their pseudonymous decentralized, and borderless characteristics pose unique difficulties for insolvency practitioners tasked with asset tracing and recovery. This article examines the conceptual and practical challenges of tracing cryptocurrencies in insolvency proceedings, evaluates the legal status of such assets across jurisdictions, and explores judicial developments that shape recovery strategies. Imploring on judicial precedents, statutory guidelines, this article argues for the integration of blockchain analytics, international cooperation, and statutory reform to improve outcomes for creditors. I. Introduction The advent of cryptocurrency has ushered in a paradigm shift in global finance, often described as – ‘the dawn of decentralized era’. This has, in turn, posed novel challenges for the framework of insolvency proceedings. Unlike traditional insolvency practice, where professionals address tangible properties, securities, and bank deposits; digital assets are intangible, borderless and accessible solely through private cryptographic keys on decentralized ledgers. This fundamental difference raises complex questions regarding valuation, custody, and recovery in insolvency proceedings, challenging established legal doctrines and procedural framework. With the continuous expansion of digital assets, it becomes imperative to examine how insolvency laws must adapt to address the unique characteristics and risks posed by cryptocurrencies. The Insolvency and Bankruptcy Code, 2016 (‘IBC’) defines ‘property’ in broader terms but does not explicitly enumerate Virtual Digital Assets (‘VDA’) such as cryptoassets.[1] This lacuna has led to uncertainty: should cryptocurrencies be regarded as property capable of tracing and recovery, or merely as contractual rights lacking proprietary status? Addressing the same, in AA v Persons Unknown, the English High Court recognized that cryptocurrency constitutes property and may be subject to a proprietary injunction.[2] Likewise, the Singapore High Court in CLM v CLN, affirmed that cryptocurrencies qualify as property for the purpose of proprietary remedies.[3] The paradox of cryptoassets is that they are simultaneously transparent and opaque. On one hand, blockchains provide immutable public ledgers of transactions. On the other, pseudonymity and complex technologies make linking wallets to real-world debtors difficult. This duality complicates insolvency proceedings, challenging tracing, valuation and distribution of such assets. II. Taxed but not Tender: Legislative Intent on Recognition of Cryptocurrency The legal status of cryptocurrency in India reflects a cautious yet evolving regulatory approach. While cryptocurrencies are not yet recognized as legal tender, they are permitted to be bought, sold, and held as Virtual Digital Assets under the Income Tax Act, 1961. Judicially, the Supreme Court in Internet and Mobile Association of India v Reserve Bank of India,[4] set aside the RBI’s 2018 ban[5] on banking facilitation of cryptocurrency transactions, reaffirming constitutional freedom to trade in such assets. Subsequent legislative developments, including the proposed but unpassed Cryptocurrency and Regulation of Official Digital Currency Bill, 2021, highlighted the State’s intent to restrict private cryptocurrencies while exploring a central bank digital currency. However, with the Union Budget 2022, the government opted for a taxation regime instead – introducing a 1% TDS under Section 194S and a 30% tax on gains under Section 115BBH of the Income Tax Act – thereby acknowledging the legitimacy of crypto transactions as taxable events without according them the status of currency.[6] Parallelly, the regulatory framework has shifted towards compliance and monitoring. In March 2023, the Ministry of Finance issued a notification bringing VDA service providers within the definition of ‘reporting entities’ under section 2(1) (wa) of the Prevention of Money Laundering Act, 2002.[7] Consequently, exchanged and service providers are now required to register with the ‘Financial Intelligence Unit’ and adhere to ‘anti-money laundering’ obligations.[8] This has already resulted in 28 VDA platforms securing registration as reporting entities.[9] The combined effect of these measure reveals a legislative and regulatory trajectory that, while avoiding full recognition of cryptocurrency as money, positions it firmly within India’s taxation and compliance architecture. III. The Core Dilemma of Asset Tracing in Insolvency Tracing cryptoassets in insolvency proceedings poses significant challenges. Their anonymous nature, accompanied with privacy-enhancing tools, and rapid price volatility complicates the identification, recovery and valuation. Traditional approach used for bank accounts and other assets are often inadequate. The following sections examine the key issues: establishing ownership, navigating concealment strategies, and addressing valuation difficulties.   i. Identification of Ownership Establishing ownership of cryptoassets is a central challenge in insolvency proceedings given their anonymous nature and reliance on privacy tools. Courts across multiple jurisdictions have recognized cryptocurrencies as property, enabling proprietary remedies to recover misappropriated assets. As discussed earlier, in AA v Persons Unknown, the English High Court held that cryptocurrency qualifies as property and granted a proprietary injunction, emphasizing the importance of forensic evidence and tracing transactions. Similarly, in CLM v CLN, the Singaporean Court confirmed that cryptocurrencies constitute property under common law principles and allowed a worldwide freezing order against persons unknown. In addition to this, precedents such as Fetch.ai Ltd. v Persons Unknown[10] and Ion Science Ltd. v Persons Unknown[11]  further highlight the use of proprietary injunctions and third-party debt orders to identify wallet owners and recover assets. In Robertson v Persons Unknown[12] [2019] EWHC 358 (Comm) and D’Aloia v Persons Unknown[13] [2020] EWHC 1410 (Comm), the Court reinforced the need for disclosure orders compelling exchanges or intermediaries to reveal wallet ownership. These judgements collectively demonstrate that effective identification of cryptoasset ownership often relies on a combination of forensic blockchain analysis, information from cryptocurrency exchanges, and legal mechanisms like injunctions and disclosure orders. The accumulated jurisprudence establishes that while blockchain’s transparency aids tracing, the anonymous and decentralized nature of cryptoassets requires innovative legal tools and careful evidentiary strategies to connect digital wallets to their rightful owners in insolvency proceedings.   ii. Assets Concealment Strategies The corporate debtors indulge in exploiting various technological tools to frustrate tracing efforts in insolvency proceedings. Mixing services and tumblers, obscure the provenance of funds by pooling and redistributing cryptocurrency among various users, posing it difficult to trace the original source of assets. Privacy-focused cryptocurrencies complicate tracing due to their built-in features that conceal transaction details, including sender and receiver information. ‘Decentralized Exchanges’ (DEXs) without robust ‘anti-money laundering’ (‘AML’) mechanism and ‘Know Your Customer’ (‘KYC’) controls allow rapid and anonymous conversion, enabling debtors to move assets without detection. In response to these challenges, legal system across various jurisdictions have begun amending existing legal framework. In United States of America, the Department of Justice have charged individuals operating crypto mixers under ‘the Bank Secrecy Act’, emphasizing the need for compliance with AML regulations.[14] In addition, the blockchain analytics firms are developing advanced tools to detect and mitigate the risks associated with anonymous strategies, aiming to enhance the traceability of cryptoassets transactions. However, the evolving nature of these technologies presents ongoing challenges for the insolvency practitioners seeking to trace and recover assets effectively.   iii. Challenges in Valuation The valuation of cryptoassets poses significant challenges due to their volatility and the absence of standardized valuation methods. Thus, it makes imperative to ascertain whether the valuation of assets be at the date of commencement of insolvency proceeding, date of realization or date of distribution.  In the case of Mt. Gox Co. Ltd.[15], the Tokyo Court commenced bankruptcy proceedings in February 2024 following the disappearance of approximately 744,800 Bitcoins, valued around $ 473 millions. As of July 2022, approximately 142,000 Bitcoins were located, but the distribution process has been protracted and fraught with challenges. The creditors of the company received distributions based on the value of Bitcoin at the time of insolvency filing, not its later surge, thus causing significant inequity. In FTX Trading Ltd. v Vara,[16] the United States Bankruptcy Court issued a ruling in the FTX Chapter 11 of bankruptcy case, providing guidance on estimating the value of cryptocurrency claims. This decision marked a significant development in the legal treatment of cryptoassets under insolvency proceedings, establishing a framework that could influence future cases. These cases underscored the complexities and uncertainties associated with valuing cryptoassets in the regime of insolvency laws. The lack of established precedents and the volatile nature of cryptocurrencies necessitate careful consideration and innovative approaches by the insolvency practitioners to ensure fair and equitable treatment of creditors. IV. Property or Contractual Right? Why Classification Matters The legal classification of cryptoassets is not a mere academic exercise; it fundamentally determines the remedies available to creditors and insolvency practitioners. Accordingly, crypto being recognized as ‘property’, it opens the door to proprietary remedies – such as constructive trusts, tracing and injunctions – that offer stronger protection and recovery prospects. Conversely, if treated only as contractual rights, creditors are left as unsecured creditors with limited recovery. Thus, the classification debate goes to the heart of how law responds to cryptoassets insolvency.   i. The Property Debate The classification of cryptoassets as ‘property’ is pivotal: it enables remedial frameworks like constructive trusts, tracing, and proprietary injunctions, while a contractual-only characterization relegates creditors to unsecured claims with lower recovery priority. Jurisprudence established across other jurisdictions has largely settled this debate: for instance, in Ruscoe v Crytopia Ltd.,[17] the New Zealand High Court held that cryptocurrency indeed constitutes property. The Court applied the ‘four-part test’ from National Provincial Bank Ltd. v Ainsworth[18] – definability, identifiability by third parties, transferability, and permanence. Conversely, Indian jurisprudence has not yet ventured into this debate with clarity. In Internet and Mobile Association of India v Reserve Bank of India,[19] the Supreme Court invalidated the RBI’s ban on banking facilitation of cryptocurrency transactions on grounds of proportionality and protection of constitutional freedoms under Article 19(1)(g),[20] but deliberately sidestepped the question of whether cryptoassets are property under Indian laws. This omission leaves insolvency framework in India operating within an uncertain legal landscape, with no clear path to employing proprietary remedies for cryptoassets. ii. International Divergences The legal status of cryptoassets remains fragmented across jurisdiction, with courts adopting divergent approaches to classification. In the United States of America, bankruptcy courts have generally treated cryptocurrencies as part of the debtor’s estate under Section 541 of U.S. Bankruptcy Code.[21] Notably, in re Hashfast Technologies LLC,[22] the court recognized Bitcoin as property of the estate, thereby enabling the trustee to pursue avoidance and recovery actions in respect of crypto transfers. By contrast, China has displayed inconsistency. While certain decisions have treated cryptoassets as property entitled to legal protection – as in Li et al. v Liu (Stenzhen Intermediate People’s Court, 2019) – other rulings, following regulatory prohibitions, have emphasized that cryptocurrencies cannot function as legal tenders or tradable financial assets. This divergence underscores the absence of a settled global consensus. Whereas jurisdictions like the United States adopt a functional property analysis to safeguard creditor rights, China’s courts are constrained by regulatory bans, often relegating cryptoassets to a quasi-property status without full proprietary recognition. These differences highlight the risks of cross-border proceedings involving cryptoassets, where the remedies available to creditors may depend less on the nature of the assets than on the forum in which recover is sought. V. Policy and Legislative Reforms for the Digital Assets Era As comparative jurisprudence shows, jurisdictions that recognize cryptoassets as property have made meaningful strides in insolvency recovery. For India to avoid lagging behind, a coherent policy and legislative response must address disclosure, valuation and cross-border cooperation in digital asset cases.   i. Statutory Recognition and Disclosure Obligations The first and most pressing reform is to amend the Insolvency and Bankruptcy Code, 2016 to expressly recognize digital assets as ‘property’. Presently, the definition of property under Section 3(27) is broad,[23] but its silence on digital assets breeds uncertainty. Codifying cryptoassets as property would align Indian law with international standards and enable insolvency professionals to employ proprietary remedies such as tracing, freezing and constructive trusts. Debtors should be statutorily required to disclose all wallet addresses, holdings on centralized exchanges, and details of private key custodians. Failure to disclose should attract penalties akin to concealment of assets under existing insolvency laws. Such obligations would mirror disclosure standards in jurisdictions like the United States, where trustees can demand wallet information under Section 521 of 11 United States Code.[24] Without disclosure, the tracing mechanism remains speculative.   ii. Specialized Divisions and Cross-border Cooperation. Given the technical nature of digital assets, the legislatures should consider establishing specialized benches or expert panels within the NCLT/NCLAT. These divisions could be staffed with judicial members and technical experts in blockchain forensics, ensuring informed adjudication. This mirrors developments in other jurisdictions where specialized financial courts handle complex asset recovery cases. As crypto-transactions are inherently borderless, domestic reforms must be supplemented with international cooperation. India must adopt and adapt UNCITRAL’s Model Law on Cross-Border Insolvency,[25] which facilitates cooperation between courts of different jurisdictions. Enhanced use of ‘Mutual Legal Assistance Treaties’ (MLATs) and direct judicial communication channels will be critical in tracing assets across exchanges and jurisdictions.   iii. Infrastructural Capacity Finally, institutional capacity must be strengthened. Insolvency professionals, judicial members and regulators require training in blockchain technology, custody mechanisms, and forensic techniques. Investment and partnerships with forensic forms and academic institutions could create a sustainable ecosystem of expertise. Without this capacity, even the strongest statutory reforms risk under-enforcement. VI. Conclusion and Way Forward Tracing and recovering digital assets in insolvency represents one of the most pressing frontiers of modern commercial law. Foreign jurisdiction has begun to chart a path – recognizing cryptoassets as property, experimenting with proprietary remedies, and developing jurisprudence on valuation and recovery. India, by contrast, still grapples with statutory silence and limited judicial engagement, leaving insolvency professionals uncertain about the scope of their powers. The way forward lies in a multi-pronged strategy: legislative reform to expressly classify virtual digital assets as property under the Insolvency and Bankruptcy Code; procedural innovations such as mandatory disclosure of wallets and custodians; and institutional investment in technical expertise and cross-border cooperation. Embracing these measures, India can equip an insolvency regime that is both technologically attuned and creditor-protective-ensuring that digital assets are no longer insulated from accountability, but integrated into the fabric of commercial justice. [1] Section 3(27), Insolvency and Bankruptcy Code, 2016. [2] AA v Persons Unknown, [2019] EWHC 3556 (Comm). [3] CLM v CLN, [2022] SGHC 46. [4] Internet and Mobile Association of India v Reserve Bank of India, (2020) 10 SCC 274. [5] RBI’s Prohibition on dealing in Virtual Currencies, https://www.rbi.org.in/commanman/english/scripts/Notification.aspx?Id=2632. [6] Section 115BBH and 194S, Income Tax Act, 1961. [7] Section 2(1)(wa), Prevention of Money Laundering Act, 2002. [8] The Global Legal Post,  https://www.globallegalpost.com/lawoverborders/cryptoassets-1166537785/india-113459270?utm_source=chatgpt.com#4 [9] The Economic Times, Compliance of VDA Platforms to FIU-India https://economictimes.indiatimes.com/tech/technology/28-virtual-digital-assets-platforms-register-with-fiu-india-to-comply-with-pmla-norms/articleshow/105727721.cms [10] Fetch.ai Ltd. v Persons Unknown, [2021} EWHC 2254 (Comm). [11] Ion Science Ltd. v Persons Unknown, [2020] EWHC 290 (Comm). [12] Robertson v Persons Unknown, [2019] EWHC 358 (Comm). [13] D’Aloia v Persons Unknown, [2020} EWHC 1410 (Comm). [14] The Bank Secrecy Act, 31 USC 5311, United States of America. [15] In Re Mt. Gox Co. Ltd., 2014(Fu) No. 3830, Tokyo Bankruptcy Courts. [16] FTX Trading Ltd. v Vara, No. 23-2297 (3rd Cir. 2024), United States Bankruptcy Court. [17] Ruscoe v Crytopia Ltd., [2020] NZHC 728. [18] National Provincial Bank Ltd. v Ainsworth, [1965] AC 1175 (HL). [19] Internet and Mobile Association of India v Reserve Bank of India, (2020) 10 SCC 274. [20] Article 19(1)(g), Constitution of India, 1950. [21] Section 541, United States Bankruptcy Code (Tittle 11 of United State Codes). [22] In re Hashfast Technologies LLC, No. 14-30725 (Bankr.N.D.Cal.2016). [23] Section 3(27), Insolvency and Bankruptcy Code, 2016. [24] Section 521, United States Bankruptcy Code (Tittle 11 of United State Codes). [25] UNCITRAL’s Model Law on Cross Border Insolvency, 1997. Authored by Mr. Ketan Joshi, Senior Associate

INTRODUCTION In a global marketplace where product safety, consumer rights and regulatory compliance are paramount, foreign manufacturers seeking access to the Indian market must contend with robust standards. The Foreign Manufacturers Certification Scheme (“FMCS”) of the Bureau of Indian Standards is one such standard that determines whether manufactured goods made in foreign jurisdictions may bear the BIS Standard Mark and be brought into India lawfully. FMCS is not merely a regulatory requirement; rather it is a strategic touchstone for global companies. Compliance under FMCS confers legitimacy, operational certainty, and legal safety in dealings involving India’s regulatory framework. Hence, an informed and pragmatic understanding of FMCS is critical to balancing compliance obligations with commercial objectives in the Indian market. BUREAU OF INDIAN STANDARDS The Bureau of Indian Standards (“BIS”) is India’s national standards body, established under BIS Act, 2016. Functioning under the aegis of Department of Consumer Affairs under Ministry of Consumer Affairs, Food, and Public Distribution, BIS plays a pivotal role in safeguarding quality, safety and reliability across goods and services in India. Its mandate extends beyond formulating Indian Standards; it is also the authority for conformity assessment, product certification, hallmarking, laboratory recognition, and consumer protection initiatives. Through its certification schemes like FMCS, CRS and Scheme X under Machinery and Electrical Equipment Safety (Omnibus Technical Regulation) Order, 2024, BIS ensures that both domestic and imported products meet rigorous and safety benchmarks. THE FOREIGN MANUFACTURERS CERTIFICATION SCHEME FMCS is a scheme through which foreign manufacturers obtain BIS Certification for goods exported to India, enabling use of Standard Mark. The scheme ensures that foreign goods meet Indian safety, quality and conformity standards prior to import. FMCS acts as a quality assurance filter for products manufactured abroad. The BIS operates both voluntary and mandatory certification regimes. Voluntary certification applies to products that are not yet covered by a Quality Control Order (“QCO”), which is issued by concerned ministries under Government of India. In such cases, manufactures may still choose to obtain BIS license and use the ISI Mark as a mark of quality and assurance. By contrast, mandatory certification applies to all products notified under QCOs. Once notified, certification under the relevant BIS scheme becomes a legal prerequisite for import, distribution, and sale in India. As of March 2025, the Government of India has issued 187 QCOs, covering 769 product categories, including cement, steel bars, pipes, pressure cookers, gas stoves, electric water heaters, kitchen appliances, cookware, LED lights, helmets, goggles, infant food, packaged drinking water and mineral water (IS 14543/IS 13428) etc. Scope of FMCS The scope of FMCS is intentionally broad, covering almost all manufactured goods. The only carve-out relates to electronics and IT products, which are separately regulated under the Compulsory Registration Scheme (“CRS”) of the Ministry of Electronics and IT (“MeitY”)[1]. Exempted products include laptops, tablets, mobile phones, LED luminaires, televisions, UPS Systems, CCTV equipment, power banks, and solar photovoltaic modules, among others. Grant of License[2] The application procedure is a critical step in authorizing foreign manufactured products to carry the BIS Standard Mark for sale or import into India. The application procedure goes as prescribed below: Application Submission – When an applicant, who necessarily have to be the foreign manufacturer, submits a complete application with the requisite fees[3] of INR 1000, as prescribed, the BIS records the same for scrutiny. Scrutiny and Clarification - BIS conducts a detailed review of the submitted documents. If there are deficiencies, the same are communicated via email, and the applicant is required to respond satisfactorily. Factory Verification and Sample Drawal – A site visit to the foreign manufacturing premises is conducted by the BIS Inspectors to inspect manufacturing units and testing capabilities. Inspectors shall draw sample(s) that will go independent testing. It is pertinent to note that samples for grant and subsequent operation of license shall be tested at BIS or BIS recognized labs[4]. The applicant is responsible for the safe deposit of samples and for remittance any testing charges. Independent Testing and Inspection Report - The license will be processed for grant of license only after satisfactory inspection report. Fee, Marking Fee, and Outstanding Dues – Prior to grant of license, the applicant must pay the license fee, the advance minimum marking fee, and clear any other outstanding dues. Legal Undertaking and Financial Security – The foreign manufacturer must execute necessary documentation including an Agreement and an Indemnity Bond. Additionally, a performance bank guarantee of USD 10,000 from a bank with a branch in India approved by Reserve Bank of India is required immediately after grant of license. The average period for grant of license under FMCS is approximately six months, counting from the date the application is formally recorded. The license under FMCS is granted initially for a minimum of one year and up-to two years. Renewal is possible for up-to five years[5]. AUTHORIZED INDIAN REPRESENTATIVE  A distinctive feature of the FMCS is the requirement that every applicant shall nominate an Authorized Indian Representative (“AIR”)[6] in Form VI of Scheme I. The AIR acts as the local point of accountability and is legally responsible for ensuring compliance with the BIS Act, 2016, the rules and regulations framed thereunder, and the terms of the certification license. An AIR shall be an Indian resident and appointed in following manner[7]: (A) In-charge or a senior officer of the liaison office/subsidiary firm/branch office in India. If is not possible, then option (B) below. (B) Proprietor/ Registered user/ subsidiary firm / branch office/ liaison office of the Brand/Trade mark appearing on the article. If (B) is not possible, then option (C) below. (C) Major importer/distributor/entity having marketing tie up with the brand owner and / or the manufacturer. If (C) is not possible, then option (D) below. (D) A legally appointed agent of the manufacturer in India. To maintain accountability and integrity: AIR(s) shall not have any conflict of interest with respect to their role as AIR with Product Compliance Reporting. AIR(s) shall be at least graduate by qualification and shall understand the provisions of BIS Act, 2016 and rules, regulations framed thereunder and the implications thereof. AIR(s) shall declare his/her consent to be responsible for compliance of the BIS Act, Rules, Regulations and Terms & Conditions as laid down in BIS certification, Agreement, Undertaking executed by or on behalf of the foreign manufacturer in connection with grant and operation of certification The name of AIR(s) is endorsed in the certification document In case of change of AIR and/or his/her address, the foreign manufacturer shall be required to inform BIS well in advance with the required documents Responsibilities of AIR AIR shall ensure compliance of terms and conditions of the agreement signed by them, provisions of the Bureau of Indian Standards Act, 2016 and Rules, Regulations framed thereunder and the applicable Indian laws. The Bureau may ask AIR as an authorized representative to appear before it for representation as and when required. AIR shall not engage in any unethical practices such as communicating with laboratory with regard to testing of samples (except for deposition of sample and payment of testing charges), tampering of documents, misrepresentation of facts etc. AIR shall maintain confidentiality of all the information. AIR shall facilitate and ensure drawl of market samples from the consignments being imported to India under BIS certification In case of non-cooperation of AIR, actions will be initiated as per the BIS (Conformity Assessment) Regulations, 2018 which may include suspension/cancellation of certification[8], compensation to consumers[9]. The Manufacturer or his representative can be held personally liable for non-compliance of BIS Act 2016, rules and regulations framed thereunder. The coveted BIS Standard Mark is a powerful symbol of quality and safety in the Indian consumer’s mind. It directly enhances brand credibility and provides a distinct competitive advantage in a crowded place. This certification not only facilitates direct to consumer sales but also opens the door to lucrative public procurement contracts, a significant channel for business growth in India. Importers and distributors, keen to avoid regulatory liabilities and operational disruptions, often prioritize certified products. The Gauntlet of Entry Despite these clear advantages, the path to certification is a demanding one. The process is notoriously resource intensive, imposing substantial costs and administrative burden. For small and medium-sized enterprises, in particular, the financial outlay for adapting production process, conducting inspections, and maintaining ongoing compliance can be a significant barrier to entry. Apart from this, manufacturers must meticulously align their production methods and quality control systems with detailed Indian standards; this involves extensive documentation, continuous record-keeping, possible site-inspections. These administrative demands can disrupt routine operations and lead to protracted delays. CONCLUSION The Foreign Manufacturers Certification Scheme is a critical framework for foreign manufacturers exporting goods to India. The Scheme ensures that foreign products meet India’s rigorous safety, quality, and conformity standards prior to import. While the application process is comprehensive involving a detailed review, onsite factory verification, and independent sample testing, the most distinctive requirement is the appointment of an Authorized Indian Representative (“AIR”). The AIR acts as the local point of accountability and is legally responsible for compliance with the BIS Act, 2016, and the terms of the certification license. Ultimately, the FMCS acts as a quality assurance filter and is a foundational step for ensuring a stable and legally safe commercial presence in the Indian market. [1] https://www.bis.gov.in/fmcs/certification-process/products-under-fmcs/ [2] https://www.bis.gov.in/fmcs/certification-process/grant-of-licence/ [3] https://www.bis.gov.in/wp-content/uploads/2021/06/LIST-OF-FEE-3.pdf [4] https://www.bis.gov.in/fmcs/fmcs-laboratories/ [5] https://www.bis.gov.in/fmcs/renewal-of-licence/ [6] https://www.bis.gov.in/fmcs/certification-process/nomination-of-air/ [7] https://www.heavyindustries.gov.in/sites/default/files/2025-08/guidelines_for_grant_of_certification.pdf [8] https://bis.gov.in/PDF/cart/GoLGuidelines_23082018.pdf [9] https://bis.gov.in/wp-content/uploads/2020/12/BIS-Act-2016-Bilingual.pdf (Section 31, pg 14) Authored by Ms. Jyotsna Chaturvedi, Head - Corporate Practice and Ms. Navya Saxena, Associate.  

The intersection of fashion and intellectual property (IP) presents a complex and often contradictory legal landscape. In contemporary fashion, the cyclical emergence of trends poses complex challenges for legal protection, particularly in the context of intellectual property (IP). A central and on-going question in this context is whether a design can be so "trendy" or common that it cannot receive trademark protection. This inquiry examines the main principles of trademark law, particularly the ideas of distinctiveness and aesthetic functionality. It also highlights the risky situation for a design that suffers from its own commercial success. Trademark Law in Fashion: Foundational Principles Trademark law is vital in the fashion world, serving as a legal mechanism that safeguards distinctive elements, like a brand’s name, logo, or design that differentiate its offerings from others. However, its scope is limited; it does not extend to every creative aspect, but rather focuses on protecting identifiers that signify brand origin. Instead, it aims to help consumers consistently recognize the origin of goods and services based on distinctive signs, safeguarding both consumer trust and commercial goodwill. Each creation represents an intangible asset that, if not adequately protected, may be vulnerable to imitations, counterfeiting, and strategic information leaks that could compromise the company’s position. India’s trademark system operates under the provisions of the Trademark Act enacted in 1999. It enables designers to secure legal rights over brand names, logos, emblems, or even distinctive visual elements that define their fashion lines. Trademark law in fashion is anchored in several core principles. First, a mark must possess distinctiveness, to be recognized as identifying a specific source. Secondly, the non-functionality rule ensures that utilitarian features. To secure legal protection, trademarks must be actively utilized in the marketplace. This entails their visible presence on products or within advertising materials, serving to identify and distinguish the source of goods or services. Mere registration without genuine commercial use does not suffice; continuous and lawful use is essential to establish and maintain trademark rights. Finally, trademark law provides protection against consumer confusion, allowing fashion brands to take action against imitators whose products may mislead consumers about their origin. Why Most Fashion Designs Don't Qualify for Trademarks Fashion designs, despite their inherent creativity, rarely secure trademark protection due to specific legal criteria. Trademark law primarily guards’ elements that uniquely identify a product's source. Most clothing designs—be it particular cuts, silhouettes, or aesthetic details—are perceived as decorative or functional rather than brand identifiers. Unless a design achieves singular, widespread recognition as originating from one specific company (e.g., Burberry's distinct check), it falls short of this core trademark purpose. A key hurdle is distinctiveness. Designs must either be inherently unique or gain consumer association with a single source through extensive, exclusive use, as exemplified by Louis Vuitton's renowned monogram. However, fashion trends, by their very nature, are widely adopted and imitated, rapidly diluting any potential distinctiveness and preventing them from serving as reliable source indicators. Furthermore, trademark law excludes features that are primarily functional or essential to a product's use, such as a basic garment construction. Similarly, purely ornamental elements that don't convey commercial origin, like generic patterns, are not eligible for trademark status. This framework also aims to preserve the "fashion commons," preventing perpetual monopolies over design elements crucial for the industry's artistic and economic dynamism, thereby fostering continuous innovation rather than hindering it. The Impact of Trendiness on Trademark Eligibility A fashion design that is too trendy is often, by nature, fleeting and widely adopted by many actors in the industry. This widespread adoption undermines its distinctiveness—a core requirement for trademark registration. When a trend is generic, ephemeral, or lacking in source-identifying function, trademark protection is inappropriate: Furthermore, when a design becomes popularized across the market, it risks being viewed as a common style rather than a proprietary mark. As a result, the more a fashion feature blends into a trend, the less likely it is to qualify for trademark protection, as it may fail to signal a single source or avoid consumer confusion. In Aditya Birla Fashion and Retail Ltd. v. Manish Johar,[1] Aditya Birla Fashion, owner of the “ALLEN SOLLY” brand, discovered that Manish Johar was manufacturing and selling counterfeit goods bearing deceptively similar branding. These products were also being circulated online. The Hon’ble Saket District Court recognized plaintiff’s trademark rights and found that the defendant’s goods were intended to deceive consumers. Permanent injunctive relief was granted, and the Hon’ble Court ordered that counterfeit stock be seized and destroyed. This ruling showcased Indian court’s increasing attention to impose stringent remedies against counterfeiting, including injunctions and destructions of infringing products, thereby protecting consumer trust and brand’s goodwill. In the case of Ritika Private Limited v. BIBA Apparels Private Limited[2], owner of the celebrated “RITU KUMAR” label sued BIBA Apparels. Ritika alleged that BIBA had copied its garment designs. However, the Hon’ble Delhi High Court clarified that once an artistic work is industrially applied and reproduced more than 50 times, copyright protection discontinues as per Section 15(2) of the Copyright Act unless the design is registered under the Designs Act, 2000. Since, Ritika’s designs were unregistered, its claim failed. Similarly, in the case of Microfibres Inc. v. Girdhar & Co.,[3] Microfibres, a textile manufacturer claimed that Girdhar & Co. had copied its upholstery fabric designs. The plaintiff pleaded that the patterns should be protected as artistic works under the Copyright Act. The Hon’ble Delhi High Court emphasized that once an artistic work is applied to an industrial product; it ceases to qualify for copyright and falls within the ambit of the Designs Act. Since Microfibres had not registered its designs, no protection was available. The Hon’ble Supreme Court later affirmed this decision underlining the legislative intent to prevent dual protection and harmonize the two statutes. In the case of Rajesh Masrani v. Tahiliani Design Private Ltd.,[4] Rajesh Masrani alleged that Tarun Tahiliani’s fashion house had copied his fabric prints. The defense argued that the works were unregistered designs, and hence not enforceable under the Designs Act. The Hon’ble Delhi High Court held that the plainitff’s prints were original artistic works as per Section 2(c) of the Copyright Act, and therefore protectable since the designs had not been mass produced beyond the threshold of Section 15(2), copyright subsisted. The defendant’s appeal was dismissed. Aesthetic Functionality Doctrine A significant obstacle in securing trademark protection for fashion designs lies in the doctrine of aesthetic functionality. This principle holds that a feature cannot be monopolized as a trademark if it is primary appeal lies in its aesthetic value or if it confers a competitive advantage of source identification. The rationale is to ensure that no single brand can claim exclusivity over design elements that consumer are drawn to for their beauty or style, rather than for brand association. Courts frequently reply on competitive necessity test to determine whether a feature qualifies as aesthetic functionality. The more a design reflects a prevailing trend, the greater the likelihood that it will be regarded as an aesthetic choice necessary for the competitors to adopt freely. In such circumstances, trademark protection is denied to avoid restricting legitimate competition in the marketplace. A recent and instructive example of Indian jurisprudence can be found in the case of Royal Country of Berkshire Polo Club Ltd & Ors v. Lifestyle Equities C V & Ors[5], also known as Beverly Hills Polo Club (BHPC) case. In early 2025, the Hon’ble Delhi High Court ordered an Amazon subsidiary to pay USD 39 Million (approximately INR 340 Crore) in damages for selling apparel featuring a logo nearly indistinguishable from the BHPC trademark. The Hon’ble Delhi High Court’s ruling emphasized that brand identifying elements, regardless of aesthetic appeal are entitled to protection where they serve as strong indicators of source and reputation. Unlike cases involving purely decorative motifs that fail to signal origin and thus fall prey to the doctrine of aesthetic functionality, BHPC’s logo had achieved brand distinctiveness and consumer recognition. The Hon’ble Delhi High Court’s approach reinforces that courts will protect decorative designs when they play a clear source identifying role, reaffirming that distinctiveness, not ornamentally, remains the guiding principle in trademark enforcement. For fashion and lifestyle brands, the BHPC decision provides a compelling blueprint i.e., registering and cultivating distinctive, recognizable designs is essential to ensuring legal protection, not just foe aesthetic merit, but as embodiments of brand identity. Conclusion A design cannot be deemed “too trendy” to trademark in the legal sense; rather, trendiness itself is antithetical to the distinctiveness and source-indicating function necessary for trademark protection. Trend-driven, short-lived designs usually enter the public domain, available for all to use, unless and until they gain sufficient secondary meaning to become inextricably linked with a single brand. For fashion innovators, robust protection lies in a layered IP strategy involving design registration, trademark cultivation, and copyright protection. [1] TM No. 7/2017 [2] CS(OS) No. 182/2011 [3] 128 (2006) DLT 238 [4] FAO (OS) No. 393/2008 [5] 2023 SCC OnLine Del 5347 Authored by Mr. Ketan Joshi, Senior Associate

Introduction Today, the world has become a global village, at least in the economic sense. In this increasingly interconnected global economy, corporate distress rarely respects national borders. It is not unknown that every country has multinational enterprises that are operating across various jurisdictions, which inevitably requires that there should be an insolvency regime that cooperates internationally so that there can be preservation of the value of the assets and at the same time there is equitable treatment of the creditor, thereby leading to efficient resolution of cross-border insolvency. The Insolvency and Bankruptcy Code, 2016 (“IBC”) revitalized the domestic insolvency resolution as soon as it was brought into action. Prior to the IBC, the condition of the distressed entities was not so good because there was no consolidated law, but after the arrival of the IBC regime, the resolution process streamlined the insolvency process. While IBC has been appreciated for revitalizing domestic insolvency resolution, it remains silent on a formal mechanism to recognize and cooperate with foreign insolvency proceedings. This lacuna leaves Indian resolution professionals and foreign stakeholders in a precarious position: India benefits from having its Corporate Insolvency Resolution Processes (“CIRPs”) recognized abroad, such as in the recent decision in Singapore in Re Compuage Infocom Ltd. decision. Yet India itself offers no reciprocal framework to foreign proceedings. Current Legal Framework in India The IBC provides a regime for insolvency and bankruptcy of companies, limited liability partnerships, and individuals. It has the main objective of first doing resolution and then liquidation in the domestic proceedings to preserve the value of the assets and balance the interests of all stakeholders while providing a time-bound framework for resolving insolvency cases. However, it incorporates only two provisions addressing cross-border insolvency in a limited, reciprocal manner: Section 234 -Agreements with foreign countries. “(1) The Central Government may enter into an agreement with the Government of any country outside India for enforcing the provisions of this Code. (2) The Central Government may, by notification in the Official Gazette, direct that the application of provisions of this Code in relation to assets or property of corporate debtor or debtor, including a personal guarantor of a corporate debtor, as the case may be, situated at any place in a country outside India with which reciprocal arrangements have been made, shall be subject to such conditions as may be specified.” As per this section, the Indian government can make a bilateral treaty with any other country to help enforce the rules of the IBC in that country. Once such an agreement exists, the government can officially notify that the IBC provisions will apply to the assets of the Indian companies or individuals, which includes debtors or guarantors that are located in that foreign country. However, this will only apply if the country agrees to do the same for the Indian authorities, which in simple terms means reciprocity. Section 235: Letter of request to a country outside India in certain cases. “(1) Notwithstanding anything contained in this Code or any law for the time being in force if, in the course of insolvency resolution process, or liquidation or bankruptcy proceedings, as the case may be, under this Code, the resolution professional, liquidator or bankruptcy trustee, as the case may be, is of the opinion that assets of the corporate debtor or debtor, including a personal guarantor of a corporate debtor, are situated in a country outside India with which reciprocal arrangements have been made under section 234, he may make an application to the Adjudicating Authority that evidence or action relating to such assets is required in connection with such process or proceeding. (2) The Adjudicating Authority on receipt of an application under sub-section (1) and, on being satisfied that evidence or action relating to assets under sub-section (1) is required in connection with insolvency resolution process or liquidation or bankruptcy proceeding, may issue a letter of request to a court or an authority of such country competent to deal with such request.” In order to understand what Section 235 says, let's take an example wherein a company undergoing insolvency in India owns a building in Dubai. Now, if India and the UAE have a reciprocal arrangement under Section 234, then the Resolution Professional can apply in NCLT, asking to take action on the Dubai property, and if the tribunal agrees then it can send a formal request to UAE court to take the necessary action, like freezing or selling of the assets. However, even after almost a decade of IBC, no reciprocal agreements under Sections 234–235 have been concluded. Thus, these provisions remain inoperative. Further, in the absence of formal cross-border insolvency legislation, the Indian courts have only way of enforcing an insolvency decree is via section 13 of the Code of Civil Procedure for the recognition and the enforcement of the foreign judgment that relies on the fact that it satisfies the provisions therein. Why Recognition Without Reciprocity Is a Global Trend? The answer to the question as to why recognition without reciprocity is becoming a global trend is simple and identifiable; this is the era of globalized commerce, wherein businesses operate across jurisdictions and the corporate debtors hold assets and owe obligations not just in one country. Consequently, this gave rise to the need for national insolvency regimes to address the complexity of cross-border insolvency in a manner that is coordinated, efficient, and equitable. We have to understand that at the heart of the global trend lies the principle of modified universalism, which balances the need for a single, centralized insolvency process with the sovereignty and interests of local jurisdictions. This philosophy is embodied in the UNCITRAL Model Law on Cross-Border Insolvency (1997), which has now been adopted, with or without modification, in over 60 states and 63 jurisdictions, including the United States, United Kingdom, Singapore, Australia, Japan, and other multiple jurisdictions, enabling smooth cross-border insolvency. This model law is intentionally neutral on reciprocity, which means that it does not require the adopting countries to condition their recognition of the foreign insolvency proceedings on whether the initiating country would do the same or not. This is basically done with the approach that encourages open coordination and recognizes that the benefits of facilitating the efficient cross-border resolution outweigh the potential cost of asymmetry. However, it must also be recognized that despite the inclusive spirit of the model law there are few jurisdictions, such as Mexico, South Africa, and Romania, that have inserted reciprocity clauses that condition recognition on mutual treatment. These clauses have however been widely criticized for being counterproductive. As discussed in India’s 2018 Insolvency Law Committee (ILC) report and reinforced by comparative academic commentary, reciprocity creates regulatory fragmentation, slows down the legal process, and undermines the very goal of harmonization. Now, considering the Indian perspective, Sections 234 and 235 of the IBC have proven to be a bottleneck. It is to be noted that as of mid-2025, India has not signed any reciprocal agreement which renders the provisions ineffective in practice. The absence of an enacted cross-border insolvency law ultimately means that India remains a passive recipient of the recognition abroad while offering no equivalent legal certainty to the foreign investors or the insolvency practitioners operating in India. Considering the reasons for the recognition without reciprocity, there are three key drivers: 1. Value Preservation and Economic Efficiency: The individuals in these proceedings are obviously commercially driven, which ultimately makes their goal to be the preservation of the value of the assets and at the same time be economically efficient. It is no secret that multiple jurisdictions and local courts will lead to delay in the recognition and can lead to a “race to the courthouse,” where local creditors attempt to seize assets before foreign proceedings are acknowledged. 2. Enhancing Global Credibility and Investment Climate: Jurisdictions that extend recognition to foreign proceedings build their reputation as legally mature, creditor-friendly, and cooperative. 3. Judicial Predictability and Legal Certainty: A harmonized legal regime based on objective criteria simplifies litigation, reduces costs, and enhances procedural fairness. The Model Law’s framework (Articles 15–17) for recognition and relief provides a uniform path forward that is missing from India’s current ad hoc and discretionary mechanisms. The Re Camouflage Case and Its Implications Recently, Singapore High Court’s decision in Re Compuage Infocom Ltd [2025] SGHC 49 marked a moment in cross-border insolvency jurisprudence involving India. For the first time, a Corporate Insolvency Resolution Process was initiated under India’s IBC regime which was formally recognized as a “foreign main proceeding” in a jurisdiction that had adopted the UNCITRAL Model Law on Cross-Border Insolvency. Facts of the case were simple: Compuage Infocom Ltd (CIL), an Indian company, was undergoing CIRP under NCLT Mumbai and the appointed Resolution Professional, Mr. Gajesh Jain, sought recognition of the Indian proceedings in Singapore to access and administer assets held there. The Singapore High Court undertook a detailed examination of the criteria under the Model Law, including the definition of “foreign proceeding,” and considered the status of NCLT as a foreign court and whether India was CIL’s Center of Main Interest. The court of Singapore then concluded affirmatively on all counts that is a. CIRP was collective, judicial, and reorganization-focused; b. NCLT was deemed a competent adjudicatory body; and c. India was the COMI based on operational and managerial control. With this, RP got control over the assets that were situated in Singapore, but it imposed a moratorium on the local enforcement actions. The court withheld the automatic repartition, emphasizing the need to protect local creditors. With this, there was the exercise of modified universalism, which cooperated with the other jurisdiction without sacrificing local interest, which is located and reflected in the heart of the Model Law’s philosophy. It also exposed India’s policy gap: Singapore recognized Indian proceedings, yet India has no reciprocal framework to do the same, owing to its reliance on outdated provisions under Sections 234 and 235 of the IBC, which are dependent on bilateral treaties that have not materialized. With this comes practical and reputational consequences for India which are as follows: a. First, Indian RPs can benefit from global recognition, but foreign insolvency professionals cannot access Indian jurisdictions with equivalent clarity or certainty. b. Second, while the ruling enhances confidence in India’s domestic procedures, it may also pressure India to adopt the Draft Part Z based on the Model Law, currently pending legislative action. Missed Opportunities in Indian Jurisprudence It is undeniable that the insolvency regime in India has improved significantly, but with regard to the cross-border insolvency regime, it still lacks, and here are the missed opportunities in Indian jurisprudence: a. The insolvency bankruptcy code was enacted in 2016, and soon after that, the need for cross-border was realized, and therefore, the Insolvency Law Committee recommended Draft Part Z’s inclusion to address the complexities of insolvency cases involving assets and creditors across different countries. Although Draft Part Z promised structured recognition of both foreign main and non-main proceedings, automatic moratoria, and clear standards for cooperation, it remains unnotified nearly seven years on, forcing stakeholders into ad hoc bilateral protocols rather than a uniform statutory regime. b. Second, the Jet Airways case, which depicts the judicial hesitation to embrace cross-border coordination. In this case the Mumbai NCLT initially rejected the Dutch trustee’s recognition, but the NCLAT partially rectified this by admitting the trustee “without voting rights” and sanctioning a bespoke Cross-Border Insolvency Protocol . This case highlighted the potential for cooperation and the risk that, absent clear law, courts will default to a territorialist posture, delaying asset pooling and value maximization. c. Third, in Videocon Industries, the NCLT sought to “lift the veil” over four foreign subsidiaries to include their assets, but the NCLAT stayed that order and, in effect, excluded significant overseas value from the resolution pool. Now this happens because there is no explicit statutory authority to administer. d. Fourth, India’s reliance on Sections 234–235 IBC (reciprocal treaties and letters of request) continues to be sterile, as there have been no bilateral agreements concluded, rendering these provisions dormant. India’s Draft Framework and Why It Remains Stalled India’s Draft cross-border insolvency framework is based on the UNCITRAL Model Law and remains inexplicably stalled despite growing global integration and increased foreign investment. The delay is not just about the bureaucratic sluggishness; it highlights other issues such as India's persistent consciousness towards relinquishing control in the transnational insolvency matters. The government has hesitated to implement it, citing concerns over judicial discretion, regulatory overlap, and potential misuse. However, one major reason is the fear of giving too much power to the foreign courts in matters involving Indian creditors and assets. Also, the Draft lacks certain clarity on the reciprocity that triggers the uneasiness about enforcing the Indian judgments abroad which might lead to the gap between the global north and global south as well. The Indian government might also be focused upon the sovereign rights that it can realize while keeping the insolvency regime to itself, particularly safeguarding the public interest. Without stronger political will and trust in institutional mechanisms, India risks remaining an outlier in global insolvency cooperation, which is repulsive to investor confidence and cross-border trade. Conclusion The global trend toward recognition without reciprocity reflects an international consensus that efficient cross-border insolvency mechanisms are relevant to economic stability, investor protection, and legal predictability. By continuing to insist on reciprocity and bilateral treaties, India risks isolating itself from this cooperative framework because legislative inertia not only hampers Indian creditors’ ability to recover abroad but also disincentivizes foreign participation in Indian restructurings. It is, therefore, essential that India align itself with the Model Law’s principles and become a proactive contributor to the global insolvency architecture. While at the same time protecting the local and the domestic interests of the creditors. Authored by Mr. Vipul Maheshwari, Managing Partner

The Indian corporate environment is characterized by its volatile mix of opportunities, aspiration and complex regulatory frameworks especially with the country's emerging status as one of the largest markets globally. With numerous opportunities, it has attracted a significant number of foreign investments, especially through acquisitions and joint ventures (JVs). Foreign companies, entering into JVs or acquisitions, often face challenges due to India’s complex regulatory environment that may affect their operations. To mitigate these risks, exit clauses are a critical element in such JV agreements, as they provide a clear roadmap for foreign partners wishing to divest or exit the business. Put options, being one of the exit options, enable investors to sell their shares to the issuing company or other shareholders at a set price within a stipulated period, allowing shareholders to define their exit strategy clearly. By clearly defining the terms under which a foreign partner can exit the joint venture, these clauses help manage the inherent uncertainty of the Indian market, providing foreign entities with a more favorable environment to engage in business partnerships while balancing risks and returns. Hence, a put-on option allows the put buyer to exercise the option within the designated expiration time at a predetermined price Such clauses are vital in fostering trust between local and foreign partners, ensuring that the latter have an exit strategy in place, which enhances the overall attractiveness of India as a destination for foreign direct investment (FDI). PUT OPTION:  A SWORD AND SHIELD A put option gives the holder the power to sell an asset at a pre-determined price within a specified timeframe. The duality of this instrument makes it constraining: it works as both a defensive shield (limiting downside risks) and a strategic sword (leveraging power in negotiations). However, it is important to emphasize that exercising the put option by a foreign partner also involves various legal, regulatory, and administrative issues challenges related to the enforcement of such clauses. These issues must be carefully considered when drafting the definitive agreements or invoking these options in cross-border contexts. Since India is an exchange-controlled state, the framework and regulations of Foreign Exchange Management Act, 1999 (FEMA) govern transactions between residents and non-residents. Foreign Exchange Management Act (FEMA) plays a crucial role in ensuring compliance with the FDI framework, particularly concerning the transfer of equity from international investors to Indian enterprises to ensure that any such transfers align with valuation norms and adhere to the sectoral caps set by the FDI policy. A key challenge for foreign investors lies in share valuation, as FEMA requires the sale to occur at fair market value. This can create complications when executing the put option, especially if the parties disagree on the share price. Traditionally, put options were considered speculative instruments since their performance depended on future events. Under the Securities Contract Regulation Act of 1956 (SCRA), such options were deemed invalid because they did not come under any of the definitions for spot delivery or derivative contracts. The legal position was clarified when SEBI issued a notification on October 3, 2013 for the first time permitting contracts in shareholders agreements or provisions in the articles of association, providing for a put/ call option. The October 2013 Notification permitted put/call option clauses subject to satisfaction of the underlying conditions which included compliance with FEMA. The latest judgment of a Division Bench of the Bombay High Court, in Percept Finserve Private Limited v. Edelweiss Financial Services Limited upheld the enforceability of a put option clause in a share purchase agreement, that was executed prior to the October 2013 Notification. Moreover, concerning Foreign Exchange Management Act of 1999 (FEMA), put options that give assured returns to investors were considered a contravention of regulations that forbid guaranteed returns on investments. In numerous cases, the Court upheld the put option while requiring RBI permission for the remittance. The Bombay High Court's decision in Videocon Industries Ltd. v. Intesa Saupaolo SPA[1] "interpreted the phrase with the general or special permission of the Reserve Bank of India as not requiring prior permission and stated that contracts were not invalid for lack of permission. A public interest lawsuit was brought in the Calcutta High Court in Sanjib Kumar Dan v. Union of India and Ors [2]to clarify that guaranteed returns on equity investments are unlawful. The court denied the petition, which upheld the existence of adequate rules. In this regard, the case of “NTT Docomo V. Tata Sons” is a landmark judgment which is more than a legal dispute between two corporate giants, revolving around breach of a shareholder agreement related to the sale of shares in the Indian telecom company Tata Teleservices. The case helps in exploring the broader context of corporate governance practices in India along with the significant legal, strategic, and financial ramifications. The case revealed that put options, when partnered with contractual obligations, serves more than just financial hedges but they also become tools for enforcing accountability in joint ventures and safeguarding investments in unpredictable market. Exercising put options in a complex legal framework As one of the world’s most promising investment destinations, India attracts foreign investors eager to stake their claim. Regardless, for these shareholders, particularly those entering through acquisitions or joint ventures (JV’s), the Indian regulatory framework often complicates otherwise straightforward financial strategies. Among these complexities lies the issue of put options, a simple seeming contractual mechanism that becomes entangled in a legal and regulatory hurdle when exercised in India.  While offering a crucial exit strategy for investors, the put options open up the labyrinth of valuation norms, compliance mandates, and judicial scrutiny for foreign shareholder. The most immediate challenge foreign shareholders face is the compliance burden imposed by Indian regulations: FEMA’s Valuation Norms: FEMA mandates that the transfer of shares must be at or above the fair market value for foreign investors selling to residents. However, this requirement often clashes with the predetermined pricing in a put option. In the case the agreed upon price is below the fair market value, the transaction maybe deemed non-compliant, leaving the foreign investor in a precarious position. Sectoral Caps and Restrictions: FEMA also governs sector-specific FDI caps. For instance, investments in susceptible sectors like defense or telecommunications face additional scrutiny, making the exercise of put options even more complicated. Foreign investors frequently encounter delays in obtaining the necessary regulatory approvals: Role of the RBI: the reserve bank of India plays a crucial role in approving remittance related to put options. Even if the courts uphold, executing the payment to a foreign shareholder may require explicit RBI permission. These approvals can be time-consuming, leading to prolonged uncertainty for investors. Enforcement Uncertainty: Despite regulatory clarifications, the enforcement of put options remains inconsistent. This inconsistency stems from differing interpretations of laws across jurisdiction, further complicating the process. Exercising a put option in India often triggers tax implications that can erode the financial benefits of the transaction: Capital Gains Tax: Foreign shareholders may be liable for capital gains tax on the proceeds of the share sale. The tax rate is dependent on the holding period and the type of capital asset. For example, the short-term gains may attract higher tax rates, while long term gains could benefit from tax treaties between India and the investor’s home country. Withholding Tax: Indian companies executing the payment under a put option may also be required to withhold tax before remitting funds to the foreign shareholder. Ensuring compliance with these provisions can add another layer of complexity. Indian courts have played a pivotal role in shaping the enforceability of put options, but they also highlight the challenge investors face: Guaranteed Returns and FEMA Compliance: courts have repeatedly held that put options offering guaranteed returns contravene FEMA. For example, in “Sanjib Kumar Dan V. Union of India”, the court emphasized that equity investments must carry an inherent risk, and guaranteed returns undermine this principle. Rewriting shareholder agreements: in several cases, courts have scrutinized shareholder agreements to ensure they align with the Indian laws. This has led to a growing emphasis on drafting agreements with built-in flexibility to adapt to regulatory changes. The cornerstone of navigating the legal framework is a well-drafted shareholder agreement. Foreign investors must anticipate potential challenges and craft agreements that: Incorporate Indian Legal standards: Provisions must align with FEMA, SEBI guidelines, and sector-specific regulations to ensure enforceability. Provide Dispute Resolution Mechanism: given the likelihood of disputes, agreements should include robust arbitration clauses and specify governing law to minimize delays in enforcement. Provides Dispute Resolution Mechanisms: Given the likelihood of disputes, agreements should include robust arbitration clauses and specify governing law to minimize delays in enforcement. Plan for Exit timing: Investors should account for regulatory delays and build timelines into the agreement to avoid indefinite postponements. Exercising put options in India requires more than a basic understanding of contractual rights. It demands: Proactive compliance: staying updated with evolving regulations, particularly FEMA amendments and SEBI guidelines. Strategic Collaboration: Engaging with local legal counsel to navigate approvals and align strategies with Indian regulatory frameworks. Flexibility in Agreements: Structuring contracts that allows for renegotiation in case of regulatory conflicts. CONCLUSION While India offers immense potential for foreign investors, the exercise of put option remains a complex and nuanced process. At its core, the put option represents a delicate balancing Act between safeguarding investor rights and ensuring compliance with India’s evolving legal framework. The requirement to adhere to FEMA’s valuation norms, navigate sectoral caps, and secure RBI permissions reflects the complexities of operating in an exchange-controlled system. While these measures are designed to preserve market integrity and align with public policy, they also demand that investors remain vigilant, informed, and pro-active in structuring their agreements and business strategies. Despite these challenges, the future hold promises. India’s legal and regulatory environment is gradually maturing, with reforms aimed at creating a more predictable and investor friendly ecosystem. SEBI’s notifications, judicial clarity, and the governments ongoing efforts to streamline FDI policies are all steps in the right direction. These developments reflect India’s recognition of the critical role foreign investment plays in its economic growth story. For foreign shareholders, the path forward requires a combination of legal expertise, strategic foresight, and a willingness to embrace the intricacies of India’s regulatory framework. Success lies in understanding the markets unique challenges and leveraging its opportunities. Exercising put options, though complex, can be a powerful tool when wielded with preparation and precision. India remains a land of immense potential for foreign investors, offering opportunities that are as vast as its regulatory landscape is intricate. The put option, once seen as a speculative gamble, now stands as a symbol of India’s evolving approach to business partnerships. By, rising to meet the challenges of this framework, foreign shareholders not only safeguard their investments but also contribute to a more robust and globally integrated Indian economy. Author: Ms. Jyotsna Chaturvedi, Head – Corporate Practice. Footnotes [1] Intesa Sanpaolo S.P.A vs Videocon Industries Limited on 5 December, 2013 available at https://indiankanoon.org/doc/19525454/ [2]Sanjib Kumar Das vs Union Of India & Ors on 10 September, 2021 available at  https://indiankanoon.org/doc/98831369/

India's independence in 1947 was accompanied by the tragic partition, which led to large-scale violence, displacement, and loss of life. Many individuals were unable to migrate to their desired countries due to the chaos. Once the situation normalised, people sought citizenship in the country where their families resided. However, when the Indo-Pak wars of 1965 broke out in the country. To safe guard the public of India, the Indian government led to the issuing notifications via its Notification No. 12/2/65-E Pty dated 10.09.1965 and S.O. 5511 dated 18.12.1971 under the Defence of India Rules 1962, stating that all immovable properties in India belonging to Pakistani nationals would be vested in the Custodian of Enemy Property for India.This is in pursuance of the war, as if the Pakistani nationals remained the owner of the Property in the Indian territory. Under those circumstances, the Property might be misused for planning and plotting terrorism, which will ultimately lead to endangering the lives of the general public of India. To regulate such properties, the government, in furtherance of the notification, had introduced the Enemy Property Act of 1968. This Act defined an "Enemy" as any person who had acquired the citizenship of an enemy country. In accordance with the Act, the Country will be termed as Enemy Country if at any point in time in the past the Country was at war with India or might be in future will be considered as an Enemy Country. At present, India has engaged in wars with Pakistan and China, and consequently, the Indian citizens who have acquired the Citizenship of these two countries are classified as "Enemies" under the Act. Consequently, any property owned by such individuals in India is designated as "Enemy Property." However, in accordance with Section 2(b), the "enemy" or "enemy subject" or "enemy firm" means a person or country who or which was an enemy, an enemy subject or an enemy firm, as the case may be, under the Defence of India Act, 1962 and the Defence of India Rules, 1962 but does not include a citizen of India. Consequently, it can be determined that the Legal heirs who have not acquired citizenship of the Enemy Country will have Ownership rights over the Property being owned by the Enemy, and if not, the Property will be vested in the name of the Custodian. The Custodian will be managing and administrating the Property. Furthermore, in accordance with Section 6, despite the property vested in the name of theCustodian, the enemy or an enemy subject or an enemy firm can transfer the Property to an Indian Citizen since the Enemy is the owner of the Property and the Custodian acts as a Trustee. However, if the Central Government felt that such a transfer was/is injurious to the public interest or was/is made with a view to evading or defeating the vesting of the property in the Custodian. Afterwards, the Central Government, after giving a reasonable opportunity to the transferee to be heard,subsequently passed an order/declared the transfer void. In furtherance, the property will continue to be vested or deemed to be vested in the name of the Custodian. However, the same led to the Multiplicity of the case related to the same subject matter in the Hon’ble High courts and Supreme Court. Legal Debate A critical legal debate arose regarding whether an enemy or their legal heirs retained any rights over their vested property in the name of the Custodian. In the landmark judgment of Union of India & Ors. Vs. Mohammed Amir Mohammad Khandecided on 21.10.2005, the Supreme Court held that under the Enemy Property Act, the title of an Enemy's Property does not transfer to the Custodian. Instead, the Custodian only assumes possession, control, and management of the property. The judgment clarified that the Enemy remains the legal owner of the property. Furthermore, the Supreme Court ruled that if a legal heir has never acquired Enemy Country Citizenship, they have a rightful claim to the Enemy Property. Additionally, as per the act, if ownership is transferred to an Indian citizen, the property ceases to be classified as enemy property. This ensured that lawful owners preserved their property rights. However, it was clarified in the act that if the Central Government feels it is against the Public interest, then the said transfer can be termed void, and the Property will continue vesting in the name of the Custodian. JUDGEMENT LINK The 2017 Amendment and Its Implications Under those circumstances, where the afore stated judgement was in effect. The Central Government amended the Enemy Property Act in 2017, drastically altering the legal provisions. The amendment stripped legal heirs of their rights and declared any Legal Heirs rights over the enemy property as an Indian citizen as illegal / not in accordance with the Law. In accordance with the Amendment, in furtherance of the definition as stated in the Enemy Property Act, 1968, the act further added that it does not include a citizen of India other than those citizens of India, being the legal heir and successor of the "enemy" or "enemy subject" or "enemy firm” which means the Indian Citizen being the legal heir and successor cannot have the right over the Property. Consequently, the rights of the Legal Heirs over the property have been seized. This amendment also applied retrospectively, raising concerns about violations of legal heirs' rights. Even the amended act prohibited the transfer of the property vested in the name of a Custodian via an enemy, enemy subject or enemy firm. Consequently, it can be determined that the Property, once acquired the title of the Enemy Property, will remain as an Enemy Property. However, under these circumstances, the question arises via the said amendment concerning who will be the owner of the Property, whether it will be the Central Government, the Enemy or his Legal Heirs being the Indian Citizen. Supreme Court Stance Post Amendments The Supreme Court recently revisited the issue in Lucknow Nagar Nigam & Ors. Vs. Kohli Brothers Colour Lab Pvt. Ltd. & Ors. decided on 22.02.2024 on the afore-stated issue. The Court reaffirmed that the Custodian of Enemy Property does not acquire ownership. Rather, it only acts as a trustee for the management and administration of such properties. The Court emphasised that there is no transfer of ownership from the original owner to the Custodian or the Union of India. Consequently, enemy properties do not become Union properties or the Central Government Property. From the above judgments, it is clear that the enemy remains the lawful owner of their property, and such property can be transferred to Indian citizens or legal heirs. However, the 2017 amendment has fundamentally altered this principle by retroactively revoking these rights. The Supreme Court has yet to decide conclusively on the retrospective applicability of these amendments as they potentially violate the property rights of legal heirs and transferees. The forthcoming judicial decisions will play a crucial role in determining the fate of such properties and their rightful owners in India. However, the Central Government, via its notification no. CG-DL-E-17102024-258001, dated 16.10.2024, had issued Guidelines for the Disposal of Enemy Property. JUDGEMENT LINK Central Government Latest Notification The Central Government has introduced a significant amendment impacting the valuation and sale of enemy properties, particularly concerning the rights of occupants. Under the revised guidelines, long-term occupants now have the first right to purchase these properties—specifically those valued below ₹1 crore in rural areas and ₹5 crore in urban areas. If an occupant chooses not to purchase, the property will be disposed of according to existing regulations. This amendment reflects the evolving legal stance on enemy property, aligning with various Supreme Court judgments that emphasize providing stability to long-term occupants. However, while this move appears to offer a fairer approach, it raises critical legal concerns, especially in light of the 2017 amendments that retrospectively revoked the rights of legal heirs. This change could create potential conflicts between occupants, legal heirs, and transferees of enemy property who acquired ownership before the 2017 amendment. Does this new provision strike the right balance between stability for occupants and justice for rightful heirs? Or does it further complicate the legal landscape surrounding enemy properties in India? The Supreme Court of India has yet to decide on the aforementioned questions. NOTIFICATION Conclusion The legal status of enemy property in India remains a contentious issue, shaped by evolving judicial interpretations and legislative amendments. While the Supreme Court has consistently held that the Custodian does not acquire ownership but merely manages such properties, the 2017 amendment significantly altered this principle by retrospectively stripping legal heirs of their rights. This raises serious concerns about fairness and property rights, particularly for those who never acquired citizenship of enemy country. As legal challenges continue, the judiciary’s future stance will be crucial in balancing national security concerns with individual property rights, ultimately shaping the fate of enemy properties in India.   Author - Akhand Pratap Singh Chauhan, Partner Co-Author - Sachin Sharma, Assessment Intern  

In an era where information dissemination occurs in milliseconds, the concept of privacy seems to be a dream. The internet has transformed into a vast repository of personal data, making it difficult for individuals to control their digital footprints. The Right to be Forgotten (RTBF) emerges as a safeguard to protect individuals' privacy by allowing them to request the removal of specific personal data from search engines and online platforms when such information is inaccurate, inadequate, irrelevant, or excessive under particular conditions. Right to be forgotten, also referred to as Right to be Erasure means an individual can claim for deletion of specific personal data available on the search engines or other online platforms which are inadequate, inaccurate, irrelevant or excessive within specific conditions. The evolution of this right traces back to 1998, when a Spaniard faced some financial difficulties and wanted to auction his property. The advertisement was published in a newspaper and later found its way onto the internet, since then he has never been forgotten. Even after his financial crunches were over, online search results continued to portray him bankrupt, tarnishing his reputation. Seeking redress, he approached the European Court of Justice (ECJ), the court ruled against search engine, affirming that residents of the European Union (EU) could request the removal of certain personal information from search engines, subject to restrictions. This landmark decision gave birth to the concept of the Right to be Forgotten. In India, case of Justice K.S. Puttaswamy v. Union of India opened the gateway to the debate over the Right to be Forgotten. The Supreme Court of India recognized Right to Privacy as a Fundamental Right under the Constitution, which implicitly recognize the Right to be Forgotten. However, the Court clarified that this right is not absolute and should be applied in cases where personal data is no longer relevant or serves no legitimate public interest. INDIA’S STAND ON RIGHT TO BE FORGOTTEN: LEGAL PERSPECTIVE AND DEVELOPMENTS. India does not have any codified law on the Right to be Forgotten. But the concept has received judicial recognition through various judgments. The Supreme Court’s ruling in K.S. Puttaswamy v. Union of India (2017) was a pivotal moment, establishing the Right to Privacy under Article 21 of the Constitution of India and opening avenues for RTBF. The roots of Right to Privacy in India can be traced back to Rajagopal v. State of Tamil Nadu (1994), where the Supreme Court upheld the Right to Be Let Alone, but subject to exceptions for public documents and judicial records that serve legitimate public interest. Several High Courts and Supreme Court have also weighed in on the matter: Kerala High Court (2016, Civil W.P. No. 9478 of 2016) directed Indian Kanoon, a legal database, to remove a judgment revealing the identity of a rape victim. Gujarat High Court (Dharanraj Bhanushankar Dave v. State of Gujarat & Ors., 2017) declined a petition to remove non-reported judgments from search engines, stating that their publication does not infringe any Fundamental Rights. Karnataka High Court (Sri Vasunathan v. The Registrar General, High Court of Karnataka & Ors., 2017) acknowledged RTBF as an evolving legal principle and permitted the redaction of the name of the petitioner’s daughter from court records, balancing modesty, privacy, and the evolving right to be forgotten. Delhi High Court (Zulfiqar Ahman Khan v. Quintillion Business Media Pvt. Ltd., 2019) affirmed that RTBF and the Right to Be Let Alone are integral aspects of privacy of an individual. Delhi High Court (Jorawar Singh Mundy v. Union of India & Ors.) deliberated on whether privacy rights should outweigh public access to judicial records. The debate still ongoing in Indian jurisprudence. Supreme Court (Ikanoon Software Development Pvt. Ltd. v. Karthick Theodore, 2024) overturned a Madras High Court judgment that had granted an acquitted petitioner’s request to remove his name from a sexual assault judgment. The Supreme Court ruled that judicial decisions are public records and RTBF cannot be invoked in every situation. Additionally, Information Technology Rules, 2021 and the Digital Personal Data Protection Act, 2023 provide limited recognition of RTBF. Under these provisions, intermediaries must remove content violating privacy rights within 24 hours, and individuals may seek data erasure where applicable. GLOBAL OUTLOOK ON DELETING THE UNFORGETTABLE MEMORIES OF THE INTERNET Legal adoption of the Right to be Forgotten across Globe: European Union: The debate over RTBF sparked by ECJ ruling in Google Spain SL v. Agencia Española de Protección de Datos (AEPD) This set a precedent, allowing individuals to request for deletion of information that is inaccurate, inadequate, irrelevant, or excessive. The General Data Protection Regulation (GDPR, 2017) further cemented this right under Article 17 (Right to Erasure). Japan: Japan was the first country in Asia to adopt the Data Protection Regulation to protect the interest of its citizens. The Protection of Personal Information Act empowers individuals to demand data suspension or deletion if used beyond its stated purpose or without consent. Australia: The RTBF is not explicitly recognized by the Australian laws, but Australian Privacy Principles (APP) mandate that businesses destroy or de-identify outdated, incomplete, or misleading personal information upon request. United States: The First Amendment's emphasis on freedom of speech creates significant hurdles for implementing RTBF. However, some states, such as California, offer limited rights to request data removal. On the contrary, some states like California provide limited rights to allow an individual to make requests for deletion of data from the internet. RIGHT TO BE FORGOTTEN – THE CHALLENGES AHEAD Despite its growing recognition, RTBF faces significant legal, technical, and ethical challenges: Jurisdictional Conflicts: The borderless nature of the internet complicates enforcement. Should RTBF apply only within a specific nation or globally? Conflicts with Other Rights: RTBF risks infringing upon Freedom of Speech and the Right to Information. The removal of information may hinder public access to knowledge, especially in matters of public interest. Threat to Journalism: Unchecked implementation of RTBF may curtail journalistic freedom, limiting the dissemination of critical information. Technical and Ethical Concerns: Filtering and determining the extent of data removal pose challenges. Who decides what is irrelevant or excessive, and how should this be enforced? THE WAY FORWARD Universal Recognition and Legal Framework: There is a pressing need for a standardized global legal framework to ensure consistent enforcement of RTBF while protecting competing rights. Harmonization with Other Rights: A balanced approach among all the rights is necessary, ensuring RTBF does not unduly curtail freedom of expression or restrict public access to legitimate information. CONCLUSION In the digital era where the footprint of the internet is traced everywhere, the Right to be Forgotten is the need of this hour. As concerns over data protection continue to rise, RTBF has emerged as a significant legal development. However, its implementation must strike a balance between privacy rights, public interest, and freedom of expression. The evolving legal discourse surrounding RTBF underscores its importance in shaping the future of digital privacy, and ongoing efforts aim to integrate it into a well-defined statutory framework. While the internet’s memory may never be fully erased, RTBF strives to ensure that individuals can regain control over their personal narratives in the digital world. Author: Mr. Vipul Maheshwari, Managing Partner

On May 8, 2025, the Reserve Bank of India (RBI) issued a very significant notification in respect of the regulatory framework governing Foreign Portfolio Investor (FPI) investment in India's corporate debt market. In removing the short-term investment limit, and the concentration limit, for FPIs investing in India via the general route, the RBI is signaling its commitment to develop a more transparent, liquid, and internationally competitive bond market.[1] This is part of a series of steps that would foster foreign capital inflows, enhance domestic financial market depth, and bring India's regulatory framework in line with international best practices. In the past, there were two restrictions related to FPI investment in Indian corporate debt applicable under the Master Directions - Reserve Bank of India (Non-Resident Investment in Debt Instruments) Directions, 2025. The first restriction was the "short-term investment limit" that limited FPI amounts in corporate debt securities with residual maturity up to one year, to 30% of the total corporate debt portfolio based on a daily measurement. The second restriction was a concentration limit that capped investments (with related persons) by the FPI in corporate debt securities at 15% long-term FPI and at 10% for other FPIs in respect to their maximum investment limit.[2] Initially, these policies were designed to assist with market stability, managing short-termism, and monitoring systemic risks (Provisions to this effect were contained in a scheme entitled "FPIs in the corporate bond market"). However, these clearly had operational problems and restricted active FPI engagement. Essentially, it meant that FPIs had to sell bonds that had less than one year of residual maturity, or increase the total amount of bonds (to comply with the 30% cap), and the amount of bonds they purchased was somewhat wasted; in early 2025 FPIs had only exploited 14.3% (₹1.1 lakh crore) of the total potential limit of ₹7.63 lakh crore. Additionally, the restriction imposed on FPIs prevented them from responding to market opportunities and steward capital prudently. To ameliorate these issues, the RBI had steadily increased limits for FPIs and now cover ₹8.22 lakh crore from April to September 2025, and ₹8.80 lakh crore from October 2025 to March 2026. Thus, the May 2025 notification represented not a fundamental shift, but merely a pragmatic optimization of the compliance regime so that it could deal with the real frustrations experienced by global investors and improve efficiency within India's corporate bond market. The 2025 Relaxations: Nature, Rationale, and Global Alignment On May 8, 2025, the Reserve Bank of India (RBI) released a notification[3] that caused a major shift in regulation, when it removed two significant restrictions on foreign portfolio investors ('FPIs'), investing in corporate debt through the General route: the short-term investment limit and the concentration limit. The short-term investment limit which had been defined by the Master Directions (RBI Non-Resident Investment in Debt Instruments, 2025) to restrict FPIs from holding more than 30% of their corporate debt portfolio at any time in instruments with a residual maturity of up to one year.[4] The concentration limit was defined, to prevent any single FPI (and related) entity from having exposure to 15% of the highest investment limit proposed for long term FPIs or 10% for others. These limits were set in place to address the threat to market stability posed by capital flows (as a result of excess volatility from short-term holdings) and concentration posed by large pools in a few entities. The RBI eliminated these caps based on the premise that FPI investment limits in corporate debt are barely utilized (around 14.3 % in total in early 2025). Industry inputs also confirmed that these limits created operational issues such as forced rebalancing, and tying up inefficiently assigned or allocated capital which caused FPIs to invest less than their available limits. Deregulation is designed to provide more flexibility for FPIs to manage their portfolio and will hopefully foster more active investing and liquidity in the market. Relaxing limits will help align India's framework with what is common in the rest of the world. For example, many EM and developed markets do not implement as strict regulations on foreign holdings of short-term debt, or no restrictions on indicating concentration of ownership by foreign investors, therefore allowing more Foreigners to invest and making it easier to capital to move in and out of EM. Therefore, RBI's deregulation should help India's ability to get added to global bond indices (e.g. JPMorgan GBI-EM), and increase foreign investment in India. Overall, the 2025 relaxations represent a pragmatic and strategic response by the RBI to market reality, and investor concerns to support an ongoing effort to deepen India's corporate debt market with a focus on regulatory monitoring. Capital Market Deepening and Economic Implications The RBI's May 2025 relaxations have the potential to substantially deepen India's corporate debt market by allowing FPIs to invest more flexibly and efficiently than before. The removal of short-term investment and concentration limits will likely prompt greater foreign capital inflows, which have historically been hampered by regulations and restrictions. One of the biggest benefits of these relaxations is the expected increase in FPI ownership. The removal of the 30% limit on short-term corporate debt securities now means that FPIs can hold securities at any maturity without having to adjust their portfolios, thus reducing transaction costs for the issuers and complexity of operations for the FPIs' operations.  The removal of concentration limits means that FPIs can now put larger amounts into preferred issuers or sectors, improving investment decisions and implementing a better risk engineered portfolio. This flexibility is expected to draw a broader group of institutional global investors, such as sovereign wealth funds, pension funds and asset managers wanting diversified coverage of India's robust growing corporate sector. The addition of FPIs and larger ownership of corporate securities as investors will enhance liquidity, which is an important condition for an active corporate bond market. As more liquidity is added into the market, price discovery is more sustainable, bid-ask spreads are narrower, and the cost of trading is lower, thus encouraging issuers and investors to participate further. For Indian corporates, these developments mean greater access to long-term funding at competitive rates, facilitating business expansion and infrastructure spending. This economic development aspect is particularly relevant, in so far as the corporate bond market deepening is aligned to India's broader financial sector reforms designed to reduce reliance on bank credit and promote alternative sources of capital. A healthy bond market exists alongside equity markets and bank channels of supply, better characterized by a more resilient and diversified financial system. Finally, the RBI's alignment of India's FPI investment direction with global best practices increases India's capacity for inclusion in major global bond indices. Such inclusion generates passive inflows from global funds into the Indian bond market, further integrating the market to global capital flows. Overall, the 2025 relaxations should lead to a more liquid, efficient, and globally integrated corporate debt market which has spillover effects for economic development and financial stability. Systemic Risk, Volatility, and Regulatory Safeguards Although the 2025 relaxations from the RBI are widely expected to expand the corporate debt market and draw in additional foreign capital, they also introduce new aspects of risk that may require closer attention from regulators. The two risk areas that are of particular concern are the potential increase in market volatility arising from changes in FPI flows and the general increase of systemic risk arising from removing previous restrictions. By removing the short-term investment limit, the portfolio of FPIs can now allocate a significantly larger portion to shorter maturity instruments, which are typically more sensitive to fluctuations in risk sentiment and changes in the global interest rate environment. In conditions of extreme financial stress (also called contagion) or rapid changes in monetary policy from central banks (in the current example the US), foreign capital could exit the market at very high speeds, exerting pressure on bond prices and the INR. Not only could the resulting volatility affect the corporate debt market, but volatility on such a large scale could also increase the risk of embarrassment for the financial system (in the worst-case scenario if lots of people are forced to liquidate), especially if there is a lot of debt currently held by FPIs in a short space of time. Likewise, the removal of the concentration limit increases the risk of undue concentration in issuers or sectors. If a handful of large FPIs were to over concentrate their holdings in a handful of corporate bonds - then any negative event, for example a credit downgrade or default, could have exaggerated consequences that could potentially lead to contagion across the market. This risk is more pronounced in emerging markets, where there are likely to be fewer investors in general, and likely also to have less depth in the market. In order to mitigate these risks, the RBI has retained various macro prudential tools and regulatory safeguards. The central bank has the ability to reinstate restrictions, or impose restrictive measures, if the risks evolve into a systemic risk. In addition to monitoring FPI flows, the simple introduction of regulation requiring increased disclosure will ensure that updating disclosures is another risk management control not only for FPIs, but for all investors. Clear coordination with the SEBI provides the necessary "forward looking" mechanism for basic information sharing, and the extension of FPI monitoring risk management will be added layers of FPI investment management and ongoing recognition of the limits of authority by the RBI. The introduction of basic stress testing and scenarios fitting the various volatility ranges will be an important addition to risk management for showing the resilience of the corporate bond market to upside and downside external shocks. In summary the 2025 relaxations are a welcome step forward to developing a bond market, however the success of the measures will rely on the continuous vigilance of the RBI to recognize and respond to risk in an expanding global environment. Trade Integration, Foreign Relations, and Policy Effectiveness The RBI's 2025 foreign portfolio investor (FPI) relaxations to corporate debt securities must also be understood in the context of India’s larger economic diplomacy objectives in an increasingly integrated global financial system. The liberalization of FPI norms accompanying rather significant developments in India’s trade policy, most notably the India-UK Free Trade Agreement (FTA) and the UK’s reduction of import duties on Indian goods. Trade agreements such as these are established to encourage the exchange of goods and services but more broadly as an impetus to facilitate cross-border investment flows. As such, it is particularly relevant and timely to talk about India’s capital market regulations alongside international expectations. By liberalizing FPI norms, India is signaling support for financial openness and a welcome alignment of its regulatory framework with global expectations, thus enhancing its appeal to foreign investors. Especially as India seeks inclusion to large global bond indexes, which requires clear, predictable, and investor-friendly regulatory frameworks. Once India is included in indexes, this can lead to significant passive inflows from most international funds further developing and deepening the corporate bond market in India and the country’s integration with international capital markets. The success of these reforms depends on the RBI's Master Directions (Non-Resident Investment in Debt Instruments, 2025), which present an integrated and dynamic regime for foreign investment in Indian debt[5]. The Master Directions have been constructed to be flexible, allowing the RBI the ability to move quickly to capitalize on prevailing market conditions and stakeholder input. The relaxations instituted in May 2025 are a clear indication of this flexibility, reflecting a consultative process that considered the investors' needs while ensuring the continued exercise of macroprudential oversight. The early feedback from the market has been mostly favorable, with domestic corporates and international investors appreciating the regulatory clarity and operational leeway afforded them. However, a meaningful indication of whether the policy is effective will be in whether the RBI is able to maintain the openness now afforded to the market space while appropriately moderating risk, ensuring that more foreign capital can flow into India and lead to sustained economic benefits, without undermining financial stability. The recent reforms of the RBI offer a clear and concise path forward for India's aspirations to be better integrated into trade and investment; but they also have a strong line of attack for reaffirming both the legitimacy and reliability of regulatory institutions within India, at a crucial time when India is evolving as a major player on the global stage. Authored by Ms. Jyostna Chaturvedi, Head - Corporate Practice and Shreya Mazumdar, Associate References "India-UK FTA: Tariff Reductions and Market Access," Ministry of Commerce, https://commerce.gov.in/fta/india-uk-fta-details/ "RBI relaxes requirement for investment by FPIs in Corporate Debt Securities," SCC Online Blog (13 May 2025), https://www.scconline.com/blog/post/2025/05/13/rbi-relaxes-requirement-for-investment-by-fpis-in-corporate-debt-securities/ "RBI’s Financial Stability Report," RBI (June 2024), https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=56067 "SEBI’s role in monitoring FPI flows," SEBI (May 2025), https://www.sebi.gov.in/legal/circulars/may-2025/sebi-role-in-fpi-monitoring [1] RBI, https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12847&Mode=0 [2] RBI, https://m.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12765#F_i [3] RBI, https://www.rbi.org.in/commonman/English/scripts/FAQs.aspx?Id=836 [4] RBI, https://www.rbi.org.in/commonman/English/scripts/Notification.aspx?Id=856 [5] RBI, https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12765    

A tragic incident recently occurred where an Air India Flight 171, a Boeing 787 Dreamliner, after just taking off from Ahmedabad got crashed within a few minutes. In accordance with the Data from the Airport Authority, the last recorded altitude of the plane was at 625 feet off the ground, just immediately after takeoff. It flew just 2 km more. The flight was carrying 230 passengers and 12 crew members. However, except for one passenger, all the passengers and the crew members died on the spot.  Moreover, the flight crashed into the B.J. Medical College Hostel's mess and, as per the report, killed around 19 people and injured at least 60 more on the ground. The flight was a scheduled international passenger flight operated by Air India from Ahmedabad Airport in India to London Gatwick Airport in the United Kingdom. After the 2010 air crash incident wherein the 2-year-old aircraft had crashed outside Mangalore airport in Karnataka on May 22, killing 158 people when it burst into flames after overshooting a tabletop runway and plunging into a nearby forest. This is the tragic incident wherein the Air India Flight 171 crashed and killed around 300 people. The Air India Flight 171 crashed in the B.J. Medical College Hostel's mess, causing damage to the properties nearby, approximately 2 square kilometres. This event has reportedly triggered what could be India's largest aviation liability, exceeding 1,000 crores. In this article, we will discuss and try to understand what kinds of liability arise because of this plane crash on the airlines and the country, and under which law. LAWS OF INDIA GOVERNING THE AIRPLANE INCIDENT The Aircraft (Investigation of Accidents and Incidents) Rules, 2012, were notified by the Central Government of India through a Gazette Notification. This notification was published as G.S.R. 536(E) on July 5, 2012. These rules were formulated based on the ICAO (International Civil Aviation Organisation) SARPs (Standards and Recommended Practices) and the Indian Civil Aviation scenario. The purpose of these rules was to establish a framework for investigating aircraft accidents and incidents, which led to the establishment of the Aircraft Accident Investigation Bureau (AAIB). As per the Definition of the Accident in the Act, it refers to an event related to the operation of a manned or unmanned aircraft occurring between boarding and disembarkation (for manned) or from readiness to engine shutdown (for unmanned), resulting in either: fatal or serious injury caused by being in or coming into contact with the aircraft or jet blast (excluding natural causes, self-inflicted harm, assaults, or injuries to hidden stowaways); aircraft damage or structural failure affecting performance or safety, requiring major repair or replacement (excluding minor or localized damage to components like engines, propellers, tires, or panels); or the aircraft being missing or completely inaccessible. In these types of cases of aircraft accidents, the airline is primarily liable for compensating victims, and the amount can vary. For international flights, the Montreal Convention sets a minimum compensation of around 1.4 crore per passenger, while domestic flights are also subject to this convention's standards. However, if negligence on the airline's part is proven, the compensation can exceed this capped amount. The Aircraft (Investigation of Accidents and Incidents) Rules, 2012, and subsequent amendments primarily focus on the investigation process and don't directly dictate compensation amounts, but they do establish the framework for investigation and reporting. The Air India Flight 171 took off from Ahmedabad Airport in India and was going to London Gatwick Airport in the United Kingdom, which means it was an International flight. Therefore, the liability would be covered under an International Convention. In this case, the damage caused to the passengers will be governed under the Montreal Convention, 1999, also known as the 'Convention for the Unification of Certain Rules for International Carriage by Air'. Montreal Convention, 1999 India was the 91st country to ratify the Montreal Convention 1999. The Convention was effective for India on 30th June 2009, wherein the death of a passenger, there is a strict liability of 100,000 SDRs. As per Article 17, the liability of an air carrier is limited under specific conditions. The carrier is liable for a passenger’s death or bodily injury only if the accident occurred on board the aircraft or during embarking or disembarking operations. As per Article 21, the air carrier cannot exclude or limit its liability for passenger death or injury damages up to 100,000 Special Drawing Rights (SDRs) per passenger. For damages exceeding this amount, the carrier is not liable if it proves that the harm was not due to its own negligence or that of its employees or agents, or that the damage was entirely caused by a third party’s negligence or wrongful act. The SDR is an international reserve asset created by the IMF to supplement the official reserves of its member countries. As per Article 24, the SDR amounts are reviewed and adjusted every 5 years for inflation. Thereafter, the current SDR amount is updated by the International Civil Aviation Organisation in the month of October,2024. As per the reports, one SDR is equal to 122 INR. The Kerala High Court division bench in the case of National Aviation Company Of India Ltd vs S.Abdul Salam dated 25.10.2011 has held that while an air carrier’s liability for passenger death or injury in an air accident is unlimited, only actual damages proven by the victim or claimants are payable, either through settlement or by a competent civil court. The law does not mandate any minimum compensation under Rule 21(1) or any other provision, although carriers are encouraged to offer reasonable ex gratia payments to avoid prolonged litigation. In the absence of a settlement, claimants must establish the extent of damages in court. The carrier may defend itself by proving contributory negligence on the part of the passenger. For claims exceeding the threshold, the carrier can escape additional liability only by proving that the accident was not due to its own or its agents' negligence, or was solely caused by a third party, failing. Judgement Link Who is to claim compensation The legal heirs or dependents of the deceased can file a claim for compensation. In case of injury, the passenger themselves can do so. The amount depends on the proof of damage or loss (for claims beyond the strict liability limit). As per Article 33, an action for damages may be initiated, at the plaintiff’s choice, in the territory of a State Party either where the carrier is domiciled, has its principal place of business, where the contract was made through a business location, or at the place of destination. In cases involving death or injury of a passenger, the plaintiff may also sue in the State where the passenger had their principal and permanent residence at the time of the accident, provided the carrier operates services to or from that State under its own or a partner carrier’s aircraft, and conducts its business from premises it owns or leases. CONCLUSION The tragic crash of Air India Flight 171, resulting in nearly 300 fatalities and massive property damage, marks one of the most catastrophic aviation disasters in India’s history, raising critical questions about airline accountability and systemic safety failures. Governed by the Montreal Convention, 1999, and India’s Aircraft (Investigation of Accidents and Incidents) Rules, 2012, the legal framework mandates strict liability up to 100,000 SDRs per passenger, with scope for higher compensation if negligence is proven. Legal heirs of the deceased can seek damages through various jurisdictions, though claims beyond the fixed threshold require evidence and may involve prolonged litigation. The crash not only exposes the country to liabilities exceeding ₹1,000 crore but also highlights the urgent need for stronger aviation safety standards, accountability mechanisms, and crisis response systems to prevent such devastating incidents in the future. Author: Mr Akhand Pratap Singh Chauhan, Partner Co-Author: Mr. Sachin Sharma, Assessment Intern

Abstract The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Draft DPDP Rules, 2025 are a milestone piece of legislation in India's data protection landscape. The Act prescribes a clear legislative framework for the processing, storing, sharing, and collecting of personal data, to enable digital privacy. The following article deals with important definitions within the Act, such as personal data, data principal, data fiduciary, and data processor, to help understand the compliance requirements. The article states procedural requirements such as valid consent being obtained, transparent notices given, and categorization of the data. It also addresses the practical compliance actions, such as in-house data mapping, security arrangements such as encryption and multi-factor authentication, and provisions about the cross-border transfer of data. Also, it enlightens on the most important provisions of the draft 2025 Rules, specifically those concerning consent management, notice requirements, and the State's role in data processing. Overall, the article is a practical manual for enterprises to adapt to new legal requirements while upholding data protection and the rights of users under the changing Indian privacy framework. Introduction The Digital Personal Data Protection Act, 2023 (DPDP Act), read with the draft Digital Personal Data Protection Rules, 2025 (DPDP Rules), constitute the keystone in India’s efforts to regulate the collection, processing, and protection of digital personal data. These regulations serve to protect privacy rights while outlining legal parameters for businesses. Here’s where we will explore how these regulations create the mechanics around data collection and analysis, while also contextually defining terms for how this works that preceded the Act. History and Evolution of the Act The legal framework of India for data protection was initiated with the historic Supreme Court decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, which adjudged the right of privacy to be a constitutional right under Article 21 of the Constitution. The Court emphasized that privacy is the core of the liberty of individuals and set out the test of proportionality for any restriction. This decision gave constitutional bases for a sound system of data protection that influenced the key features of the Digital Personal Data Protection (DPDP) Act, 2023, such as informed consent, data minimization, and rights of the individual about personal data. Before the DPDP Act, the Information Technology (IT) Act, 2000, was the major law governing digital data. Yet, it provided scant protection, with just Sections 43A and 72A protecting personal data security. The digital economy is evolving, and with it, we've seen a rise in data misuse that has exposed the gaps in the IT Act. This situation called for a comprehensive data protection law. It was in 2017 that the Justice B.N. Srikrishna Committee was established to tackle these matters, recommending a rights-based framework based on responsibility, consent, and localisation of data. This gave way to the Personal Data Protection (PDP) Bill in 2019. The bill came under criticism due to its robust data localization requirement and the general powers granted by it to the government under Section 35. Following delays and 81 amendments proposed by the Joint Parliamentary Committee, the PDP Bill was withdrawn in 2022. Subsequently, the DPDP Bill, 2022, was brought, with a more balanced and business-friendly approach, and was finally enacted as the DPDP Act, 2023. The Act creates a consent-based regime, enshrines roles such as data fiduciaries and principals, gives individuals the right to access, correct, and delete data, and imposes draconian penalties for non-compliance, a huge leap towards privacy-oriented data governance in India. Key Definitions in the act involved in gathering and processing the personal data under this act: Data Fiduciary- It signifies that any individual who alone or together with other individuals determines the purpose and method of processing of personal data. Data Principal- A Data Principal is the person to whom the personal data refers. If the person is a child or an individual with disability, their legitimate guardian represents them. Data Principals have rights under the DPDP Act, such as accessing, correcting, or deleting their data. Personal Data- It refers to any information relating to a natural person who is or can be identified by such information. Consent Manager- A Consent Manager is an individual or company that assists people (referred to as Data Principals) in controlling their permission (consent) on the use of their personal data. They facilitate people to provide, monitor, or withdraw their consent whenever needed. Consent Managers must adhere to tight guidelines so the process remains transparent, safe, and easy to use Procedure for Collecting and Analysing Data under DPDP Act and Rules[1] Notice sent for processing data by Data Fiduciary to Data Principal under the Draft DPDP Rules of 2025 and the Digital Personal Data Protection Act of 2023, a Data Fiduciary has to provide a clear and distinct notice to the Data Principal prior to collecting or processing any personal data. This notice must be composed in clear, simple language and must specify the kinds of personal data being gathered, the grounds for processing as per law, and the character of the goods or services. The notice must also notify the Data Principal of their rights, such as the right to withdraw consent, rectify their data, and lodge complaints with the Data Protection Board. Even if prior consent was received before the implementation of the Act, the Data Fiduciary is nonetheless required to give a new notice with all necessary information. The notice should be standalone, understandable in isolation, and available in both electronic and print media as necessary. The Data Fiduciary should also keep a record of notices given and issue a revised notice if there are any alterations in the purpose or means of data processing. This helps in ensuring transparency, accountability, and safeguarding personal data in accordance with the DPDP regime.  Reasonable Security safeguards undertaken by Data Fiduciary[2] For the secure processing of personal information, the Data Fiduciary will be required to employ a range of reasonable measures to secure data. These would be technical ones, such as encryption, masking, and obfuscation, as well as virtual tokens, for securing the confidentiality, integrity, and availability of personal information. Compelling access controls and regular surveillance of computer facilities, complete with periodic logging of activity will have to be instituted to detect unauthorized access and provide for effective investigation and remediation. Furthermore, the Data Fiduciary needs to provide data retention and business continuity by keeping regular data backups and keeping logs and personal data for a minimum period of one year, unless otherwise mandated by law. Contractually, Data Fiduciaries should ensure that Data Processors are also bound to implement similar safeguards. Organizational and technical measures shall be taken to effectively enforce these obligations, with the expression "computer resource" being interpreted as per the Information Technology Act, 2000. Role of the Consent Manager while processing the data of the Data Principal[3] A Consent Manager, under Section 2(g) of the DPDP Act, 2023, is a registered organization with the Data Protection Board that provides for the provision, administration, evaluation, and revocation of consent by Data Principals using an accessible, transparent, and interoperable platform. The task can be administered internally in an organization or contracted out to a third-party legal organization. The DPDPA suggests a process where a Data Fiduciary hires a Consent Manager to handle consent and act in the interest of the Data Principal. This structure follows the B.N. Srikrishna Committee's suggestion of taking a fiduciary approach to protecting data and putting individual consent at the centre of processing digital data. The key function of a Consent Manager is to ensure that consent is sought in an informed, purpose-specific, and verifiable way. They keep records of consent, enable its withdrawal, and ensure that consent comes before any data processing. Serving as a middleman between Data Fiduciaries and Data Principals, Consent Managers facilitate transparency and user control over personal data. By stopping unauthorized data gathering and making sure that there is accountability, they establish trust within the digital environment and maintain the fundamental tenets of the DPDP Act. Legal Compliance for obtaining valid consent from the Data Principal[4] Section 6 of the Digital Personal Data Protection Act, 2023, defines the legal standards and requirements for obtaining proper consent from the Data Principal (the person whose data is being processed). Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. It should relate only to the personal data necessary for a specific purpose. For example, if a telemedicine app requests consent to access both health data (for its services) and the contact list (which is unrelated), only the consent for health data is valid. Any consent that violates the Act or other existing laws will be considered invalid to that extent. For instance, if an insurance company asks for consent to waive the right to complain to the Data Protection Board, that part of the consent will be void. Consent must be presented in plain language, in English or any language listed in the Eighth Schedule of the Constitution and must include the contact details of the Data Protection Officer or authorized person. Data Principals have the right to withdraw consent at any time, and the withdrawal process should be as simple as the process of giving consent. However, the consequences of withdrawal (such as loss of access to services) will be borne by the Data Principal and will not affect processing done before the withdrawal. For example, if someone withdraws consent after placing and paying for an order, the order will still be fulfilled. Once consent is withdrawn, the Data Fiduciary and any associated Data Processor must cease processing the personal data unless allowed by law. Consent may also be managed through Consent Managers, who act on behalf of Data Principals and must be registered with the Data Protection Board. In legal proceedings, the burden of proving valid consent lies with the Data Fiduciary. Intimation of Data Breach to Data Principal[5] a. Immediate Intimation to Data Principals: The Data Fiduciary must promptly inform each affected Data Principal in a clear, concise, and plain manner through their registered mode of communication (such as user account, email, or mobile number). The notice must include: i. Nature, extent, timing, and location of the breach, ii. Likely consequences for the individual, iii. Mitigation measures being taken, iv. Personal safety measures the individual can adopt, v. Contact details of a responsible person to answer queries. b. Notification to the Data Protection Board (Initial Report): The Data Fiduciary must immediately inform the Board with a basic description of the breach, covering its nature, extent, timing, location, and likely impact, even before a full investigation is complete. c. Follow-up Detailed Report within 72 Hours: Within 72 hours of becoming aware of the breach (or a longer time if permitted by the Board), the Data Fiduciary must submit A report of all notifications sent to affected Data Principals. i. Detailed breach information, ii. Circumstances and reasons leading to it, iii. Risk mitigation measures taken or proposed, iv. Identity of the person responsible (if known), v. Remedial actions to avoid future incidents. Obligations of a Data Fiduciary while collecting and analysing the data of the Data Principal[6] a. Accountability and Engagement of Data Processors: A Data Fiduciary remains fully responsible for complying with the Act and its rules, even if the Data Principal fails to fulfil their duties or regardless of any contrary agreement. It may engage or appoint a Data Processor to process personal data on its behalf, but only under a valid contract and solely for activities related to providing goods or services to Data Principals. b. Data Usage and Accuracy for Disclosure or Decision-Making: If personal information is utilized to make decisions that have an impact on a Data Principal or is released to another Data Fiduciary, the initial Data Fiduciary should guarantee the completeness, accuracy, and consistency of the data. c. Security Measures and Breach Intimation: A Data Fiduciary must implement suitable technical and organizational measures to follow the provisions of the Act and prevent data breaches. This includes protecting data in its control and any processing done by a Data Processor. In case of a data breach, it must notify both the Data Protection Board and each affected Data Principal in the prescribed manner. d. Data Retention and Erasure Obligations: Unless obligated under a requirement to maintain data according to law, a Data Fiduciary has to destroy personal data when consent is withdrawn by the Data Principal or if purpose of data is reasonably understood as fulfilled—whichever comes first. e. Transparency, Grievance Redressal, and Communication: The Data Fiduciary must publish the contact information of a Data Protection Officer or another responsible person to address queries. Additionally, it must set up an effective grievance redressal mechanism for Data Principals. A Data Principal is considered inactive if she hasn't contacted the Fiduciary through any form—physical or electronic—within a prescribed period. In case of processing the data of a minor or a person with a disability, the data fiduciary has certain duties to carry out the processing of their personal data[7] a. Mandatory Verifiable Consent Before processing a child's personal data or the personal data of an individual with a disability with a lawful guardian, a Data Fiduciary is required to get verifiable consent of the parent of the child or the lawful guardian, as the case may be. The phrase "consent of the parent" shall embrace the consent of a lawful guardian where such applies. The process and manner of obtaining this consent shall be as prescribed under the Rules b. Protection of Child’s Well-being Data Fiduciaries are strictly prohibited from processing personal data in ways that may have a detrimental effect on the well-being of a child. This is a precautionary measure to prevent misuse of children's data and to uphold their safety and dignity online. c. Ban on Tracking and Targeted Advertising The Act bars Data Fiduciaries from engaging in tracking, behavioural monitoring, or targeted advertising directed specifically at children. These restrictions aim to protect children from being manipulated or exploited through personalized content or advertisements. d. Exemptions for Certain Fiduciaries The Central Government may exempt a Data Fiduciary from obtaining parental consent and from restrictions on tracking, behavioural monitoring, and targeted advertising if it is satisfied that the Data Fiduciary processes children’s data in a verifiably safe manner. This exemption applies only after a government notification and may specify an age( which shall be above 18) above which these obligations no longer apply. It is granted on a case-by-case basis and aims to balance child data protection with innovation. e. Due Diligence and Identity Verification Data Fiduciaries shall apply technical and organizational measures sufficient to enable a parent or guardian's consent to be verified. They shall ensure that the consenting party is an adult by examining trustworthy identity and age information available to the Fiduciary or voluntarily supplied information, such as a virtual token provided by a legally recognized body, such as a Digital Locker service provider. In case if a company is handling a large amount of a personal data of the individuals and has been asked to handle that data by the government, then they are known as Significant Data Fiduciary, and therefore, they have the following obligations as mentioned below: Designation and Criteria for Notification: The Central Government can issue any Data Fiduciary or class of Data Fiduciaries as an Important Data Fiduciary depending upon the quantum and sensitivity of personal data being processed, threats to Data Principals' rights, effects on national sovereignty and integrity, electoral democracy, state security, and public order. Mandatory Appointments: A Significant Data Fiduciary must appoint a Data Protection Officer (DPO) who will be based in India, report directly to the board or equivalent governing body, represent the organization under the Act, and serve as the contact for grievance redressal. It must also appoint an independent data auditor to evaluate its compliance with the Act. Annual Assessments and Audits: Each twelve months, a Significant Data Fiduciary needs to perform a Data Protection Impact Assessment (DPIA) and data audit to ensure compliance with the Act and related rules in effective way. DPIA should outline purpose of processing, rights of Data Principals, and contain an assessment and control of related risks. Reporting Requirements: The entity must ensure that the individuals or bodies conducting the DPIA and audit furnish a report to the Data Protection Board, highlighting any significant observations or findings, as part of regulatory oversight. Algorithmic and Data Localization Compliance: Significant Data Fiduciaries need to make sure that any algorithmic software they use for data processing respects the rights of Data Principals. They also need to ensure that the personal and traffic data, defined by the Central Government, remain in India and are processed domestically, according to the guidelines laid down by the government on localisation. The Data Principal then has a right to access its data once processed and analysed by the Data Fiduciary, and its rights are enumerated as follows: Right to Access Personal Data[8]: Under Section 11, a Data Principal has the right to request a summary of her personal data that a Data Fiduciary is processing. This includes details about how her data is being handled. She has the right to know who else, such as other Data Fiduciaries and Data Processors, her data has been passed on to, and a description of that transferred data. And she can request any other information about her personal data and its processing. But note that this right does not extend to sharing data with other Data Fiduciaries that are legally permitted to ask for data for purposes such as crime prevention, investigations, prosecution, or responding to cyber incidents. Right of Correction and Data Deletion[9]: Under Section 12, people have the right to request corrections for any incorrect or misleading personal information, to complete any gaps in their details, and to rectify any old information. They also have the right to have their personal data deleted. Right to Grievance Redressal[10]: According to Section 13, the Data Principal has the right to seek grievance redressal from a Data Fiduciary or Consent Manager if there is any failure in fulfilling obligations or if her rights are violated. The Data Fiduciary or Consent Manager is required to respond to such grievances within a prescribed time frame. Importantly, the Data Principal must exhaust these grievance redressal avenues before she can escalate the issue to the Data Protection Board. Right to Nominate Another Individual[11]: Section 14 states that a Data Principal may nominate some other person to exercise her rights in case she dies or is incapable. The word "incapable" covers cases of unsoundness of mind or physical infirmity preventing her from exercising her rights. Nomination must be done as prescribed under the Act and it facilitates continuity in protecting her data rights. Scope and Limitations of Rights: While the Act extends substantive rights to the Data Principal, there are certain restrictions. For example, the right of the Data Principal to access data relating to data sharing does not hold when a Data Fiduciary is forced to share data with lawfully authorized agencies in order to prevent or investigate an offence or cyber-attack. Such exceptions do not allow law enforcement and national security interests to suffer while still preserving data protection norms. They also have the following duties which they shall adhere to while giving their consent for access to their personal data, they are as follows:[12] Compliance with Laws: The Data Principal must comply with all applicable laws while exercising her rights under the Act. No Impersonation: She must not impersonate another person when providing her personal data for any specific purpose. No Suppression of Material Information: She should not hide or suppress important information while providing personal data for any official documents or government-issued IDs. No False Grievances: The Data Principal should not file false or frivolous complaints or grievances with a Data Fiduciary or the Data Protection Board. Authentic Information for Corrections: While requesting correction or erasure of personal data, she must provide only verifiably authentic information. Data Transfer across Borders[13] The Central Government can restrict the transfer of personal data outside India by Data Fiduciaries through formal notifications, subject to specific conditions. This power is used to protect national interests or data security. However, suppose any existing Indian laws require stricter protection or local storage (such as regulations from the Reserve Bank of India for payment data). In that case, those rules will take precedence over the general provisions for cross-border data transfer. In contrast to the GDPR, which is based on an adequacy model, India has government-approved restrictions on a concern related to data protection. The Digital Personal Data Protection Act, 2023 contains a few exemptions from its provisions in certain situations. They are processing personal data to enforce legal rights, by courts or regulators to conduct judicial or supervisory tasks, for law enforcement, for cross-border contractual obligations, and in the case of mergers, demergers, or insolvency-related assessments of companies The Act also exempts processing by state instrumentalities for reasons such as national security, sovereignty, or public order, and for research, archiving, or statistical purposes if no decision specific to a Data Principal is taken. Additionally, the government may exempt certain Data Fiduciaries, including recognized startups, from specific compliance obligations based on their size and nature of data processed. Furthermore, certain provisions do not apply to processing by the State where no decision affecting the Data Principal is involved. Lastly, the Central Government may, within five years, exempt specific classes of Data Fiduciaries from any provisions of the Act through official notification. Composition and Structure of the Data Protection Board of India[14] The Central Government will establish the Data Protection Board of India on a notified date to enforce the provisions of the Act. This Board will function as a body corporate with its own legal identity, capable of owning property, entering contracts, and being sued or suing in its name. It will consist of a chairperson and other Members as determined by the government. The Central Government will appoint these individuals and must possess integrity along with expertise or experience in fields like data governance, law, dispute resolution, ICT, or digital economy, with at least one member being a legal expert. Powers and Functions of the Board[15] The Data Protection Board of India is empowered to take immediate remedial actions and conduct inquiries in case of personal data breaches and impose penalties as necessary. It addresses complaints from Data Principals against Data Fiduciaries or Consent Managers and can also act on referrals from the government or courts. The Board monitors Consent Managers for compliance and can penalize breaches, including those related to registration conditions. It also investigates intermediary breaches referred by the Central Government. Additionally, the Board may issue binding directions, and has the authority to modify, suspend, or cancel them based on representations or government references. Appeal to the Tribunal from Board’s orders[16] Any person aggrieved by an order of the Data Protection Board of India can appeal to the Appellate Tribunal within 60 days, with the possibility of extension if a valid reason for delay is shown. The Tribunal, functioning entirely through digital means, hears all parties and may confirm, modify, or cancel the Board’s order, with its decisions holding the same force as a civil court decree. Appeals are best concluded in six months, and delays have to be justified in writing. The Board can also refer disputes to mediation or take voluntary undertakings from the person to settle issues without considering them to be violations, subject to the condition that the undertakings are fulfilled. Penalties imposed by the board[17] The Digital Personal Data Protection Act, 2023 (DPDPA) also authorizes the Data Protection Board to levy financial fines on organisations that violate its provisions. The Act Schedule mandates differential penalties depending on the type of breach, with the maximum being ₹250 crore (approximately USD 30 million) for non-compliance by a Data Fiduciary in putting reasonable security practices in place, and ₹200 crore (approximately USD 24 million) for non-compliance in reporting a personal data breach The Board is to report into consideration many factors while determining the penalty amount, including the level of seriousness and gravity of the violation, kind of penalty data, economic advantage or loss prevented, attempts to mitigate the violation, and overall impact of the penalty on the subject entity. Fines may be levied against Data Fiduciaries, Consent Managers, and intermediaries based on the kind of breach. For example, Consent Managers could be fined for failing to adhere to their obligations or registration requirements, and intermediaries could be fined for refusing to block access to data as ordered by the Central Government. Individuals are not, however, granted the right to claim compensation, which might dissuade them from instituting proceedings. The Board should increase transparency by publishing its reasoned decisions and issuing guidance on penalty determination. Conclusion In summary, the Digital Personal Data Protection (DPDP) Act of 2023 and its forthcoming Rules are a turning point in the manner India addresses data governance and privacy. The Act is founded on the constitutional definition of privacy as a human right and establishes a consent model that prioritizes transparency, accountability, and user control over personal data. It fills the legislative gap left by the IT Act of 2000 and puts India's data protection policies on par with the world. The obligations placed on Data Fiduciaries like adoption of strong technical measures and ensuring data minimization and legitimate processing, are an indication of the government's intent to foster privacy and innovation both. While the Act grants people the right to access, correct, and delete their data, it also aims to balance such rights, national interest, and ease of doing business. How the DPDP Rules are implemented will be key to successful implementation and enforcement to create a safe, responsible, and rights-based digital environment in India. This bill is not just a legislative amendment; it's a step towards building trust in India's fast-expanding digital economy. Authored by Mr. Ketan Joshi, Senior Associate REFERENCES A Deep Dive into India’s Draft DPDP Rules, Ikigai Law (Jan. 5, 2025), https://www.ikigailaw.com/article/614/from-principles-to-practice-a-deep-dive-into-indias-draft-dpdp-rules. Prashant Phillips Paritosh Chauhan Abhishek Singh, Consent Managers under Digital Personal Data Protection Act, Lakshmikumaran Sridharan Attorneys (Jan. 30, 2024), https://www.lakshmisri.com/insights/articles/consent-managers-under-digital-personal-data-protection-act/. India's DPDP Act to enable Indian firms align with global standards, International Business Times (Mar. 31, 2025), https://www.ibtimes.co.in/world-backup-day-2025-indias-dpdp-act-enable-indian-firms-align-global-standards-881596. The Role of a Consent Manager Under the DPDP Act, King Stubb & Kasiva (Mar. 31, 2025), https://ksandk.com/data-protection-and-data-privacy/the-role-of-a-consent-manager-under-the-dpdp-act/. Digital Personal Data Protection Act, 2023 – A Brief Analysis, Bar and Bench (Aug. 20, 2023), https://www.barandbench.com/law-firms/view-point/digital-personal-data-protection-act-2023-a-brief-analysis. Enforcement and Penalties under the DPDPA, 2023, Tsaaro Consulting (Mar. 18, 2025), https://tsaaro.com/blogs/enforcement-and-penalties-under-the-dpdpa-2023-and-draft-dpdp-rules-2025/. Enforcement and Penalties under the DPDPA, 2023, Usercentrics (Feb. 21, 2024), https://usercentrics.com/knowledge-hub/india-digital-personal-data-protection-act-dpdpa/. [1] Section 4, 5 of DPDP Act [2] Rule 6 of DPDP Rules [3] Rule 4 of DPDP Rules [4] Section 6 of DPDP Act [5] Rule 7 of DPDP Rules [6] Section 8 of DPDP Act [7] Section 9 of DPDP Act [8] Section 11 of DPDP Act [9] Section 12 of DPDP Act [10] Section 13 of DPDP Act [11] Section 14 of DPDP Act [12] Section 15 of DPDP Act [13] Section 16, 17 of DPDP Act [14] Section 18 of DPDP Act [15] Section 27 of DPDP Act [16] Section 29 of DPDP Act [17] Section 33 of DPDP Act