Argus Talks: Grounds For Processing Data Under Digital Personal Data Protection Act, 2023 (Ep. 2) (Podcast)

Businesses increasingly rely on customer information, employee records, analytics, cloud platforms and third party technology. As data use grows, organisations need more than a privacy policy. They need evidence showing how personal data is collected, used, stored, shared and protected.

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.

India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.

Indian businesses face a complex regulatory landscape when responding to data breaches, requiring coordination between technical containment, legal assessment, and multiple reporting obligations. Understanding the parallel timelines under CERT-In's six-hour cyber incident reporting and the DPDP Act's breach notification requirements is critical for compliance and risk management.

India’s digital regulatory framework is multi-layered. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) sit alongside the long-standing Information Technology Act, 2000 (“IT Act”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Guidelines” or “IT Rules, 2021”).

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.

The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services, and cybersecurity platforms.

The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.

WhatsApp’s proposed move away from phone-number-based identification towards a username-based system has, within days of being reported, triggered two distinct but connected reactions in India: public concern voiced by industry founders and privacy experts over impersonation and data-sharing risk, and a reported regulatory direction to Meta to pause the feature’s India rollout pending consultations.

Argus Partners maintains offices in three major Indian cities - Mumbai, New Delhi, and Bengaluru - providing legal services across the country. The firm's strategic presence in these key metropolitan areas enables comprehensive coverage of India's primary business and commercial centers. Contact information and physical addresses are provided for each location to facilitate client engagement.

Argus Partners operates offices in three major Indian cities - Mumbai, New Delhi, and Bengaluru - providing legal services across the country. The firm maintains a professional presence with strategically located offices in key business districts including Nariman Point, Okhla Industrial Area, and Lavelle Road. Contact information and physical addresses are provided for each location to facilitate client communication and engagement.

Argus Partners maintains a strategic presence across India's major business hubs with offices in Mumbai, New Delhi, and Bengaluru. The firm provides comprehensive legal services while adhering to Bar Council of India regulations regarding professional conduct and client engagement.

Argus Partners maintains offices in three major Indian cities - Mumbai, New Delhi, and Kolkata - providing legal services across the country. The firm's website includes a mandatory disclaimer acknowledging Bar Council of India regulations prohibiting solicitation and advertising by advocates, requiring visitors to confirm their voluntary access to information.

Argus Partners maintains offices in Mumbai, New Delhi, and Bengaluru, providing legal services across India's major business centers. The firm operates under strict Bar Council of India regulations regarding solicitation and advertising, requiring visitors to acknowledge specific disclaimers before accessing information. Users must understand that website content is informational only and does not establish attorney-client relationships.

The Court held that mere subsistence of the underlying contract in cases where the debt had already matured would not lend a new lease of life to such debts in case they already stood time-barred.

Argus Partners maintains offices in three major Indian cities: Mumbai, New Delhi, and Bengaluru. The firm provides legal services while adhering to Bar Council of India regulations that prohibit solicitation and advertising, requiring visitors to acknowledge specific disclaimers before accessing information.

Argus Partners maintains offices in Mumbai, New Delhi, and Bengaluru, providing legal services across India's major business centers. The firm operates under strict Bar Council of India regulations that prohibit solicitation and advertising, with this website serving purely informational purposes. Users must acknowledge that no attorney-client relationship is created through website access and should seek independent legal advice for specific matters.

Argus Partners maintains offices in Mumbai, New Delhi, and Bengaluru, providing legal services across India's major business centers. The firm operates under strict Bar Council of India regulations that prohibit solicitation and advertising, with this website serving purely informational purposes. Users must acknowledge that no attorney-client relationship is created through website access and should seek independent legal advice for specific matters.

The Insolvency and Bankruptcy Code (Amendment) Act, 2026 introduces transformative reforms to India's insolvency framework, particularly for real estate sector resolution. How do these legislative changes...