Corporate Investigations And Indian Data Privacy Law

Introduction

Data collation and review lie at the heart of corporate investigations, which often requires collecting and reviewing data in hostile situations involving suspected employee misconduct, misuse of company's IT assets, breach of terms of employment or company policies. The data processing requirements to be followed in corporate investigations can be gathered from The Digital Personal Data Protection Act, 2023 (DPDP Act), India's first comprehensive data protection legislation.

The DPDP Act regulates the collection, processing, and disclosure of digital personal data. On 13 November 2025, certain key provisions¹ of the DPDP Act were brought into force by the Government of India while the other provisions will come into force in November 2026 and May 2027. The DPDP Act has been operationalised by the Digital Personal Data Protection Rules, 2025 (DPDP Rules), which sets out the procedural and compliance requirements to be followed under the Act. Similar