Data Protection As A Closing Condition: Rethinking Risk Allocation In Indian Tech Deals

Introduction

Data protection has historically been considered a compliance issue during transactions, which is generally identified during diligence and only tackled after closing, often addressed through generic representations, warranties and, in some cases, post-closing covenants. However, with the evolving regulatory framework in India, this approach is increasingly inadequate to address a material category of transaction risk. With the enactment of the Digital Personal Data Protection Act, 2023 (“DPDP Act“) and the subsequent notification of the Digital Personal Data Protection Rules, 2025 (“DPDP Rules“), data protection has moved beyond a compliance hygiene issue to become a core regulatory obligation with direct financial and operational implications for businesses.