From Law–To–Code: India's Emerging Data Protection Compliance Infrastructure

Introduction

India is on the verge of implementing the Digital Personal Data Protection Act, 2023 ("DPDPA"). To assist the industry with compliance, the Ministry of Electronics and Information Technology (MeitY"), is exploring a "law-to-code" framework that seeks to build compliance directly into technological infrastructure by converting law into machine-executable rules capable of being automatically implemented within digital systems.

The proposal also comes at a time when policy makers are increasingly concerned about the growing sophistication of AI-driven cyber threats. Advanced frontier AI systems¹ are capable of identifying vulnerabilities, system loopholes and security flaws at a scale and speed that traditional human-led compliance systems may struggle to address effectively. This has led to concerns that conventional compliance models may no longer be sufficient in an environment where cyberattacks can operate at machine speed.²