Gateway To Privacy: Privacy Regulations Are Built On Hope - A Deep Dive Into India's Digital Personal Data Protection Act (Podcast)

Businesses increasingly rely on customer information, employee records, analytics, cloud platforms and third party technology. As data use grows, organisations need more than a privacy policy. They need evidence showing how personal data is collected, used, stored, shared and protected.

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.

India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.

Indian businesses face a complex regulatory landscape when responding to data breaches, requiring coordination between technical containment, legal assessment, and multiple reporting obligations. Understanding the parallel timelines under CERT-In's six-hour cyber incident reporting and the DPDP Act's breach notification requirements is critical for compliance and risk management.

India’s digital regulatory framework is multi-layered. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) sit alongside the long-standing Information Technology Act, 2000 (“IT Act”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Guidelines” or “IT Rules, 2021”).

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.

The increasing use of remote working, Bring Your Own Device (“BYOD”) arrangements, cloud-based platforms and workplace monitoring software has made employee privacy an important consideration for employers in India. Organisations routinely collect and process employee data through access-control systems, company email accounts, endpoint security tools, attendance systems, CCTV, location services, and cybersecurity platforms.

The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.

WhatsApp’s proposed move away from phone-number-based identification towards a username-based system has, within days of being reported, triggered two distinct but connected reactions in India: public concern voiced by industry founders and privacy experts over impersonation and data-sharing risk, and a reported regulatory direction to Meta to pause the feature’s India rollout pending consultations.

Ireland offers a sophisticated regulatory framework for Alternative Investment Funds, with structures ranging from ICAVs and Investment Limited Partnerships to Unit Trusts and Common Contractual Funds. The jurisdiction provides flexible options for both retail and institutional investors, with distinct regulatory pathways for RIAIFs, QIAIFs, and ELTIFs, each designed to accommodate different investment strategies and liquidity profiles while maintaining robust investor protections.

This issue examines pivotal developments in carbon markets and climate policy, including California, Québec, and Washington's historic carbon market linkage agreement, the Trump Administration's use of Defense Production...

On 9 September 2026, the Environmental Protection Agency (EPA) and the US Army Corps of Engineers published a supplemental proposal to revise the definition of “waters of the United States” (WOTUS) under the Clean Water Act.1 The supplemental proposal builds on the agencies’ November 2025 proposed rule and responds to the Supreme Court’s 2023 decision in Sackett v. EPA, which significantly narrowed the scope of waters subject to federal jurisdiction under the Clean Water Act and established a new framework for determining which waters fall within that jurisdiction.

Australia's mandatory merger control regime undergoes significant refinement through new legislation that addresses practical challenges businesses have faced since its 2026 introduction. The amendments fundamentally reshape how control and associate relationships are assessed, what happens when acquisitions aren't properly notified, and how parties can manage completion timelines for approved mergers.

The Australian Government has unveiled its Financial Innovation Strategy, introducing a new Financial Innovation Committee and overhauling the Enhanced Regulatory Sandbox framework to better support emerging businesses testing innovative financial products. The strategy encompasses reforms across consumer data rights, digital assets, tokenised infrastructure, and regulatory frameworks designed to position Australia as a leader in financial innovation.

The Endangered Species Act protects threatened and endangered species, but what actions cross the line into prohibited "harm"? This analysis examines the legal boundaries of harm under the ESA and explores how courts and regulators interpret this critical term when balancing conservation with human activities.

The SEC has proposed rescinding its 2010 pay-to-play rule that restricted political contributions by investment advisers and their employees to government officials. After nearly sixteen years of enforcement, the Commission now characterizes the rule as having "significant unintended consequences" with draconian penalties for minor violations, proposing instead to rely on existing antifraud provisions to address pay-to-play practices.

A federal court has issued the first ruling on the constitutionality of state extended producer responsibility laws, upholding Oregon's Plastic Pollution and Recycling Modernization Act against industry challenges. The decision addresses critical questions about whether EPR programs violate the Commerce Clause and Due Process protections, with implications for similar legislation in California, Colorado, and other states. Companies subject to Oregon's EPR regulations must continue complying with registratio

The United Kingdom has introduced a new disclosure regime for investment products that are made available to retail investors in the United Kingdom. The new requirements apply to consumer composite investments (CCIs) and took effect on 6 April 2026. The CCI regime is a significant regulatory change that applies to any firm—including non-UK firms—that make investment products that are CCIs available to retail investors in the United Kingdom.

The Full Federal Court of Australia has handed down its appeal decision in Aldi Foods Pty Limited v Hampden Holdings I.P. Pty Limited [2026] FCAFC 103 which provides guidance regarding the application of copyright infringement principles to the packaging of look-alike products.