I. INTRODUCTION
On August 11, 2023, the Digital Personal Data Protection Act
2023 (“DPDP Act”) received the
President's assent, ending the nearly five-yearjourney that
saw multiple iterations of the legislation under consideration.
Although the DPDP Act has received the President's assent,
its effective date is yet to be notified and consequently, the
prevailing law regarding the collection, handling, processing, and
transfer of personal data (including sensitive personal data) is
the Information Technology (Reasonable Security Practices and
Procedures and Sensitive Personal Data or Information) Rules, 2011
(‘IT Rules') under the Information
Technology Act, 2000 (“IT Act”). Once the effective
date of the DPDP Act is notified, it will repeal the IT Rules.
However, for the purpose of internal investigations, other
provisions of the IT Act will continue to be in effect – for
instance, where the investigation concerns unauthorized use of
computer resources.
