Businesses collect personal data through websites, mobile applications, customer accounts, marketing forms, financial transactions and digital services. As data use becomes more complex, consent management is no longer simply a matter of adding an “I agree” button to a website.

Incorporating a company is only the beginning of a business journey. Once a company is registered, it must comply with a range of statutory obligations throughout its existence.

The Government of Maharashtra has recently enacted the Maharashtra Stamp (Amendment) Ordinance 2024, which further amends the Maharashtra Stamp Act of 1958.

Businesses increasingly rely on customer information, employee records, analytics, cloud platforms and third party technology. As data use grows, organisations need more than a privacy policy. They need evidence showing how personal data is collected, used, stored, shared and protected.

Indian businesses face a complex regulatory landscape when responding to data breaches, requiring coordination between technical containment, legal assessment, and multiple reporting obligations. Understanding the parallel timelines under CERT-In's six-hour cyber incident reporting and the DPDP Act's breach notification requirements is critical for compliance and risk management.