Corporate News Letter - February 2026

Digital Personal Data Protection Rules 2025: Privacy, Competition & Corporate Compliance

A practical overview of India’s DPDP framework, how it compares with the EU GDPR, and what foreign businesses should do now.

India has notified the Digital Personal Data Protection Rules, 2025 and operationalised the Data Protection Board of India, marking a clear move towards enforceable digital privacy governance. While core compliance obligations are scheduled to phase in later, you should start data mapping, tighten consent and notice flows, and prepare breach-response governance now to reduce legal and commercial risk.

What changed on 14 November 2025?

India operationalised the Digital Personal Data Protection Act, 2023 (DPDP Act) through the notification of the Digital Personal Data Protection Rules, 2025 (DPDP Rules). The DPDP Act and the DPDP Rules are concerned with the Digital Personal Data which has been defined as any data about an individual who is identifiable by or in relation to such data. This data could be collected online or offline data that is later digitalised. Some examples of personal data include any information such as names, addresses, Aadhar numbers or online behaviour that identifies a specific individual and is stored or processed electronically.

The DPDP Act and DPDP Rules regulate how businesses and government will collect, use and store such digital personal data.

On the same date, the Government brought into force provisions establishing the Data Protection Board of India (DPB) as the adjudicatory authority for DPDP-related matters.

Does the DPDP framework apply to foreign companies?

Yes. The DPDP framework is not limited to businesses physically located in India.

If your business offer services to individuals in India, or runs an application which is being used by Indian customers, tracks Indian users online, or otherwise process their personal data in any way, the DPDP regime will apply even if you are headquartered outside India.

Key roles under the DPDP framework

Data Fiduciary: the business that determines why and how personal data is processed.
Data Principal: the individual whose personal data is processed.
Significant Data Fiduciary (SDF): they are subcategory of Data Fiduciary that handle high volumes of personal data or process sensitive data that poses higher risks to individual rights and freedom. SDF have enhanced obligations than that of normal Data Fiduciary. These obligations include data audits, Data Protection Impact Assessments (DPIA) and a Data Protection Officer.
Consent Manager: a regulated intermediary that enables individuals to manage and withdraw consent.

What should you do now? A simple checklist

Obtain valid consent for Data Collection and provide clear privacy notice

As per Section 5 of the DPDP Act, Companies collecting the data should provide clear notices at data collection points (apps, website) in English and/or regional languages. These notices should explain what Personal Data you collect (e.g. name, email, location, etc.), why is it being collected, and how users can exercise their right to access their personal data or remove their personal data. The data fiduciary should also obtain valid consent from data principals and such consent must be free, specific, informed, unconditional, and given through a clear affirmative action.

Use of Data only for disclosed purpose

Section 6 of the DPDP Act stipulates that the data collected should only be used for the stated purpose. New use of such collected data needs explicit, renewed consent of the Data Principal.

Implement Security Safeguards:

As per Rule 6 of the DPDP Rules, A Data Fiduciary must protect personal data in its control (including that handled by a Data Processor) by implementing reasonable security measures to prevent breaches. This includes:

Using safeguards like encryption, masking, or tokenization.
Controlling access to computer systems.
Monitoring and logging access for detection, investigation, and prevention of unauthorised access.
Ensuring business continuity through data backups.
Retaining logs and data for one year for investigation and remediation.
Including security obligations in contracts with Data Processors.
Maintaining technical and organisational measures to enforce these safeguards.

Data Breach Response Plan

Document procedures for detecting and managing personal data breaches (as provided under Rule 7 of DPDP Rules). On becoming aware of any breach, it is the obligation of the Data Fiduciary to immediately notify the Data principal of any such breach and intimate the Data Protection Board (DPB) within 72 hours of becoming aware of any breach.

Assess SDF status and strengthen governance (Section 10, DPDP Act)
Check if your company (data fiduciary) handles any large scale sensitive data or serves any vulnerable groups. If yes, the additional requirements for Significant Data Fiduciaries are as follows –
- Appoint a Data Protection Officer (DPO): Must be based in India and report to the Board of Directors.
- Independent Audits: Conduct annual audits by an independent data auditor.
- Data Protection Impact Assessments (DPIA): Perform periodic assessments to manage risks to data principals’ rights.

Document all Data Flows

Track data across your organisation, group companies, and vendors. It is important for a data fiduciary to clarify responsibilities in their Data processing Agreements in order to ensure compliance and have clarity on the handling of the data.

Protecting rights of Data Principals (Rule 14 of DPDP Rules)

Organizations must provide mechanisms for individuals to:

Access & Summary: Request a summary of their processed data and a list of third parties it was shared with.
Correction & Erasure: Update inaccurate data or request deletion of the data collected.
Grievance Redressal: File complaints through a readily available mechanism, with a mandatory response within 90 days.
Nomination: Appoint a representative to exercise rights in case of death or incapacity.

Why data protection now overlaps with competition law

Regulators increasingly treat personal data as a source of market power, especially where platforms can combine datasets across services.

This is why privacy terms, consent design, and dataset-combination decisions can attract scrutiny beyond pure data protection compliance.

Case study 1: Google / Fitbit – purpose limitation and dataset separation

Quick Answer: Regulators scrutinised Google’s acquisition of Fitbit because Fitbit devices collect sensitive health and biometric data. Approval focused on keeping Fitbit health data separate and not using it for advertising.

What it means for you: If you collect sensitive data (health, biometric, financial), expect closer scrutiny. Do not repurpose data collected for one purpose (for example, fitness tracking) into advertising or cross-selling without clear, informed consent. In transactions involving customer datasets, plan governance and separation safeguards early.

Case study 2: WhatsApp / Meta – consent cannot be forced

Quick Answer: In WhatsApp LLC & Meta Platforms Inc. v. Competition Commission of India, the Competition Commission of India (CCI) held that WhatsApp’s 2021 privacy policy imposed unfair conditions by requiring users to accept expanded data-sharing with Meta Platforms Inc. entities as a precondition for continued use. The CCI on 18^th November, 2024, imposed a penalty of ₹213.14 crore stating that the act by WhatsApp amounts to ‘abuse of dominance position’ and directed WhatsApp to ensure data sharing is voluntary, clearly disclosed, and supported by a visible opt-out option, and banned data sharing with Meta for advertising for five years (with opt-out from 2029).

Aggrieved by the penalty imposed, WhatsApp and Meta appealed to the National Company Law Appellate Tribunal (NCLAT). The NCLAT, vide its judgement dated 4^th November 2025, upheld the abuse findings, penalty, and competitive harm but set aside the five-year advertising data-sharing ban, deeming intra-group sharing standard while retaining user-choice remedies.

Both WhatsApp/Meta and CCI have since appealed to the Supreme Court of India, where hearings are ongoing as of February 2026. During the proceedings, the Supreme Court condemned “take-it-or-leave-it” consent models, emphasizing that privacy is a fundamental right and that companies operating in India must adhere to domestic data protection principles.

What it means for you: Consent needs to be real choice. If your product design pressures users into agreeing to expanded data sharing as the price of access, you increase both regulatory and reputational risk. Make opt-outs visible and terms easy to understand.

DPDP vs GDPR: where they align and where they differ

Quick Answer: DPDP and GDPR share core principles (consent, purpose limitation, rights, security and breach notification) but they are not interchangeable. Compliance with one does not automatically satisfy the other.

Key similarities

Both emphasize lawful processing based on valid, informed, specific consent.
Both require purpose limitation and data minimisation.
Both provide rights such as access, correction, erasure and grievance redressal.
Both impose security safeguards and breach notification duties.
Both can apply extraterritorially.

Key differences

Scope: GDPR covers personal data broadly, including offline processing; DPDP focuses on digital personal data and digitised offline data.
Legal bases: GDPR allows multiple lawful grounds for data processing such as contract, legitimate interest, legal obligation, etc.; DPDP is more restrictive and limits data processing mainly to consent and specific legitimate uses defined in the Act (e.g. compliance with law, employment purposes, or emergencies)..
Regulator: GDPR uses supervisory authorities across EU member states; DPDP uses a central DPB.
DPO: GDPR mandates DPOs in specified cases; DPDP requires a DPO mainly for SDFs.
Penalties: GDPR follows a two-tier , turnover-linked system, for instance, lower fines (up to €10 million or 2% of global turnover) for procedural breaches, and higher fines (up to €20 million or 4%) for serious violations such as unlawful processing or consent failures. In contrast, DPDP prescribes heavy financial penalties for the following:

Failure to Secure Data: Up to ₹250 crore.
Failure to Notify Breaches: Up to ₹200 crore.
Mishandling Children’s Data: Up to ₹200 crore(requires verifiable parental consent).

The Data Protection Board of India: what it can do

Quick Answer: The DPB is an independent adjudicatory authority with powers to inquire into non-compliance and breaches, impose monetary penalties, and issue corrective directions including cease-processing orders.

In deciding penalties, the DPB may consider factors such as the nature and duration of the breach, sensitivity of data, number of individuals affected, the entity’s profile, harm caused, and cooperation during the inquiry.

DPDP compliance timeline: when do obligations start?

The Ministry of Electronics and Information Technology notified the DPDP Rules on 14th November, 2025, initiating an 18-month phased implementation schedule. For most mid-sized and large organizations, the risk of non-compliance becomes real during 2026.

Phased Implementation Timeline

Phase	Effective Period	Statutory Obligations and Operational Requirements
Phase 1: Governance and Security	November 2025 to Mid-2026	Immediate effect for definitions, the establishment of the Data Protection Board (DPB), security safeguards (Rule 6), and breach notification rules (Rule 7). Substantive compliance obligations are not yet operational in this phase.
Phase 2: The Intermediary Ecosystem	November 2026	Mandatory registration for Consent Managers and the implementation of associated obligations for these intermediaries.
Phase 3: Individual Rights and SDF Mandates	May 13, 2027	Full enforcement of transparency and notice obligations, rights of individuals (access, correction, erasure), and the specialized duties of Significant Data Fiduciaries.

Key takeaways for foreign companies

Treat data governance as a core business function, not back-end compliance.
Map data flows across teams, group entities and vendors so responsibility is clear.
Build privacy terms and consent choices into customer journeys early, before you scale.
For Global Capability Centres (GCCs) in India, when the GCC processes data of foreign individuals solely on behalf of its overseas parent or affiliate, provided it does not handle personal data of individuals in India, then the provisions of DPDP Act are not applicable under the overseas exemption. Review and align internal policies with the DPDP Act’s consent, notice, and data-subject-rights requirements
Train employees and vendors handling Indian data on privacy-by-design principles and breach-response procedures.
Adopt transparency in privacy notices and data practices to strengthen trust with Indian consumers and regulators.
Integrate data protection reviews into M&A, outsourcing, and technology-procurement due diligence.

Conclusion

India’s DPDP framework signals a move towards a more predictable privacy regime. For foreign businesses, privacy governance now sits at the intersection of compliance, trust and competition risk.

If you build governance, consent design and breach readiness early, you reduce friction later and protect commercial reputation as enforcement becomes active.

Key takeaways for foreign companies

Treat data governance as a core business function, not back-end compliance.
Map data flows across teams, group entities and vendors so responsibility is clear.
Build privacy terms and consent choices into customer journeys early, before you scale.
For Global Capability Centres (GCCs) in India, when the GCC processes data of foreign individuals solely on behalf of its overseas parent or affiliate, provided it does not handle personal data of individuals in India, then the provisions of DPDP Act are not applicable under the overseas exemption. Review and align internal policies with the DPDP Act’s consent, notice, and data-subject-rights requirements
Train employees and vendors handling Indian data on privacy-by-design principles and breach-response procedures.
Adopt transparency in privacy notices and data practices to strengthen trust with Indian consumers and regulators.
Integrate data protection reviews into M&A, outsourcing, and technology-procurement due diligence.

Conclusion

The regulatory landscape governing Indian corporate operations is undergoing significant refinement, balancing stringent compliance expectations with substantive facilitation of business growth. The ROC enforcement actions documented in this newsletter demonstrate that regulatory authorities continue to impose substantial penalties for procedural lapses, particularly where violations recur across multiple reporting periods or where core governance functions such as the Company Secretary appointment are neglected. However, these same authorities are simultaneously removing regulatory barriers that previously constrained legitimate international business activity.

Compliance as Competitive Advantage

Organizations that recognize compliance not as a burden but as a competitive advantage are well-positioned to navigate this evolving environment. By implementing robust internal protocols for statutory disclosures, establishing succession planning frameworks for key managerial positions, implementing digital tracking systems for form filing obligations, and maintaining structured processes for capital-raising activities, companies can substantially reduce their regulatory risk profile.

Opportunities for Growth

Simultaneously, the significant liberalization of FEMA regulations provides unprecedented opportunities for Indian companies to expand internationally, manage foreign currency operations efficiently, and facilitate smoother capital flows between Indian and non-resident stakeholders.

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Subscribe to our Newsletter

Subscribe to our India Legal Updates. Practical updates on Indian law for foreign businesses, in-house legal teams & international counsel.

Ship Arrest in India: A Foreign Claimant’s Practical Guide

October 14, 2026

Digital Personal Data Protection Rules 2025: Privacy, Competition & Corporate Compliance

What changed on 14 November 2025?

Does the DPDP framework apply to foreign companies?

Key roles under the DPDP framework

What should you do now? A simple checklist

Why data protection now overlaps with competition law

Case study 2: WhatsApp / Meta – consent cannot be forced

DPDP vs GDPR: where they align and where they differ

The Data Protection Board of India: what it can do

DPDP compliance timeline: when do obligations start?

Phased Implementation Timeline

Key takeaways for foreign companies

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Subscribe to our Newsletter

Recent Posts

Ship Arrest in India: A Foreign Claimant’s Practical Guide

Categories

Digital Personal Data Protection Rules 2025: Privacy, Competition & Corporate Compliance

What changed on 14 November 2025?

Does the DPDP framework apply to foreign companies?

Key roles under the DPDP framework

What should you do now? A simple checklist

Why data protection now overlaps with competition law

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Conclusion

Compliance as Competitive Advantage

Opportunities for Growth

The convergence of these developments, heightened enforcement coupled with regulatory facilitation, signals that India’s regulatory architecture is maturing toward a model that demands operational excellence from corporates while enabling their global ambitions.

Subscribe to our Newsletter

Recent Posts

CSR Compliance in India: A Practical Guide for Foreign-Owned Subsidiaries (2026–27)

Ship Arrest in India: A Foreign Claimant’s Practical Guide

Sister Ship Arrest in India: Ownership and Cross-Border Enforcement

How to Arrest a Ship in India: Procedure, Court Orders and Security

Categories