Important Indian Laws and Policies on Data Protection and Privacy

India regulates data protection and privacy through a statutory framework that balances individual rights with digital governance requirements. The legal architecture has evolved from basic electronic contract rules into dedicated legislation governing personal data processing, corporate accountability, and institutional oversight.

Core Legislative Foundation

Digital Personal Data Protection Act

• The legislation establishes a comprehensive legal framework for processing digital personal data within the territory of India.
• It applies extraterritorially to the processing of personal data outside India if such processing relates to offering goods or services to individuals within the country.
• The statute classifies key stakeholders into data principals, who own the personal data, and data fiduciaries, who determine the purpose and means of processing.
• Processing of personal data requires explicit, free, unconditional, and unambiguous consent given by the individual or through a registered consent manager.

Information Technology Act Provisions

• Section 43A mandates corporate entities handling sensitive personal data to implement reasonable security practices and procedures.
• Failure to maintain adequate security resulting in wrongful loss or gain exposes organizations to civil damages and financial penalties.
• Section 72A prescribes criminal penalties, including imprisonment and fines, for intentional disclosure of personal information obtained under a lawful contract without consent.

Constitutional and Judicial Mandates

Fundamental Right to Privacy

• A nine-judge constitutional bench of the Supreme Court of India in the historic Puttaswamy judgment unanimously recognized the right to privacy as a fundamental right.
• Privacy is protected under Article 21 of the Constitution as an intrinsic element of life and personal liberty.
• Any legislative or executive intrusion into individual privacy must satisfy the judicial tests of legality, proportionality, and legitimate state aim.

Rights and Duties of Individuals

Statutory Protections

• Data principals possess the right to obtain a summary of personal data processed and identities of sharing entities.
• Individuals hold rights to correction of inaccurate data, updating of incomplete records, and erasure of data once processing purposes are fulfilled.
• A unique nomination provision permits individuals to designate a representative to exercise privacy rights in the event of death or incapacity.
• Statutory duties prohibit data principals from registering false grievances, impersonating others, or withholding material information.

Obligations of Data Fiduciaries

Compliance Mandates

• Fiduciaries must issue clear, itemized privacy notices detailing the nature of data collected and the purpose of processing.
• Strict technical and organizational security safeguards must be deployed to prevent personal data breaches.
• Data fiduciaries are obligated to notify the regulatory board and affected individuals immediately upon discovering a security breach.
• Processing of data concerning children requires verifiable parental consent, with a strict prohibition against behavioral tracking, targeted advertising, or detrimental profiling of minors.

Significant Data Fiduciaries

• The central government classifies specific entities as Significant Data Fiduciaries based on the volume and sensitivity of processed data.
• Such entities face heightened compliance burdens, including appointing an India-based data protection officer.
• Significant entities must conduct periodic data protection impact assessments and independent data audits.

Regulatory Enforcement and Penalties

• The Data Protection Board of India functions as the independent adjudicatory body responsible for assessing non-compliance and imposing statutory penalties.
• Appeals against orders of the Data Protection Board are directed to the Telecom Disputes Settlement and Appellate Tribunal.
• Sectoral regulators such as the Reserve Bank of India and the Securities and Exchange Board of India enforce specialized data localization and storage norms for financial transactions.
• The Aadhaar Act regulates the collection, authentication, and vault storage of biometric identifiers for targeted delivery of subsidies and public services.