Data Privacy
The firm advises on data protection compliance under the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000. Instructions come from multinational corporations, insurers and healthcare businesses, directly or through foreign counsel, on how personal data is collected, processed, transferred and disclosed.
The legal framework
The practice works under the Digital Personal Data Protection Act 2023 and the rules made under it, which govern notice, consent, the obligations of data fiduciaries and processors, the rights of data principals and the transfer of personal data outside India, with enforcement by the Data Protection Board of India and appeal to the Telecom Disputes Settlement and Appellate Tribunal. Until the Act is fully in force, Section 43A of the Information Technology Act 2000 and the Sensitive Personal Data or Information Rules 2011 continue to apply. Sectoral regimes overlay both: the Reserve Bank of India's directions on the storage of payment system data, the outsourcing and data guidelines of the Insurance Regulatory and Development Authority of India, and the requirements of the Securities and Exchange Board of India for market intermediaries. Where an Indian business processes data of persons in the European Union or the United Kingdom, the General Data Protection Regulation and the UK GDPR may reach it directly.
Scope
Compliance with the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000, including data mapping, consent frameworks and cross-border transfer assessments.
Review of privacy notices, consent architectures and data processing terms in outsourcing and IT contracts.
Advice on the collection and handling of sensitive personal data, including health data.
Notification obligations where personal data is affected by a cyber incident.
Privacy in internal investigations, including the processing of employee and company data.
Advice on the directions and reporting requirements of the Indian Computer Emergency Response Team (CERT-In).
Where it applies
Writing on this subject
Corporate Investigations and Indian Data Privacy Law
Rajat Pradhan, Padmanabh Sethunath · Mondaq · 14 January 2026
India’s Digital Renaissance: Ushering in the Digital Personal Data Protection Rules, 2025
Rajat Pradhan, Maya Ramesh, Namya Bose · Mondaq · 18 November 2025