Recent data breaches at two public sector banks-State Bank of India (in October 2026) and Bank of Baroda (in July 2026)- exposed the data of its lakhs of customers to be sold on Dark Web have raised serious questions about the security of Indian citizens’ data. These incidents have made it crucial for citizens, businesses, and all private and government entities to understand and consider certain aspects of data protection in the context of India’s much-anticipated data protection law-the Digital Personal Data Protection Act, 2023 (DPDP Act), the second phase of which comes into effect on November 13, 2026. With the expansion of digital services in India, governments, companies, and digital platforms are processing vast amounts of personal data of individuals -such as names, mobile numbers, addresses, identity information, financial details, health records, and information related to online activities. Regardless of how accessed, all this information or data is private and requires protection. It is important to note that this law applies to digital data. Against this backdrop, the Digital Personal Data Protection Act, 2023, was enacted to strike a balance between personal data protection and lawful, transparent, and responsible data processing.
This law not only seeks to prevent data breach, but also stipulates the reasons for personal data collection by an organisation, the scope of its use, the period for which it can be retained, and the rights individuals can exercise over their data. The fundamental principle of data law is that personal data must be used for a legitimate purpose and based on the individual’s consent or a legally recognised “legitimate use.”
The DPDP Act refers to the individual to whom the data relates as the “Data Principal”; the entity that determines the purpose and manner of data processing as the “Data Fiduciary”; and the entity that processes data on behalf of the Data Fiduciary as the “Data Processor.” This law grants individuals, as “Data Principals,” numerous rights, including right to access information about personal data, right to correction and erasure of personal data, right of grievance redressal and right to nominate. Juxtapose to global Data protection Law DPDP Act imposes duty upon Data Subject in case of its failure it also imposes a penalty of Rs 10,000-.
The Data Protection Law not only allows citizens to control the use of their personal data, linking the collection and use to a clear purpose and legitimate basis, but also obligates companies to provide notice to Data Principal, obtain consent in case processing does not fall within Legitimate use, execute a valid contract while engaging a Data Processor to process personal data, adopt appropriate technical and organisational measures, ensure accountability timely notifying the Data Protection Board and Data Principal in the event of a data breach. It is also important for the Data Fiduciary to understand that in case of failure to implement appropriate technical and organisational measures may attract a penalty upto Rs 250 Cr.
In November 2025, the government notified the DPDP Rules, 2025, setting an 18-month phased implementation plan to enable organisations to make technical and organizational measures for implementing the law. In the first phase, which concluded on November 13, 2025, some preliminary provisions of the rules came into effect with the notification. These include the institutional framework and basic provisions related to the Data Protection Board. In this phase, most companies’ detailed daily compliance obligations have not yet been fully implemented. In the second phase, which comes into effect on November 13, 2026, provisions related to the registration and obligations of “consent managers” are coming into effect. Consent managers are systems that help individuals provide, view, change, or revoke their consent to their data. To be registered as Consent Manager applicant must be a Company incorporated in India, must have sufficient capacity to fulfill its obligation as a consent manager, having net worth of more than Rs 2 Crore, whose proposed operations are in interest of Data Principals.
If any of the company fulfill these criteria can enter into this competitive industry. In the final and third phase, which comes into effect on May 13, 2027, most of the practical obligations, such as clear notices, consent management, data security measures, data principal rights, grievance redressal, and additional obligations for special category entities, will come into effect. Therefore, individuals, businesses, and organizations covered by the data protection law should not consider May 13, 2027, as the deadline for preparation; instead, it would be advisable to begin with data mapping, preparing data inventory, contract amendments, implementing technical and organizational security measures, execute valid contract with the Vendors to ensure flow-down of obligations and employee training in advance. To comply with this law, organizations and businesses must understand what personal data they collect and why.
This requires them to create comprehensive data inventories and data flow maps related to customer, employee, vendor, website, mobile app, cloud service, and third-party service provider data. Every data fiduciary must provide clear and easily understandable information to the data subject when collecting data, and the notice must indicate which data is being collected for which specific purpose. Informed consent should not be obtained through vague or implicit terms, and the company should only collect as much data as is necessary for the stated purpose. If data was collected for a specific purpose and that purpose has expired, there should be a provision for data deletion beyond the legally required period.
The Data Act requires data fiduciaries to withdraw consent or delete data upon the expiration of the purpose; to have it deleted by the data processor; and to take appropriate safeguards to protect the data under their control and the data processed by the data processor. Companies must adopt technical and organisational measures to protect personal data and establish mechanisms for individuals to request access, correction, deletion, consent withdrawal, and complaints regarding their data. Identifying, timing, recording, and addressing requests will also be a key component of compliance.
Siddharth is Associate Professor, Faculty of Law, University of Delhi and Saurabh is advocate at the Supreme Court of India; Views presented are personal.