Siechem Technologies’ vice president of legal, Pooja Damodaran, and legal associate Sailesh Neelakantan explore the uncertain space left by the delay in implementation of privacy laws released in 2023
The journey towards a strong data protection framework in India has been long. The Digital Personal Data Protection Act (DPDP Act) received presidential assent in August 2023. But more than two years have passed, and the law still remains inactive, as the central government is yet to issue the notification under section 1(2) of the DPDP Act that would bring the act into force.
As digital transformation accelerates across industries, the absence of a functioning privacy legislation increasingly exposes businesses to regulatory uncertainty and operational risk. This has left India in an unusual situation, where a comprehensive privacy framework exists on paper but remains without legal effect despite rising public and judicial pressure to operationalise it.
The Information Technology Act, 2000 (IT Act), governs electronic records, cyber offences, and limited data security, addressing personal data protection only incidentally through the IT Rules, 2011. These apply to “body corporates” handling sensitive data, but grant no rights to individuals or accountability for data use.
The DPDP Act, 2023, marks a shift from a security-based to a rights-based framework, treating personal data as part of individual autonomy. It defines lawful processing, data fiduciary duties, user rights, and cross-border transfer norms, areas largely absent in the IT Act. This paradigm shift from organisational responsibility to individual empowerment places India in closer alignment with global privacy regimes, yet the delay in activation continues to erode its intended impact.
Concerned judiciary
Recently, this delay by the government was criticised by Delhi High Court, which questioned why the DPDP Act had not yet been implemented. The court stressed the urgency of enforcing data protection laws, asking whether the notification required for its implementation is even being contemplated.
From a business perspective, the court’s observations highlight the core issue: legal frameworks exist in form, but their implementation continues to be deferred.
TIMELINE
2017: The Supreme Court’s decision, in Justice KS Puttaswamy v Union of India, affirmed privacy as a fundamental right and provided the momentum for a statutory data protection framework.
2017 to 2018: The central government constituted a committee of experts, chaired by Justice BN Srikrishna, to explore legislation on privacy. The committee submitted a comprehensive draft data protection framework and recommendations to the government in 2018, which guided subsequent draft bills.
2019 to 2022: Multiple iterations of a Personal Data Protection Bill were introduced and debated, reflecting stakeholder consultations and successive revisions.
2023: The DPDP Act was published in August 2023, after receiving the presidential assent, but required notification of a commencement date and rules to become operative.
2025: The government released draft rules in January 2025, and invited feedback and comments from the public and stakeholders on cross-border transfer provisions, and breach reporting timelines. Much of this consultation focused on contentious areas, including the above-mentioned and exemptions for government entities. Despite extensive submissions and multiple stakeholder meetings, final notification remained pending as of September 2025, leaving organisations uncertain about compliance expectations.
Business uncertainty
The high court’s comments point to the main issue here, the presence of a data protection law that is not enforceable. This delay has created a policy vacuum, with companies not being able to rely on consistent standards or guidance on enforcement.
You must be a
subscribersubscribersubscribersubscriber
to read this content, please
subscribesubscribesubscribesubscribe
today.
For group subscribers, please click here to access.
Interested in group subscription? Please contact us.
你需要登录去解锁本文内容。欢迎注册账号。如果想阅读月刊所有文章，欢迎成为我们的订阅会员成为我们的订阅会员。
