Data Policy & Regulation

India’s data protection framework is in a period of significant development. The Digital Personal Data Protection Act, 2023 has been enacted and the DPDP Rules are being finalised. A broader Digital India Act, intended to replace the IT Act, 2000, has been discussed but not yet introduced. Sector-specific regulations from the RBI, SEBI, IRDAI, and CERT-In continue to evolve. The government has also signalled interest in regulating non-personal data and AI governance. We track these developments closely and advise clients on preparing for upcoming regulatory changes rather than reacting to them after they take effect.

The proposed Digital India Act (DIA) is intended to replace the Information Technology Act, 2000 as India’s primary legislation governing the digital economy. While a draft has not yet been published, the government has indicated that the DIA will address platform regulation, intermediary obligations, online safety, AI governance, digital competition, and emerging technologies. The DIA is expected to interact with the DPDP Act and sector-specific regulations. We advise clients on engaging with the consultation process as it develops and on building regulatory flexibility into their operations to accommodate the eventual legislation.

Companies can participate in regulatory consultations when MeitY or other ministries issue draft rules or policy papers, submit comments through industry associations such as NASSCOM, IAMAI, DSCI, or sector-specific bodies, engage with parliamentary committees when relevant legislation is under consideration, and contribute to multi-stakeholder forums on data governance. We are actively involved in data policy work through varipus forums, and we assist clients in preparing policy submissions that translate business concerns into regulatory language.