Author name: Progressive Infotech

The DPDP Act places consent at the centre of its regulatory architecture. Unlike some jurisdictions that offer multiple legal bases for processing (legitimate interest, contractual necessity, etc.), the DPDP Act primarily relies on consent and a narrow set of “legitimate uses” defined in Section 7. This means that for most commercial data processing, obtaining valid […]

The DPDP Act empowers Indian citizens with a set of enforceable rights over their personal data. These rights shift the balance of power from organisations that collect data to the individuals who own it. For the first time in Indian law, individuals have a clear, statutory mechanism to control how their data is used. These

India’s data protection journey has been long and complex. For years, the Information Technology Act, 2000, and its 2011 rules on reasonable security practices were the only guardrails. These provisions were widely regarded as inadequate — they lacked a dedicated regulatory body, did not define individual rights comprehensively, and imposed no meaningful penalties for data

Data protection in India has entered a decisive new chapter. After years of legislative deliberation and public consultation, the Ministry of Electronics and Information Technology (MeitY) notified the final Digital Personal Data Protection (DPDP) Rules on November 13, 2025. These rules operationalise the DPDP Act, 2023 and give every Data Fiduciary operating in India the

The Digital Personal Data Protection Act, 2023 is now in force, with the DPDP Rules 2025 notified on November 13, 2025. It establishes a clear, present-day obligation for organisations handling personal data. Every organisation processing the personal data of individuals in India, regardless of size or sector, must comply. The penalties are substantial, reaching up