Data protection lawyers for businesses help organisations understand privacy laws, manage personal information responsibly and reduce the legal risks associated with collecting, storing, using and sharing data. As companies increasingly rely on digital platforms, customer databases, cloud services and third party providers, data protection has become an essential part of business governance. A privacy issue can lead to regulatory scrutiny, contractual disputes, financial losses and damage to customer trust. In India, the evolving data protection framework makes early legal guidance particularly valuable. Businesses need to understand their current obligations, prepare for upcoming regulatory requirements and build processes employees can follow in practice. Data protection lawyers support this work by translating legal rules into clear policies, contracts, risk assessments and incident response procedures. Why Data Protection Is a Legal Priority for Businesses? Personal information is used across nearly every business function. Sales teams manage customer details, human resources departments process employee records, finance teams handle payment information, and digital platforms collect information through websites and applications. Each activity can create legal risks if information is collected without an appropriate basis, used for an undisclosed purpose, retained unnecessarily or shared without suitable safeguards. A data breach is only one possible source of liability. Businesses may also face complaints about misleading privacy notices, inappropriate marketing, weak vendor controls, excessive employee monitoring or failure to respond properly to requests concerning personal information. Poor documentation can make it difficult to demonstrate how a decision was reached or whether the organisation followed its own procedures.  Data protection lawyers help identify these risks before they develop into disputes. Their role is not limited to interpreting legislation. They also help management understand how legal requirements affect commercial decisions, technology projects, employment practices and customer relationships. Understanding India’s Data Protection Legal Framework 1. Digital Personal Data Protection Act, 2023 The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in India. It sets out obligations for Data Fiduciaries, provisions relating to individual rights, safeguards for personal data and consequences for non compliance. The Digital Personal Data Protection Rules, 2025 provide further detail on how key requirements are intended to operate. The framework is being implemented in phases. As of October 2026, some institutional and preliminary provisions are in force, while many substantive operational duties are scheduled to commence on 13 May 2027. Businesses should therefore distinguish between requirements already effective and those requiring advance preparation. The official DPDP Act commencement notification and implementation timeline provides the legal basis for these dates. Data protection lawyers can help businesses assess which provisions currently apply, identify future obligations and prepare an implementation plan. This may involve reviewing privacy notices, consent mechanisms, internal responsibilities, data retention practices, individual request procedures and arrangements with service providers. 2. Information Technology Act and CERT In Directions The Information Technology Act, 2000 and applicable rules remain relevant to cybersecurity and information handling. CERT In, India’s national cyber incident response agency, has issued directions under Section 70B of the Act. These include reporting specified cyber incidents within six hours of noticing them or being informed of them, alongside requirements concerning system logs and other cybersecurity practices for entities within scope. A business may have to consider cybersecurity reporting obligations even where an incident does not involve personal data. Legal advisers can help identify the relevant reporting route, coordinate with technical teams and ensure deadlines are not overlooked. The applicable directions and clarifications are available on the official CERT In website. Depending on the industry, businesses may also need to consider sector specific rules, contractual commitments and foreign privacy laws. A company serving international customers may have obligations beyond the Indian framework, depending on its activities and the laws applicable to those activities. How Data Protection Lawyers Reduce Business Legal Risks? 1. Identifying Legal Risks Through Data Mapping Businesses cannot manage data protection risks effectively without understanding what information they hold and how it moves through the organisation. Legal advisers help map personal data across customer onboarding, marketing, employee management, payments, analytics and third party services. The assessment considers why information is collected, who can access it, where it is stored, how it is shared and when it should be deleted. It can reveal unnecessary data collection, unclear responsibilities, excessive access permissions and gaps in vendor arrangements. The findings help businesses prioritise improvements based on legal exposure and practical risk. 2. Drafting Privacy Policies and Notices Privacy notices explain how an organisation handles personal information. If the notice is vague, incomplete or inconsistent with actual practices, customers may be misled and the business may struggle to demonstrate responsible data handling. Data protection lawyers help draft notices which accurately reflect the organisation’s activities and applicable legal requirements. They can also review website forms, app permissions, cookie notices, employee privacy statements and marketing communications. The objective is to ensure disclosures are understandable, relevant and consistent with how information is actually processed. A policy alone does not establish compliance. Employees and systems must follow the documented approach, and the organisation should update its notices when its data practices materially change. 3. Reviewing Contracts With Vendors and Business Partners Many businesses rely on cloud providers, payroll platforms, customer relationship management systems, marketing agencies and outsourced support teams. These arrangements can create uncertainty over security responsibilities, permitted data use, breach notifications and deletion of information when a contract ends. Lawyers help review service agreements and data processing terms to define each party’s responsibilities. Relevant provisions may cover confidentiality, access controls, security safeguards, incident notification, subcontracting, audit cooperation, data transfers and return or deletion of records. Clear terms reduce the risk of disputes and help the business respond more effectively when a vendor fails to meet its obligations. 4. Preparing for Data Breaches and Regulatory Investigations A suspected breach often requires rapid coordination between IT, management, communications teams and legal advisers. Organisations must establish what happened, which information may be affected, whether systems remain compromised and which notifications may be required. Legal advisers help interpret applicable reporting duties, preserve relevant evidence and document decisions. They can also assist with communications to regulators, affected individuals, customers and contractual partners where appropriate. A prepared response plan reduces the risk of missed deadlines, inconsistent statements and avoidable delays. Businesses should not wait for an incident before establishing these procedures. Regular exercises help confirm whether staff know how to escalate a problem and whether decision makers can access the information needed to respond. 5. Supporting Employee Data and Workplace Compliance Employee information may include identity documents, salary details, performance records, health related information and access logs. Collecting or sharing such information without appropriate safeguards can create privacy concerns and employment disputes. Lawyers help review employee notices, monitoring policies, recruitment procedures, background checks and record retention practices. They can also advise on access restrictions and internal processes for handling complaints. The approach should balance legitimate business needs with applicable privacy requirements and employee expectations. 6. Managing Data Retention and Deletion Keeping information indefinitely increases exposure if systems are compromised or records are used inappropriately. However, deleting records too early can also create legal problems where tax, corporate, employment or litigation requirements call for continued retention. Data protection lawyers help develop retention schedules based on the type of information, its purpose and applicable legal obligations. They also advise on legal holds, secure deletion, backup systems and responsibilities when a vendor relationship ends. A documented schedule helps avoid both unnecessary retention and premature destruction of important records. 7. Assessing New Technology and Business Projects New applications, artificial intelligence tools, analytics platforms and digital marketing systems may introduce privacy risks before a product reaches customers. Personal information entered into an external AI tool, for example, may be processed under terms the business has not reviewed. Legal advisers can assess proposed uses of data, review supplier terms and identify issues involving transparency, access, retention, confidentiality and transfers. Businesses seeking guidance from data privacy lawyers can use this review to build privacy considerations into product development and procurement decisions rather than trying to resolve problems after launch. When Should a Business Consult a Data Protection Lawyer? Legal support is useful when a business launches a new website or application, expands into a new market, introduces AI tools, changes its marketing practices, appoints a new data processor or experiences a suspected breach. It is also valuable when responding to a customer complaint, negotiating a contract involving personal information or preparing for upcoming legal requirements.Smaller businesses may not need a full time privacy legal team. They can still benefit from periodic reviews, clear internal responsibilities and access to specialist advice when a significant risk arises. Businesses working with technology corporate lawyers can also align privacy requirements with technology contracts, commercial transactions, intellectual property concerns and wider corporate governance. Practical Steps to Reduce Data Protection Risks Businesses should begin by creating an inventory of the personal information they hold and identifying the legal requirements relevant to each activity. They should review privacy notices, restrict access to sensitive records, establish retention schedules and assess third party providers. Staff training should explain how to handle personal information and report suspected incidents. Management should assign responsibility for privacy compliance and review progress periodically. Legal and technical teams should work together because a policy cannot compensate for weak security, while technical controls cannot resolve every issue involving lawful processing, transparency or contractual responsibility. Records of assessments, training, decisions and incident responses can help demonstrate a consistent compliance approach. Conclusion Data protection lawyers help businesses reduce legal risks by identifying gaps in data handling, interpreting applicable laws, reviewing contracts and preparing organisations for privacy complaints or security incidents. Their involvement can support better decisions throughout the data lifecycle, from collecting information to retaining, sharing and deleting it. For Indian businesses, a practical approach involves understanding the phased DPDP framework, complying with applicable cybersecurity requirements and building reliable internal processes. Early legal advice can help organisations prepare for regulatory change, protect customer trust and reduce avoidable disputes. Regular reviews are essential because business models, technology and legal requirements continue to evolve. Frequently Asked Questions (FAQs) Q1. What do data protection lawyers do for businesses? They advise businesses on privacy laws, data handling practices, privacy notices, vendor contracts, data retention, individual requests and breach response. They also help identify compliance gaps and develop practical procedures to manage legal risks. Q2. Why does a small business need data protection legal advice? Small businesses often collect customer, employee and supplier information even without operating a technology focused business. Legal advice can help them understand relevant obligations, establish appropriate policies, review vendors and avoid preventable compliance problems. Q3. What laws should Indian businesses consider for data protection? Relevant frameworks include the Digital Personal Data Protection Act, 2023 and its Rules as they commence, the Information Technology Act, 2000, applicable CERT In directions and any sector specific or contractual requirements. Businesses should verify which provisions are effective for their circumstances. Q4. Can data protection lawyers help after a data breach? Yes. They can help identify applicable reporting obligations, coordinate with technical responders, preserve evidence, review communications and advise on regulatory or contractual exposure. The business should also take immediate technical steps to contain the incident. Q5. When should a company review its privacy policies? A review is appropriate when the business changes its data collection practices, launches a new product, adopts new technology, enters a new market, appoints a new service provider or becomes subject to new legal requirements. Periodic reviews can also identify outdated disclosures and procedures. Q6. How can businesses prepare for the DPDP framework? Businesses can map personal data, assess gaps, review notices and contracts, define responsibilities, establish breach response procedures and train employees. They should also track commencement notifications and distinguish current legal duties from requirements scheduled to take effect later.

Cybersecurity and data protection are closely connected, but they serve different purposes. Cybersecurity protects systems, networks and information from unauthorised access, disruption, alteration or destruction. Data protection governs how personal information is collected, used, stored, shared and deleted. Together, cybersecurity and data protection help businesses protect sensitive information, meet legal obligations and maintain the trust of customers, employees and business partners. For businesses in India, the connection has become increasingly important as digital operations expand and cyber threats grow more sophisticated. A ransomware attack, data leak or compromised employee account may create technical, financial, contractual and regulatory consequences. Understanding the applicable legal framework helps organisations move beyond reactive security measures towards a structured approach to risk management and accountability. What Is the Difference Between Cybersecurity and Data Protection? Cybersecurity focuses on protecting digital assets against threats. Common measures include encryption, access controls, network monitoring, multi factor authentication, secure software development, vulnerability management and incident response. Its primary concern is preventing or managing unauthorised activity involving systems and information. Data protection focuses on the rights of individuals and the responsible handling of personal information. It considers whether an organisation has a lawful basis to process data, whether the collection is necessary, who can access the information, how long it should be retained and when it must be erased. The National Institute of Standards and Technology’s explanation of the relationship between cybersecurity and privacy explains how these disciplines overlap while addressing distinct risks. A business can have strong cybersecurity and still mishandle personal data. For example, a company may encrypt its customer database but use the information for purposes which were never properly disclosed. Conversely, a business may publish a comprehensive privacy policy but leave its database exposed through weak access controls. Effective compliance requires both secure systems and responsible data governance. The Legal Framework for Cybersecurity and Data Protection in India 1. The Information Technology Act, 2000 The Information Technology Act, 2000 remains a key part of India’s cyber law framework. Section 43 addresses specified unauthorised acts involving computer systems, while Section 66 deals with certain acts described under Section 43 when committed dishonestly or fraudulently. Section 66C concerns identity theft, and Section 66D addresses cheating by personation using computer resources. Section 43A historically provided for compensation in specified circumstances involving failure by a body corporate to maintain reasonable security practices while handling sensitive personal data or information. However, the legal position must be read alongside subsequent data protection legislation and commencement notifications. Businesses should not assume older provisions operate unchanged or in isolation from the newer framework. 2. The Digital Personal Data Protection Act, 2023 The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in India. It places obligations on Data Fiduciaries, including responsibility for implementing appropriate technical and organisational measures to protect personal data. It also addresses personal data breach notifications, individual rights and accountability. The Act and the Digital Personal Data Protection Rules, 2025 were introduced with a phased commencement schedule. As of October 2026, organisations must distinguish provisions already in force from substantive obligations scheduled for later commencement. Many core operational requirements under the Rules are scheduled to commence 18 months after notification, in May 2027. Businesses should consult the Ministry of Electronics and Information Technology’s official DPDP Rules and enforcement timeline before treating a future requirement as an existing legal duty. The practical lesson is clear: businesses should prepare their systems and policies in advance while accurately identifying which legal provisions apply at the relevant time. 3. CERT-In Cybersecurity Directions The Indian Computer Emergency Response Team, or CERT-In, operates under Section 70B of the Information Technology Act. Its directions issued in April 2022 impose specific cybersecurity requirements on entities within their scope. These include reporting specified cyber incidents within six hours of noticing them or being informed of them, maintaining logs of ICT systems for a rolling period of 180 days within Indian jurisdiction, and meeting applicable requirements concerning time synchronisation and records. The reporting obligation is particularly important because the response team may not have all the facts within six hours. CERT-In guidance permits organisations to report the information available within the required period and provide further details later. Businesses should establish escalation procedures so employees do not delay reporting while waiting for a complete forensic investigation. The applicable directions and FAQs are available on the official CERT-In directions. Sector specific rules, regulatory directions and contractual requirements may create additional obligations for organisations operating in financial services, telecommunications, healthcare and other regulated industries. Why Cybersecurity Is Essential for Legal Compliance? 1. Protecting Personal and Confidential Information Businesses routinely process names, contact details, identity records, payment information, employee files, customer communications and confidential commercial data. Unauthorised disclosure can expose individuals to fraud and identity theft while causing financial and reputational harm to the organisation. Security controls should reflect the sensitivity of the information and the risks associated with its use. Practical measures include limiting access to authorised personnel, encrypting sensitive data, reviewing user permissions, maintaining reliable backups and testing recovery procedures. Security should also extend to paper records, removable devices, cloud platforms and third party systems where relevant. 2. Meeting Breach Reporting Obligations A cyber incident may trigger several reporting duties. The applicable requirements depend on the type of incident, the organisation, the data involved and the legal or contractual framework. A report to CERT-In may be required even where the incident does not involve personal data. Conversely, an incident involving personal information may engage data protection duties alongside sectoral or contractual requirements. Businesses should not assume a single notification satisfies every obligation. The DPDP framework includes personal data breach notification requirements, with important operational provisions subject to phased commencement. International customers may also impose additional reporting deadlines under contracts or foreign privacy laws. A documented reporting matrix helps legal, security and management teams identify the correct recipient, deadline and information required. 3. Maintaining Accountability and Evidence After an incident, regulators, customers, insurers or courts may ask what happened, when the organisation became aware of it, which safeguards were in place and how the response was managed. Logs, access records, risk assessments, incident tickets, vendor communications and decision records can help establish a reliable account. Evidence should be preserved in a controlled manner, with access restricted to appropriate personnel. Organisations should also consider legal holds and applicable retention requirements before deleting potentially relevant material. Documentation does not eliminate liability, but it can demonstrate that the business followed a considered process rather than responding without governance. Practical Steps Businesses Should Take 1. Conduct a Data and Cyber Risk Assessment Begin by identifying the personal and confidential information held by the organisation, where it is stored, why it is processed and who can access it. Map data flows between internal teams, cloud providers, software vendors and other service providers. This exercise helps identify excessive access, unnecessary collection, insecure transfers and information retained longer than required. 2. Establish Written Policies and Clear Responsibilities A cybersecurity policy should define acceptable use, access management, password and authentication controls, device security, backups, vulnerability handling and incident escalation. A data protection policy should address collection, permitted use, transparency, retention, deletion, individual requests and sharing with third parties. The policies should work together and reflect the organisation’s actual systems and risk profile. 3. Train Employees and Test Incident Response Human error remains a common source of security exposure. Regular training should cover phishing, suspicious attachments, social engineering, safe handling of personal data and prompt reporting of unusual activity. Staff should know whom to contact if an account is compromised or information is sent to the wrong recipient. An incident response plan should identify decision makers, technical responders, legal advisers, communications leads and external specialists. Tabletop exercises can test whether the organisation can contain an attack, preserve evidence, assess the affected data and meet reporting deadlines. Lessons from exercises and actual incidents should lead to documented improvements. 4. Review Vendors and Contracts A business may remain exposed even when its own systems are secure if a service provider suffers a breach. Before appointing a vendor, assess its security practices, access requirements, incident history where available and ability to support recovery. Contracts should address confidentiality, security controls, incident notification, cooperation with investigations, subcontracting, data return and deletion, and allocation of responsibilities. Certification can provide useful evidence of a vendor’s security programme, but it does not automatically establish compliance with every legal requirement. Organisations should assess whether the vendor’s controls fit the nature of the data and the services provided. The Role of Legal Advice in Cybersecurity Governance Cybersecurity is not solely an IT responsibility. Legal teams help identify applicable laws, interpret reporting duties, review contractual exposure, assess cross border data flows and coordinate communications following an incident. Technical specialists establish what occurred and how systems can be secured; legal advisers help determine what the organisation must do, when it must act and how to document its decisions.Businesses may consult cybersecurity and data protection lawyers to review incident response plans, privacy practices, vendor agreements and regulatory obligations. Early legal input can help prevent avoidable delays, inconsistent notifications and unsupported public statements during a crisis.For ongoing governance, corporate legal advisory can help align cybersecurity policies with board oversight, risk management, commercial contracts and wider compliance procedures. This integrated approach is particularly useful for growing businesses, organisations handling sensitive information and companies serving customers across multiple jurisdictions. Conclusion Cybersecurity and data protection are complementary parts of responsible business management. Cybersecurity protects systems and information from unauthorised access, disruption or damage, while data protection governs the lawful and responsible handling of personal data. Neither can replace the other. Indian businesses should understand their obligations under the Information Technology Act, applicable CERT-In directions, the DPDP framework and relevant sectoral or contractual rules. By mapping data, strengthening security controls, preparing for breach reporting, training employees and reviewing vendors, organisations can reduce legal risks and build a more resilient compliance framework. Seeking timely legal guidance and integrating corporate legal advisory services into business risk management can help organisations align their cybersecurity measures with applicable laws, contractual commitments and evolving regulatory requirements. Regular legal and technical reviews remain essential as cyber threats and compliance obligations continue to evolve. Frequently Asked Questions (FAQs) Q1. What is the relationship between cybersecurity and data protection? Cybersecurity protects systems and information from unauthorised access, disruption or damage. Data protection governs how personal data is collected, used, stored, shared and deleted. Strong cybersecurity supports data protection, but organisations must also ensure their processing practices are lawful and transparent. Q2. Which Indian laws govern cybersecurity and data protection? The principal frameworks include the Information Technology Act, 2000, applicable CERT-In directions and the Digital Personal Data Protection Act, 2023, together with its Rules as they commence. Sector specific regulations and contractual requirements may also apply. Q3. Is cybersecurity legally mandatory for businesses in India? Legal requirements depend on the organisation, its activities, the information it handles and the rules applicable to it. CERT-In directions impose specified requirements on entities within their scope, while data protection and sectoral laws may require appropriate safeguards. Businesses should assess their specific obligations rather than assume one standard applies to everyone. Q4. What should a business do after a data breach? The organisation should activate its incident response plan, contain the incident, preserve relevant evidence, assess the affected systems and information, and involve appropriate technical and legal personnel. It should identify all applicable reporting duties and deadlines, notify the relevant authorities or affected individuals where legally required, and document the response. Q5. Does the DPDP Act require businesses to report personal data breaches? The DPDP Act establishes personal data breach notification obligations, with detailed operational requirements provided by the Rules. Since commencement is phased, businesses should verify the applicable effective dates and requirements. They should also assess separate obligations under CERT-In directions, sectoral rules and contracts. Q6. How can small businesses improve cybersecurity and data protection compliance? Small businesses can start by mapping the personal data they hold, restricting access, enabling multi factor authentication, updating software, encrypting sensitive information, maintaining tested backups and training employees. They should also maintain written policies, review vendors and prepare an incident response process proportionate to their risks.

Businesses collect personal information, financial records, employee documents, customer communications and operational data every day. However, retaining information indefinitely can create privacy, security and regulatory risks. Data retention policies help organisations determine what information they should keep, why it is required, how long it should remain accessible and when it must be securely deleted. For businesses in India, an effective retention framework must balance privacy obligations under the Digital Personal Data Protection Act, 2023, statutory recordkeeping requirements, contractual commitments and legitimate operational needs. The objective is not simply to store less data. It is to retain the right information for a defensible period and dispose of it responsibly when the reason for keeping it ends. What Are Data Retention Policies? A data retention policy is a documented framework governing how an organisation stores, manages, archives and disposes of information throughout its lifecycle. It defines the principles for retaining records and establishes responsibilities for implementing those principles across business systems. A policy should explain the categories of information covered, the purpose of retention, applicable legal requirements, retention periods, deletion triggers and approved disposal methods. It should also identify who can approve exceptions and how the organisation will demonstrate compliance. A retention policy is different from a retention schedule. The policy establishes the overall rules, while the schedule assigns specific periods to categories such as customer records, invoices, employment documents, contracts, consent records, security logs and marketing data. Both are necessary because a general statement about retaining information only as long as necessary is difficult to implement without clear operational rules. Why Do Businesses Need a Data Retention Policy? Poor retention practices create risks in both directions. Deleting information too early can undermine tax reporting, contractual obligations, audits, investigations or legal claims. Keeping it too long can increase storage costs, expand the impact of a data breach and expose individuals to unnecessary privacy risks. A documented policy helps businesses identify which records must remain available and which can be removed. It also improves operational efficiency by reducing duplicate information and unnecessary storage. During an audit, investigation or customer dispute, a well maintained retention schedule helps the organisation locate relevant records and explain why they remain in its possession. Retention also supports accountability. If a business promises customers a defined retention period, its systems and internal procedures should reflect that promise. A policy which exists only as a document, without corresponding technical controls, offers limited practical protection. Data Retention Requirements Under Indian Law India does not prescribe one universal retention period for every category of business information. The applicable period depends on the record, the organisation, the relevant law and the purpose for which the information is retained. The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data. Section 8 addresses the responsibilities of Data Fiduciaries, including erasure when consent is withdrawn or the specified purpose is no longer served, subject to applicable legal requirements and exceptions. The Act and Rules also provide for specific retention and erasure obligations. The DPDP Rules, 2025 introduce further detail through Rule 8 and the Third and Seventh Schedules. Rule 8 addresses when a specified purpose is deemed no longer served for certain classes of Data Fiduciaries and purposes. It also provides for a minimum one year retention period for specified personal data, associated traffic data and processing logs, subject to the Rule's conditions and exceptions. These substantive requirements are scheduled to commence 18 months after publication of the Rules, generally on 13 May 2027. Businesses should therefore distinguish between requirements already in force and future obligations for which preparation is necessary. The official DPDP Rules, 2025 published by MeitY provide the relevant statutory text and commencement schedule. Other laws can require longer retention periods for particular records. For example, Section 128 of the Companies Act, 2013 generally requires companies to preserve books of account and relevant vouchers for at least eight financial years, subject to the statutory provisions and exceptions. GST law also contains record retention requirements. Section 36 of the Central Goods and Services Tax Act generally requires relevant accounts and records to be retained for 72 months from the due date for furnishing the annual return for the relevant year, with additional requirements where proceedings or investigations are pending. Businesses should map these obligations to the records concerned rather than apply one period to all company information. How the DPDP Framework Affects Data Retention The DPDP framework makes purpose and accountability central to personal data governance. Businesses should be able to explain why personal data is retained and identify when the purpose has been fulfilled. Retention should not continue merely because storage is inexpensive or a system has no automatic deletion setting. The position requires careful assessment because privacy obligations and statutory recordkeeping duties may overlap. A business may need to delete personal information after its operational purpose ends, while another applicable law may require certain transaction records to remain available. In such cases, the organisation should identify the precise legal requirement, retain only the information necessary to meet it and restrict access where appropriate. Businesses should also prepare for the phased commencement of the DPDP framework. A retention policy adopted now should be reviewed against the applicable commencement notifications, the Rules and any subsequent amendments or clarifications. Treating future requirements as already fully operative can be misleading, but ignoring them during system design can make later compliance costly. How to Create an Effective Data Retention Policy The first step is to prepare a data inventory. Businesses should identify the information they collect, the systems holding it, the people responsible for it and the purposes for which it is used. The inventory should include cloud platforms, customer relationship management systems, employee databases, email accounts, analytics tools, shared drives, archives and third party applications. Information held by vendors should not be overlooked simply because it is outside the organisation's own infrastructure.The next step is to identify the legal, contractual and operational requirements for each category. Legal and compliance teams should determine whether a statute requires a minimum period, whether a contract creates a preservation obligation and whether an investigation or dispute requires information to be retained. Business teams should then explain any continuing operational need. Each category should have a defined retention trigger. For example, the period may begin when a contract expires, an employee leaves, an invoice is issued, a transaction is completed or a customer account closes. The schedule should state the duration and the action required when the period ends. “Retain for five years” is incomplete unless the organisation knows when those five years begin. The policy should also assign responsibility. Legal, finance, HR, information security, IT and business owners may control different records. A named policy owner should coordinate changes, approve exceptions and ensure retention rules are implemented consistently. Choosing the Correct Retention Period There is no universal retention period suitable for every business record. The correct period depends on applicable legislation, the purpose of processing, contractual commitments, limitation periods, audit needs and the risk associated with keeping the information. Financial records may need to be retained to meet accounting and tax obligations. Employee records may need different periods depending on the type of document and applicable employment requirements. Customer profiles, marketing leads and website analytics may require shorter, purpose based periods. Security logs may need to remain available for investigations and compliance with applicable cyber security requirements. Businesses should avoid copying retention schedules from unrelated organisations or adopting indefinite retention by default. Each period should have a documented rationale. Where several laws apply, the organisation should identify the relevant minimum requirements and resolve any conflict through an appropriate legal review. Secure Deletion, Archiving and Backups A retention policy must explain what happens when the authorised period ends. Depending on the record and applicable requirements, the organisation may securely delete it, anonymise it or preserve it under a documented legal exception. Pseudonymisation alone does not necessarily remove information from privacy law if a person can still be identified using additional information. Archiving is not the same as deletion. Moving old records to a separate storage system may reduce costs or restrict access, but the information still exists and may remain subject to applicable retention obligations. Similarly, deleting a record from a live database does not necessarily remove copies held in backups, email systems, analytics platforms or vendor environments. Businesses should define backup rotation periods and restrict access to archived information. Where immediate removal from backups is not technically feasible, the organisation should document how copies expire, how restored systems handle previously deleted information and how legal requirements are met. Secure disposal should cover both electronic records and physical documents, including appropriate destruction of storage media where necessary. Managing Legal Holds and Investigations Routine deletion must not undermine a legal obligation to preserve evidence. Litigation, regulatory investigations, audits or reasonably anticipated disputes may require an organisation to suspend normal deletion for relevant records. A legal hold procedure should identify who can issue the hold, which records and systems are covered, who must preserve them and who can authorise release. The organisation should record the reason for the hold and review it periodically. A legal hold should not automatically stop deletion across the entire business. It should apply to the information relevant to the matter. Once the hold is formally released, the normal retention schedule can resume, provided no other preservation requirement remains. Data Retention in Employment and Customer Records Employee records often include identity documents, payroll details, performance reviews, attendance information, benefits records and disciplinary documents. These categories may be subject to different legal and operational requirements. HR teams should therefore avoid applying one retention period to every employee file. Recruitment records for unsuccessful candidates, for example, may require a different approach from payroll and statutory employment records. Customer information also needs careful classification. Transaction records, account credentials, support conversations, marketing preferences and consent evidence serve different purposes. Closing a customer account does not necessarily mean every record must be deleted immediately, but it also does not justify keeping all information indefinitely. Businesses should identify which records must remain for legal or contractual reasons and remove unnecessary personal data when the applicable conditions are met. Third Party Vendors and Data Retention Outsourcing does not remove the need to manage retention. Cloud providers, payroll vendors, customer support platforms and analytics services may hold copies of personal data on behalf of a business. Contracts should specify permitted retention, secure deletion, backup handling, subcontractor controls and confirmation of disposal where appropriate. The organisation should also verify whether the vendor uses information for independent purposes. A vendor may retain certain records under its own legal obligations, but the arrangement should be understood and documented. Retention promises in customer facing privacy notices should align with the actual behaviour of the business and its providers. Common Data Retention Mistakes A common mistake is using a single retention period for all data. Another is treating a policy as complete without confirming whether deletion actually happens in production systems, archives, backups and third party platforms. Businesses may also forget to suspend deletion when a legal hold applies or fail to restart normal disposal once the hold ends. Indefinite retention is another concern. It should be supported by a clear legal or operational reason, not simply by convenience. Policies also become outdated when laws change, new systems are introduced or the business begins processing additional categories of personal data. Regular reviews and documented approvals help prevent these failures. For organisations seeking to improve governance, a data privacy compliance law firm can assist with identifying applicable retention obligations, reviewing privacy documentation, assessing vendor contracts and aligning the retention schedule with Indian data protection requirements. How Businesses Can Maintain Ongoing Compliance A retention programme should be reviewed periodically and whenever a significant legal, technical or business change occurs. Organisations should test whether automated deletion rules work as intended, check whether vendors follow contractual requirements and verify whether records subject to legal holds remain preserved. Evidence of implementation can include approved retention schedules, system configurations, deletion logs, vendor confirmations, audit findings and records of exceptions. These materials help demonstrate that the organisation has moved beyond policy drafting to practical enforcement. Corporate lawyers for businesses can also help assess how recordkeeping duties interact with commercial contracts, employment matters, tax requirements and disputes. The goal is to create a consistent approach which preserves records when necessary and prevents unjustified retention. Conclusion Data retention policies are essential for responsible information management. They help businesses preserve records required by law, maintain evidence for legitimate business needs and reduce risks associated with excessive storage. An effective framework begins with a reliable data inventory, maps legal requirements to specific records, establishes clear retention triggers and assigns responsibility for secure disposal. For Indian organisations, the DPDP Act and Rules must be considered alongside company, tax, employment, contractual and sector specific requirements. The phased commencement of the DPDP framework makes advance preparation particularly important. Businesses should review their systems, document retention decisions, manage legal holds, control third party retention and test whether deletion procedures work in practice. A well implemented policy does more than support compliance: it creates a disciplined, secure and accountable approach to the entire information lifecycle. Frequently Asked Questions (FAQs) Q1. What is the purpose of a data retention policy? A data retention policy defines how long an organisation keeps information, why it needs it and what happens when the retention period ends. It helps balance legal recordkeeping duties, operational needs, privacy and security. Q2. Is a data retention policy mandatory in India? Specific recordkeeping obligations apply under several Indian laws, while the DPDP framework establishes personal data processing, erasure and retention requirements subject to phased commencement. A written policy is a practical way to identify and manage these obligations, even where a particular law does not prescribe a standalone policy document. Q3. How long should businesses retain personal data? The period depends on the purpose, applicable law, contractual obligations and any legal hold. Businesses should avoid adopting one universal period for every category of personal data. Q4. Does the DPDP Act require businesses to delete personal data? The Act addresses erasure when the purpose is no longer served or consent is withdrawn, subject to applicable legal requirements and exceptions. The detailed Rule 8 framework includes specific conditions and scheduled commencement, so businesses should assess the relevant provisions before setting their deletion procedures. Q5. What is the difference between data retention and data backup? Retention determines how long information should exist for an approved purpose. Backup creates copies to restore information after loss or system failure. Backup copies need their own lifecycle controls and should not become a reason for indefinite retention. Q6. Can a business retain data after a customer closes an account? Potentially. Certain records may need to be retained for tax, accounting, contractual or legal reasons. The organisation should document the reason, restrict access where appropriate and delete information once continued retention is no longer justified. Q7. How often should a data retention policy be reviewed? Businesses should establish a regular review cycle and reassess the policy when laws change, new systems are introduced, vendors change or business purposes are modified. Significant incidents and audit findings may also require updates.

The Digital Personal Data Protection Act, 2023 introduced a new privacy framework for India and established important roles for organisations handling digital personal data. Among the most important concepts are data fiduciaries and data processors. Understanding these roles is essential because the classification determines who decides why and how personal data is processed, who acts on another organisation's instructions and where compliance responsibility sits. A business may be a Data Fiduciary for its own customers while simultaneously acting as a Data Processor for another organisation. The distinction therefore depends on the specific processing activity rather than simply the nature or size of the organisation. What Are Data Fiduciaries and Data Processors? The DPDP Act uses two closely connected definitions. A Data Fiduciary is a person who alone or together with another person determines the purpose and means of processing personal data. A Data Processor is a person who processes personal data on behalf of a Data Fiduciary. The distinction is based primarily on decision making and control. An organisation does not become a Data Processor merely because another business owns the information. Likewise, storing information on another company's servers does not by itself determine the legal role. The key question is who determines the purpose of processing and how the processing is carried out. This distinction is important because many modern business relationships involve several parties. A company may collect customer information for its own products, use a cloud provider to host the information, engage a payroll company for employee records and use a marketing platform to send communications. Each relationship may involve a different role depending on the actual processing arrangement. Who Is a Data Fiduciary Under Indian Law? A Data Fiduciary is the organisation or person responsible for deciding the purpose and means of processing personal data. In simple terms, the Data Fiduciary determines why personal data is needed and how it will be processed to achieve the relevant purpose. For example, an online retailer collecting customer names, contact details and delivery addresses to fulfil orders will generally determine the purpose and means of this processing itself. The retailer is therefore acting as a Data Fiduciary for this activity. A hospital deciding how patient information is collected and used for providing healthcare services can similarly act as a Data Fiduciary. An employer determining how employee information is collected and used for employment administration can also fall within this role. The role is not restricted to large companies. The statutory definition refers to a “person”, which is broad enough to cover companies, firms, associations, individuals and other recognised legal persons. The legal classification therefore depends on the processing activity rather than turnover, employee count or corporate structure. Who Is a Data Processor? A Data Processor processes personal data on behalf of a Data Fiduciary. The processor performs processing activities for the fiduciary rather than independently deciding the purpose for which the personal data will be used. Common examples include cloud hosting providers, payroll service providers, outsourced customer support companies, data entry vendors, certain analytics providers and software platforms handling customer information for their business clients. The precise classification depends on the contractual arrangement and, more importantly, the actual conduct of the parties. For example, suppose an employer appoints an external payroll provider to calculate salaries using employee information supplied by the employer. If the provider processes the information for the employer's defined purpose and under the employer's instructions, it may act as a Data Processor. The employer remains the party determining why the employee information is being processed. A processor can perform sophisticated technical functions without automatically becoming the Data Fiduciary. Technical control over a system should not be confused with determining the legal purpose of processing. The Purpose and Means Test The most useful way to classify a relationship is to examine the purpose and means of processing. The first question is why the personal data is being processed. The second is who determines how the processing will take place. If an organisation determines both, it is likely to be the Data Fiduciary for that processing. If it processes personal data on behalf of another organisation and follows the other organisation's decisions, it may be the Data Processor. Businesses should avoid using superficial tests such as who owns the database, who pays the vendor, where the servers are located or which party physically accesses the information. These facts may help understand the relationship but do not replace the statutory role test. The contract is also important, but a contract should reflect the actual relationship rather than artificially create one. Calling a vendor a “Data Processor” in an agreement does not necessarily make it a processor if the vendor independently determines purposes for some of the processing. Can One Organisation Be Both a Data Fiduciary and a Data Processor? Yes. This is one of the most important concepts businesses should understand. A SaaS company may be a Data Processor when it hosts and processes customer information according to its customer's instructions. The same SaaS company may be a Data Fiduciary for information relating to its own employees, website visitors, account holders and business operations. Similarly, a marketing agency may process a client's customer list on the client's instructions for one campaign. If the agency separately collects information for its own purposes or uses the information independently for another purpose, its role may change for that processing. Role classification should therefore be performed activity by activity. Businesses should not automatically assign one privacy role to an entire organisation or vendor relationship. Data Fiduciary vs Data Processor: The Main Difference The fundamental difference is decision making. A Data Fiduciary determines the purpose and means of processing. A Data Processor processes personal data on behalf of the Data Fiduciary. A Data Fiduciary normally determines why information is collected, what processing is required, which services are engaged and how the processing fits within its business purpose. A Data Processor generally carries out defined processing activities for the fiduciary. This distinction affects contracts, accountability, privacy notices, security arrangements, breach response, deletion procedures and vendor management. It can also affect whether an organisation needs to consider Significant Data Fiduciary requirements. What Responsibilities Does a Data Fiduciary Have? The DPDP Act places the principal statutory obligations on Data Fiduciaries. Section 8 provides for responsibilities including compliance with the Act and Rules for processing undertaken by the fiduciary or on its behalf by a Data Processor. It also addresses security safeguards, personal data breaches, erasure and grievance mechanisms. A Data Fiduciary therefore cannot assume its responsibilities disappear simply because processing is outsourced. If a company appoints a processor to handle customer information, the outsourcing arrangement does not by itself transfer the fiduciary's statutory responsibility. This is a critical point for procurement and legal teams. Vendor selection should not be treated as a complete transfer of privacy responsibility. The Data Fiduciary needs appropriate contractual and operational controls over the processing relationship. What Responsibilities Does a Data Processor Have? The DPDP Act defines the Data Processor by reference to processing on behalf of a Data Fiduciary. Many of the detailed statutory obligations in Chapter II are addressed to the Data Fiduciary. This does not mean a processor can ignore privacy and security requirements. The relationship should be governed by a valid contract where the Act requires one. The contract should establish the permitted processing activities, security requirements, confidentiality expectations, breach escalation, assistance with rights requests, retention and deletion arrangements, subcontracting controls and other relevant obligations. The processor should also ensure its actual operations remain within the agreed scope. If it begins using customer information for its own unrelated purpose, the relationship may need to be reassessed because the processor could be determining the purpose of a new processing activity. Why Data Processing Agreements Matter A Data Processing Agreement or appropriate data processing provisions in a broader commercial contract can establish the operational framework between a Data Fiduciary and Data Processor. The agreement should describe the subject matter and purpose of processing, categories of personal data, categories of Data Principals, processing duration, security controls, confidentiality requirements, breach escalation, sub processors, deletion procedures and assistance requirements. The agreement should also deal with audit and assurance rights where appropriate. A fiduciary needs enough information to demonstrate oversight of its processors, particularly where the vendor handles significant volumes of personal data. Contractual wording should match the technical reality. A clause promising immediate deletion may be ineffective if the processor has immutable backups or data embedded within another system. Legal teams and technology teams should therefore review processor contracts together. Security Obligations Across the Fiduciary and Processor Relationship Security is an important area where the responsibilities of both parties need to work together. The 2025 Rules specify reasonable security safeguards for personal data, including measures concerning encryption, masking or tokenisation, access controls, logs, monitoring, backups and technical and organisational safeguards, subject to the applicable commencement provisions. The Rules also refer specifically to appropriate security provisions in contracts between Data Fiduciaries and Data Processors. A Data Fiduciary should therefore assess whether its processors maintain appropriate security controls. Vendor due diligence may include reviewing security certifications, access management, incident response procedures, encryption practices, vulnerability management and business continuity arrangements. A processor should also understand its contractual obligations. If the processor detects unauthorised access or a suspected breach, the contract should establish how quickly it must inform the fiduciary and what information it must provide. Who Is Responsible for a Data Breach? The allocation of responsibility following a breach should not be reduced to a simple statement such as “the processor is liable” or “the fiduciary is always liable”. The statutory framework, contract, facts and applicable commencement provisions must all be considered. Section 8 of the DPDP Act expressly places responsibility on the Data Fiduciary for compliance in respect of processing undertaken by it or on its behalf by a Data Processor. The processor relationship therefore does not allow the fiduciary to contract away its statutory responsibility. Operationally, the processor may be the first party to discover an incident. The contract should therefore require prompt escalation and cooperation. The fiduciary needs sufficient information to assess regulatory and individual notification requirements. Businesses should also remember that other laws can impose separate cyber incident reporting obligations. CERT In's directions, for example, contain reporting requirements for specified cyber security incidents. What Is a Significant Data Fiduciary? A Significant Data Fiduciary is a Data Fiduciary which the Central Government may notify based on specified factors. These include the volume and sensitivity of personal data processed, risks to Data Principals and potential effects on sovereignty, security of the State, electoral democracy and public order. SDF status brings additional requirements. Section 10 provides for appointment of a Data Protection Officer based in India, appointment of an independent data auditor and periodic Data Protection Impact Assessments and audits. The DPDP Rules provide further requirements for SDFs, including annual DPIA and audit requirements and due diligence concerning algorithmic software. Businesses operating large scale digital services should therefore assess whether their processing could place them within the future SDF framework. How Do SaaS Companies Fit Into the Framework? SaaS companies provide one of the clearest examples of why role classification must be activity specific. A SaaS provider may process a customer's employee information, customer records or business contacts as a Data Processor. At the same time, it may determine its own purposes for processing account information, billing information, website visitor data, employee information and security logs. The company may therefore have both roles within the same platform. Its privacy documentation, contracts and internal data maps should reflect this distinction. This is especially important for AI enabled SaaS products. If a provider uses customer submitted data for its own model training, product development or analytics, the parties should examine whether this use remains within the processor relationship. The answer depends on the actual purposes and means of processing rather than the wording of a standard contract. What About Cloud Service Providers? Cloud hosting creates another common classification question. A business may store customer records with a cloud provider while deciding why the records are processed and how the service is used. The cloud provider may act as a processor for the customer's data where it provides infrastructure on the customer's behalf. However, the provider may act as a Data Fiduciary for its own customer account information, billing information, security data and other processing activities.The correct approach is therefore to examine each processing activity separately. How Should Businesses Determine Their Role? Businesses should begin with a processing inventory rather than a list of vendors. For every major processing activity, identify the personal data involved, the purpose, the systems used, the people affected and the organisations receiving the information. Next, determine who decided why the information should be processed. Then identify who determines the key means of processing. Review the contract and compare it with actual operations. If the organisation decides the purpose and means, it is likely acting as a Data Fiduciary. If another organisation decides the purpose and the business simply processes information on its behalf, the business may be a Data Processor. The assessment should also consider whether the vendor uses the information for independent purposes. Independent use may change the role for that activity and should trigger a fresh legal review. Common Mistakes in Classifying Data Roles One common mistake is assuming the company collecting the data is always the Data Fiduciary. Collection is important, but the statutory test focuses on determining the purpose and means of processing. Another mistake is assuming the party hosting the database is the Data Fiduciary. Hosting infrastructure does not automatically establish control over the purpose of processing. Businesses also sometimes assume a processor has no privacy responsibilities. A processor relationship requires appropriate contractual and technical controls. The processor's conduct can directly affect the fiduciary's compliance position. A further mistake is applying one role to an entire vendor relationship. A company can perform several different processing activities for the same customer, with different legal roles for each activity. Finally, organisations should avoid treating GDPR terminology as an exact substitute. A Data Fiduciary broadly resembles a GDPR controller and a Data Processor broadly resembles a GDPR processor, but Indian businesses should apply the DPDP Act's own statutory definitions and requirements. The Role of Legal and Compliance Teams Correct role classification should be built into procurement, product development and contract review. A legal team should examine whether the proposed relationship reflects the actual decision making structure. data protection lawyers can assist with role mapping, data processing agreements, vendor assessments, privacy notices, cross border processing and broader DPDP compliance planning. Their review becomes particularly important where a vendor uses personal data for several purposes or combines client data with its own datasets. The assessment should not remain solely with the legal department. Technology, security, procurement, product and business teams should understand why a particular vendor is classified as a processor and what contractual controls are required. DPDP Compliance and the Current Implementation Timeline The DPDP Act was enacted in August 2023, but its provisions do not commence simultaneously. The Government's commencement notification dated 13 November 2025 brought Section 2 and several institutional provisions into force immediately. It placed Sections 3 to 5, Sections 7 to 17 and other substantive provisions within the eighteen month commencement group. This phased approach is important when discussing Data Fiduciary and Data Processor obligations in 2026. The statutory definitions are already in force, while several of the operational obligations associated with the distinction are scheduled for later commencement. Businesses should therefore avoid describing the DPDP Act as either completely inactive or fully operational. The correct position depends on the particular provision being discussed. The transition period provides an opportunity to map processing activities, classify vendors, update contracts, establish security controls and prepare privacy governance systems before the substantive obligations become applicable. Conclusion Understanding the distinction between Data Fiduciaries and Data Processors is fundamental to building a practical privacy compliance framework under Indian law. The most important question is who determines the purpose and means of processing. The answer should be assessed for each processing activity rather than assigned automatically to an entire organisation. A Data Fiduciary generally determines why personal data is processed and how the processing is structured. A Data Processor handles personal data on behalf of the fiduciary. However, modern businesses often occupy both roles across different activities. SaaS providers, cloud companies, marketing agencies, payroll providers and technology vendors may therefore need a detailed role assessment rather than a simple label. The distinction also has practical consequences for contracts, security, vendor management, breach response, deletion, audits and accountability. Organisations should maintain accurate processing inventories, review vendor relationships carefully and seek corporate legal advice where contractual or governance arrangements need to reflect the actual allocation of responsibilities. As India's DPDP framework moves through its phased commencement, businesses have an opportunity to resolve role classification issues before the substantive compliance obligations take effect. Clear allocation of roles today can make privacy notices, contracts, security controls and governance processes considerably easier to manage in the future. Frequently Asked Questions (FAQs) Q1. What is a Data Fiduciary in India? A Data Fiduciary is a person who alone or together with another person determines the purpose and means of processing personal data under Section 2 of the DPDP Act, 2023. Q2. What is a Data Processor under Indian law? A Data Processor is a person who processes personal data on behalf of a Data Fiduciary. The processor generally performs processing according to the fiduciary's purpose and instructions. Q3. Can one company be both a Data Fiduciary and a Data Processor? Yes. An organisation may be a Data Fiduciary for its own customers, employees or business operations while acting as a Data Processor for another organisation's personal data. Q4. Does outsourcing personal data processing transfer legal responsibility? No. Outsourcing does not automatically transfer the Data Fiduciary's statutory responsibility. Section 8 places responsibility on the Data Fiduciary for processing undertaken by it or on its behalf by a Data Processor. Q5. Is a Data Processing Agreement mandatory in India? Section 8 requires a Data Fiduciary to engage a Data Processor for activities related to offering goods or services to Data Principals only under a valid contract. Businesses should therefore ensure processor relationships are properly documented and reflect the actual processing arrangement. Q6. Is a cloud provider a Data Processor? A cloud provider may be a Data Processor when it hosts or processes personal data on behalf of a customer under the customer's purposes and instructions. It may separately be a Data Fiduciary for its own independent processing activities. Q7. Is a SaaS company a Data Fiduciary or Data Processor? It can be either or both. A SaaS provider may act as a processor for customer data while acting as a fiduciary for its own employees, account administration, billing, security or other independent processing. Q8. Who is responsible if a Data Processor causes a breach? The Data Fiduciary remains responsible for compliance in relation to processing carried out on its behalf. The contract should establish the processor's security and incident escalation obligations. The specific consequences depend on the applicable law, facts and contractual arrangements. Q9. What is the difference between a Data Fiduciary and a GDPR Data Controller? The concepts are broadly comparable because both roles focus on determining the purposes and means of processing. However, Indian businesses should rely on the DPDP Act's statutory definitions rather than assuming GDPR terminology automatically determines their position in India. Q10. Do Data Processors need a Data Protection Officer? The DPDP Act specifically requires a Data Protection Officer for a Significant Data Fiduciary. It does not establish an equivalent universal DPO requirement for every Data Processor. Q11. Can a vendor decide how it technically processes data and still remain a Data Processor? Technical implementation alone does not necessarily change the role. The assessment should focus on who determines the purpose and relevant means of processing. Businesses should examine the actual relationship, technical autonomy and contractual arrangements rather than relying on a label.