Data protection law updates can affect how businesses collect personal information, manage customer records, use artificial intelligence, work with technology providers and respond to security incidents. As governments refine privacy legislation and introduce new regulatory requirements, businesses need a reliable process for identifying changes and translating them into practical action. In India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 are central to the changing privacy landscape. International developments also matter to companies serving overseas customers or transferring information across borders. Monitoring legal updates helps businesses identify new obligations, avoid outdated practices and prepare for deadlines before they create compliance problems.

Why Businesses Must Monitor Data Protection Law Updates?

Privacy compliance is not a one time exercise. A business may introduce a new application, adopt an AI tool, outsource payroll or expand into another market. Each change can affect the personal information it processes and the laws applicable to its operations. A policy written several years ago may no longer reflect current legal requirements. Consent mechanisms may be outdated, vendor contracts may omit new responsibilities, and incident response plans may not account for revised reporting duties. Regular monitoring helps businesses identify these gaps and decide which changes require immediate attention. It also supports better planning. When a law introduces phased implementation, organisations can allocate resources, update systems and train employees before the relevant obligations take effect.

1. India’s DPDP Act and Rules: The Main Compliance Priority

The DPDP Act establishes a framework for processing digital personal data in India. It sets out responsibilities for Data Fiduciaries, addresses individual rights and provides for security safeguards, personal data breach notifications and penalties for specified contraventions. The DPDP Rules, 2025 provide further operational detail. However, the framework has a phased commencement schedule. As of October 2026, businesses must distinguish provisions already in force from substantive requirements scheduled to commence in May 2027. Not every obligation should be treated as immediately applicable.

The Government of India’s official DPDP Rules announcement and background information provides a useful starting point for understanding the framework. Businesses should monitor the effective dates of relevant provisions, assess their existing data practices and prepare for upcoming requirements. Key areas include privacy notices, consent management, data retention, individual requests, vendor arrangements and incident response. Organisations should also assess whether they may qualify as Significant Data Fiduciaries, since additional duties can apply to designated entities.

2. Personal Data Breach Reporting and Cybersecurity Rules

Breach reporting deserves particular attention because several obligations may apply to the same incident. A cyberattack can involve compromised systems, exposed personal information, contractual reporting duties and regulatory notification requirements. Under applicable CERT In directions, specified cyber incidents must be reported within six hours of being noticed or brought to an organisation’s attention. The requirement applies to entities and incidents within scope. Businesses should maintain an escalation process capable of meeting the deadline even when the investigation is incomplete. The DPDP framework introduces separate personal data breach notification duties, with substantive operational requirements subject to its phased commencement. Companies should prepare for overlapping reporting timelines rather than assume one notification satisfies every obligation. The official CERT In directions and incident reporting resources provide guidance on cybersecurity reporting. Businesses should review their incident response plans, identify who can authorise notifications and ensure relevant technical logs and evidence can be accessed promptly.

3. Global Privacy Law Changes and Cross Border Operations

Businesses operating internationally must track more than Indian legislation. The European Union’s General Data Protection Regulation, United Kingdom data protection law and privacy laws in other jurisdictions may apply depending on the organisation’s activities and the people whose data it processes. The global regulatory landscape continues to evolve through new laws, amendments, enforcement decisions and guidance. Current areas of attention include children’s privacy, international transfers, digital advertising, data security and the use of personal information in AI systems. The International Association of Privacy Professionals’ global privacy law resources can help organisations identify relevant developments across jurisdictions. International businesses should maintain a jurisdictional register showing which laws apply, the relevant regulator, key obligations and upcoming dates. A common global privacy programme can provide consistency, but local assessments remain necessary because definitions, exemptions, lawful processing requirements and reporting deadlines differ.

4. Artificial Intelligence and Automated Data Processing

AI adoption creates new privacy questions. Businesses may use AI for recruitment, customer support, fraud detection, marketing, analytics or internal productivity. These activities can involve personal information collected from customers, employees, publicly available sources or external service providers. Legal teams should monitor developments concerning AI training data, transparency, automated decision making, children’s information and the reuse of personal data for new purposes. A business should not assume information can be used to train a model simply because it already holds the information or a supplier offers the functionality. Before adopting an AI tool, organisations should identify what information will be submitted, where it will be processed, whether the provider retains inputs and outputs, and whether information may be used for model improvement. Vendor contracts and internal policies should reflect the answers. The legal position must be assessed under the privacy laws and AI rules applicable to the specific use case.

5. Data Retention, Deletion and Record Keeping

Retention requirements can change as privacy laws, tax rules, corporate obligations and sectoral regulations evolve. Keeping personal information longer than necessary can increase exposure, but deleting records too early may breach another legal duty or interfere with litigation and investigations. Under the DPDP Rules, certain future obligations address erasure after specified purposes are no longer served, subject to applicable legal requirements and the Rules’ scope. The provisions do not establish one universal retention period for every category of personal data. Businesses should review the relevant rule, schedule and commencement date before applying a deletion deadline. A practical retention schedule should identify the data category, purpose, applicable retention requirement, responsible team and deletion method. It should also account for backups, vendor systems and legal holds. Regular reviews help prevent old records from remaining in active systems without a clear business or legal reason.

6. Children’s Privacy and Sensitive Processing

Businesses offering digital services to children, education platforms, gaming products or family oriented applications should monitor rules concerning children’s personal data. The DPDP Act generally defines a child as an individual under 18, subject to the Act’s applicable provisions, exemptions and rules. The framework provides for parental consent and includes restrictions concerning specified processing practices involving children, subject to applicable exceptions. Organisations should examine age assurance, consent workflows, product design and the information collected from younger users. A global service using different age thresholds across jurisdictions may need to adapt its Indian processes. Other forms of high risk processing also warrant review. Biometric information, location data, employee monitoring and large scale profiling can raise privacy, security and fairness concerns under the laws applicable to the business. The relevant legal requirements should be assessed alongside the practical impact on individuals.

7. Regulatory Guidance, Enforcement and Penalties

Monitoring legislation alone is not enough. Regulatory guidance, enforcement decisions, official FAQs and court judgments can clarify how existing requirements are interpreted. They may also reveal areas where regulators expect stronger evidence of compliance.The DPDP Act provides for financial penalties for specified contraventions. For example, failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore under the relevant provision. The actual legal exposure depends on the nature of the contravention and the applicable statutory process. Businesses should track official publications and assess whether new guidance changes their policies, contracts or technical controls. Advice from data protection law specialists can help interpret complex updates and determine whether a change requires a policy revision, a system modification or a broader compliance project.

How to Build an Effective Legal Monitoring Process?

A useful monitoring process starts with a clear owner. Depending on the size of the organisation, responsibility may sit with legal, compliance, privacy, risk management or a cross functional team. The team should identify the jurisdictions and sectors relevant to the business, then maintain a register of laws, regulators, deadlines and outstanding actions. Each update should be assessed for its legal status. A proposal, consultation paper, enacted law and provision already in force have different implications. The review should record what changed, which business activities are affected, when action is required and who will implement it.

The team should then communicate the practical implications to relevant stakeholders. Legal may need to revise notices or contracts, IT may need to change access controls, HR may need to update employee procedures, and procurement may need to reassess suppliers. Working with corporate lawyers for technology can help align privacy developments with technology procurement, commercial agreements and wider corporate risk management. Regular reviews and management reporting help confirm whether agreed actions have been completed. The process should also be revisited when the business launches a new product, enters a market or adopts a technology involving personal data.

Conclusion

Data protection law updates can affect business operations, technology choices, contractual responsibilities and customer relationships. Organisations should closely monitor India’s DPDP framework, cybersecurity reporting requirements, global privacy laws, AI developments, retention rules and regulatory guidance. The most effective approach combines reliable legal monitoring with practical implementation. By tracking commencement dates, assessing business impact, assigning responsibilities and reviewing policies regularly, businesses can reduce avoidable risks and prepare for changing obligations. Privacy compliance is strongest when legal updates lead to clear, documented action rather than remaining unread announcements.

Frequently Asked Questions (FAQs)

Q1. What are the most important data protection law updates for Indian businesses?

The DPDP Act and Rules, their phased commencement dates, applicable CERT In directions and relevant sectoral requirements are key priorities. Businesses should also monitor official guidance and changes affecting their particular industry.

Q2. When do the main DPDP compliance requirements commence?

The framework has a phased commencement schedule. Many substantive operational requirements are scheduled to commence in May 2027. Businesses should verify the effective date of each provision relevant to their operations rather than assume every requirement is already in force.

Q3. How often should a business review data protection laws?

Businesses should monitor official developments regularly and conduct a structured compliance review at suitable intervals, such as quarterly or when a major legal change occurs. New products, acquisitions, AI adoption and entry into new markets may require an earlier review.

Q4. Do international privacy laws apply to Indian businesses?

They may apply if a business meets the relevant territorial or jurisdictional criteria, such as offering services to people in another jurisdiction or processing their personal data in covered circumstances. Applicability depends on the law and the organisation’s activities.

Q5. What happens if a business fails to comply with data protection law?

Consequences depend on the applicable law and the nature of the breach. They may include financial penalties, regulatory directions, contractual claims, litigation and reputational harm. Some laws also impose specific breach reporting obligations.

Q6. How can a business stay informed about data protection law updates?

It should monitor official government notifications, regulator guidance, relevant court decisions and trusted privacy law publications. A compliance register, assigned ownership and documented impact assessments help convert legal developments into timely business action.

This update was released on 23 Oct 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.