Time for Global Businesses to Strategically Navigate India’s New Data Protection Law

Date and Time:

Thursday, December 18, 2025
(06:30 PM – 07:30 PM IST)

 

INTRODUCTION

The Digital Personal Data Protection Act, 2023 and the rules are finally here, and it fundamentally changes how businesses handle digital personal data. The new law has extra territorial jurisdiction and applies to non-Indian businesses with a nexus to India. The new framework impresses upon consent-based processing, prescribes obligations for businesses handling personal data, introduces mandatory time bound breach reporting, purpose and retention limitations, and grievance redressal mechanisms to be deployed. The new framework mirrors the GDPR’s rigorous approach to data protection and demands elaborate preparation and attention by businesses in the coming 18 months, to mitigate the risk of penalties which may extend upto approximately USD 30 Million.

KEY DISCUSSION POINTS

  • Unpacking Applicability: Assessing roles of businesses as data fiduciaries or processors including in complex, layered, and cross border structures.

  • UI/ UX overhaul: Moving beyond passive check boxes to granular, purpose based affirmative consents.

  • Operationalizing the Consent Manager Ecosystem: Preparing businesses to successfully integrate and leverage the Consent Manager construct.

  • Deletion, Minimization and Purpose Limitation: Data mapping / inventory of legacy data and personal data to be collected and automated/ scheduled deletion.

  • The Reporting Plan: Addressing multiple reporting requirements, stemming from central and sector specific regulations

  • Overlapping Retention Timelines: Addressing varied overlapping retention timelines across central and sector specific regulations.

  • Cross Border transfers and localization: Navigating cross border data flows for global businesses.

  • Protecting the youth and persons with disabilities: Practical steps for verifiable consent of parents/ guardian and navigating the proscription of targeted advertising.

  • Documentation Liability Check: Assessing existing data protection documents (data processing agreements, privacy policies) and practical steps to reduce liability of risk for businesses.

Flow of the session

06:30 PM to 07:15 PM (IST)

Focused Discussion

07:15 PM to 07:30 PM (IST)

Audience Q&A

Speakers

Vaibhav Parikh

Lead – Corporate Transactions and Technology Practice

 

Aaron Kamath

Lead - Tech, Digital Media and Commercial Law Practice

 

Prerana Reddy

Member, Technology Law Practice

 

Shashank Venkat

Member, Technology Law Practice

 

Uttara Jhaveri

Member, Technology Law Practice

 

Recommended Reading