Privacy and penalty: Managing business with new data protection law

Stringent legal obligation to prevent breaches has companies reviewing their security practices

Stakeholders of India’s digital economy have their compliance teams scrambling to carry out strategy updates and get practices to align with the country’s first ever law on data protection.

The central government recently notified the Digital Personal Data Protection (DPDP) Act, of 2023. Under it, most firms that deal with data in a digital format — from the largest e-commerce platforms to fintech to IT services firms to ride-hailing platforms to health tech startups — have the legal obligation to ensure the safe collection, processing and sharing of personal data that they receive from their customers.

The law