India Passes New Data Protection Legislation

After several years of debate, India has passed the Digital Personal Data Protection Act of 2023 (DPDPA), an overhaul of the country’s data protection regime that will require employers operating in India to take stock of current data protection policies and ensure alignment with the new law.

Like the European Union’s General Data Protection Regulation (GDPR), the DPDPA is a comprehensive framework that will require data processers to identify a lawful purpose for processing personal data, with limited exceptions such as in cases where the data is publicly available or the processing is necessary as part of a merger or a restructuring.  Similar to the GDPR, it applies to all data processing in India or that is related to the provision of goods and services to individuals in India.