Data protection

What this covers

The Digital Personal Data Protection Act, 2023 sets out in a single statute how organisations may collect and use personal data in digital form. It reaches almost every business that deals with customers, employees or users in India.

The Act gives individuals rights over their data and places duties on the organisations that decide how it is used. It also creates the Data Protection Board of India, which inquires into breaches and can impose penalties. The Digital Personal Data Protection Rules, 2025 fill in the detail and bring the obligations into force in stages.

Agreya Legal helps businesses work out what the law requires of them, put it into their contracts and processes, and respond when something goes wrong.

Typical work

• Mapping what personal data a business holds and why
• Privacy notices and consent requests
• Contracts with data processors and other vendors
• Requests from individuals to see, correct or erase their data
• Children’s data and verifiable parental consent
• Transfers of personal data outside India
• Breach response and notification
• Internal policies, training material and audits

Who this is for

Businesses that hold customer, employee or user data, including technology, financial, healthcare, education and e-commerce businesses, and the vendors that process data for them.