BENGALURU & NEW DELHI — India’s digital privacy architecture has entered full statutory enforcement as the Ministry of Electronics and Information Technology (MeitY) operationalises the administrative rules under the Digital Personal Data Protection (DPDP) Act. From fintech lenders and e-commerce marketplaces to hospitals and generative AI laboratories, enterprises handling the personal data of Indian citizens now face binding compliance deadlines overseen by the newly constituted Data Protection Board of India (DPBI).
Verifiable Consent in 22 Eighth-Schedule Languages
Under the operational rules, every Data Fiduciary must present a standalone, plain-language privacy notice itemising the exact categories of personal data collected and the specific purpose of processing. Crucially, users must be offered the ability to read this notice in English as well as all 22 languages listed in the Eighth Schedule of the Indian Constitution, supported by India’s Bhashini translation APIs.
Algorithmic Audits for Significant Data Fiduciaries
Organisations designated as Significant Data Fiduciaries (SDFs)—determined by user volume, sensitivity of financial or health data processed, and national security impact—are required to conduct independent annual Data Protection Impact Assessments (DPIAs) and certify that their automated recommendation and credit-scoring algorithms do not infringe on constitutional rights.
Explore more coverage on cybersecurity, semiconductors, and AI regulation in our Technology & Policy Section.
