India’s new Digital Personal Data Protection framework, comprising the DPDP Act 2023 and Rules 2025, mandates organisations to build robust, India-specific privacy compliance systems before full enforcement in May 2027. Key requirements include gap assessments, consent redesign, breach reporting, data retention alignment, and governance structures led by senior management. Challenges such as conflicting retention norms, algorithmic accountability, and data localisation remain. Organisations must adopt integrated, forward-looking compliance strategies to align domestic and global obligations while strengthening accountability, risk mitigation, and consumer trust.
Please click here to read the full article by Sajai Singh, Partner, Sankalp Inuganti, Associate, and Ayush Sahay, Associate, published in International Bar Association.
Sajai Singh is a Partner at JSA and one of India’s most distinguished technology and corporate lawyers, with over 30 years of experience advising on cross-border transactions, data privacy, cybersecurity, regulatory compliance, employment law, and white-collar investigations. Recognized globally for his leadership in technology law, he advises multinational corporations, investors, and digital businesses on complex legal, regulatory, and commercial matters.