By Probir Roy Chowdhury, Partner and Raj Ramachandran, Partner at JSA Advocates & Solicitors
India’s data protection journey has come full circle. What began as a constitutional conversation on privacy almost a decade ago, in the Supreme Court’s landmark Justice K. S. Puttaswamy v. Union of India judgment in 2017, is now evolving into a comprehensive regulatory framework governing how personal data is collected, processed, stored and protected.
The Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules, 2025, marks a defining moment in India’s digital governance landscape. With implementation timelines extending through May 2027, organisations are moving from a phase of policy anticipation to one of operational readiness.
This new era of data protection is not merely about regulatory compliance. It is about embedding consent management, retention controls, breach response mechanisms and privacy-by-design principles into the core of organisational decision-making. In doing so, data protection transcends compliance to become a strategic business imperative – one that shapes trust, accountability, innovation and digital resilience.
Rebalancing trust in the digital economy
A defining feature of India’s data protection framework is its attempt to place individuals at the centre of the digital ecosystem. The DPDP Act moves beyond a compliance-driven model by creating a rights-based framework that gives citizens greater visibility and control over how their personal data is collected, processed and retained. Rights such as the ability to provide or withdraw consent, understanding the purposes for which data is being processed and seeking erasure of personal information reflect a broader shift towards individual autonomy and transparency in the digital age.
The enforcement architecture reinforces this shift. Penalties of up to Rs 250 crore for failure to implement reasonable security safeguards, and up to Rs 200 crore for certain breach notification failures and violations relating to children’s data, underscore the scale of regulatory expectations.
For businesses, this represents far more than a new set of regulatory obligations or a peripheral legal concern. Data protection is increasingly becoming a boardroom priority that intersects with enterprise risk management, corporate reputation, customer trust and long-term digital resilience.
The architecture of trust
A useful illustration lies in India’s rapidly expanding digital public infrastructure. Platforms such as the DigiLocker demonstrate how identity-linked services, authentication systems, digital records and public service delivery are becoming increasingly interconnected. With more than 67 crore users and over 950 crore documents issued by March 2026, DigiLocker reflects the scale at which digital trust now underpins everyday governance and economic participation.
From identity credentials and driving licences to educational certificates and insurance documents, every authentication request, digital transaction and document exchange depends on citizens’ confidence that their personal information will be handled securely, responsibly and lawfully.
Trusted digital ecosystems are therefore not merely technology platforms; they are institutional trust frameworks that enable citizens, businesses and governments to interact with confidence.
Data protection as a strategic enabler of deep-tech growth
India’s digital transformation is increasingly extending beyond consumer technology into deep-tech domains such as AI, semiconductors, advanced computing, data infrastructure, industrial automation and defence technologies. As these sectors become central to India’s economic and strategic ambitions, trust, security and resilience will emerge as critical determinants of long-term competitiveness.
At the same time, India is increasingly emerging as a high-value cyber target. The very factors driving the country’s digital and technological rise are also expanding its cyber risk exposure. Large-scale Digital Public Infrastructure (DPI) platforms have created high-value targets where a single compromise could potentially have population-scale consequences.
Growing dependence on complex ecosystems of global and domestic technology vendors has widened the attack surface through supply-chain interdependencies, making indirect attacks more likely. The rapid proliferation of APIs, automation platforms, cloud-native architectures and AI agents is also creating new pathways for persistent and difficult-to-detect intrusions.
India’s expanding role in global supply chains, strategic partnerships and geopolitical alignments further elevates its cyber risk profile. Simultaneously, the digitisation of critical infrastructure through initiatives such as Smart Cities, Industry 4.0 and advanced manufacturing is increasing exposure to cyber-physical threats affecting operational technology environments.
Regulatory expectations are also evolving. The DPDP framework, CERT-In directions and sector-specific requirements increasingly demand demonstrable cyber resilience, making cyber incidents not only a security concern but also a governance and compliance risk.
These challenges are compounded by persistent cybersecurity skills shortages that can affect incident response readiness. Against this backdrop, the growing prevalence of ransomware and financially motivated attacks is particularly significant. India was ranked among the ten most targeted countries globally for cyberattacks in 2025, underscoring the urgency of strengthening both data protection and cyber resilience capabilities.
Viewed through this lens, data protection is no longer solely about safeguarding personal information. It is increasingly becoming a strategic capability that supports national competitiveness, operational resilience and the trusted adoption of emerging technologies.
Next phase of digital growth
Globally, regulators are paying increasing attention to the intersection of data protection and AI. Authorities across jurisdictions including the United Kingdom, France, Germany, the Netherlands and Singapore have issued guidance clarifying how existing privacy and data protection principles apply to the development, training and deployment of AI systems. The emerging consensus is clear: innovation and accountability must evolve together.
India is moving in a similar direction. The IndiaAI Mission identifies ‘Trustworthy and Responsible AI’ as a core pillar of the country’s AI ecosystem. As AI systems are increasingly deployed across critical sectors, ensuring their security, reliability and integrity becomes indispensable.
Risks can arise across the entire AI lifecycle – from data collection, storage and transfer to model training, deployment and ongoing monitoring. Weak governance at any stage can result in unauthorised access to sensitive information, operational disruption, compromised decision-making or erosion of public trust.
In this environment, data protection becomes a foundational enabler of trustworthy AI and responsible innovation. As India accelerates its deep-tech ambitions, trust must be engineered into the digital ecosystem from the outset.
Trust as the Foundation of Viksit Bharat
As AI becomes embedded across public and private digital ecosystems, preserving trust will be one of the defining governance challenges of our time. Privacy-by-design must therefore be viewed as a governance imperative – one that shapes institutional accountability, public confidence and the future of responsible innovation.
Privacy risks arise not only from data breaches but also from excessive collection, opaque retention practices, unnecessary access, weak auditability and poorly governed data-sharing arrangements.
Addressing these risks requires organisations to embed privacy, security and accountability into the design of digital systems from the outset.
The journey towards Viksit Bharat will ultimately be shaped not only by the pace of technological innovation but also by the strength of the governance frameworks that underpin it. In this context, data protection should be viewed not merely as a regulatory obligation, but as a strategic capability that enables trusted innovation, responsible deployment of emerging technologies and sustainable digital growth.