India’s New Privacy Regime: What it means for Global Business and Data Governance
India’s approach to personal data protection has undergone a decisive shift. The Digital Personal Data Protection Act, 2023, read with accompanying Rules, 2025 (collectively, the “DPDPA”), is currently being implemented in India in a phased manner. Once operational (by May 2027) it will apply to all businesses processing personal data in connection with any goods or service offerings in India – including offshore entities.
While India’s DPDPA draws inspiration from the EU GDPR, businesses should note that it introduces terminology, rights and roles unique to its framework. The DPDPA operates on a binary consent regime – where personal data may only be processed with the individual’s explicit consent or for specified “certain legitimate uses.” Data Fiduciaries (entities determining means and purposes of processing personal data) are required to discharge comprehensive obligations under the DPDPA, with non-compliance entailing significant penalties (to the tune of $25 million).
For Fiduciaries, formal Data Processing Agreements comprise a statutory requirement as well as a practical necessity – since they bear non-delegable statutory liability for the Data Processors they engage.
The DPDPA’s implementation will place India alongside a growing number of APAC jurisdictions that provide for extraterritorial application of data protection laws. For multinationals operating in India, the regulatory divergence between India and other data protection regimes, including in the EU or APAC, may present immediate and material compliance challenges.
Key Compliance Considerations
Given the extensive compliance requirements under the DPDPA and its structural divergences with other data protection frameworks, multinational businesses operating in India should engage qualified counsel at the earliest to determine their specific roles and cross-border obligations under the DPDPA. Carefully structured and interoperable Data Processing Agreements, in particular, may serve as a practical compliance pathway for businesses navigating obligations across multiple jurisdictions.
Our lawyers advise clients on DPDPA compliance, cross-border data transfer arrangements, and DPA structuring. If your organization is seeking clarity on its obligations under India’s evolving data protection regime, please contact our member firm identified below.
For more information, contact:

Ashneet Hanspal, Senior Associate
ashneet.hanspal@ahlawatassociates.in








