DATA PROTECTION IN INDIA: CHALLENGES UNDER THE IT ACT AND THE PENDING DIGITAL PERSONAL DATA PROTECTION BILL

This blog examines India’s transition from a fragmented, security focused data regime under the Information Technology Act to a rights based framework proposed by the Digital Personal Data Protection Act. It outlines the IT Act’s key gaps—legal uncertainty, weak individual remedies, fragmented enforcement, and operational burdens then summarises the new law’s promises (enumerated data subject rights, fiduciary duties, governance requirements) and the unresolved issues (broad state exemptions, regulator design, sensitive data safeguards, and cross border transfer rules). Practical priorities for organisations data flow mapping, strengthened governance, contract updates, and regulatory preparedness are recommended to navigate the evolving landscape.