A. Ahmed

The phased implementation of the Digital Personal Data Protection Act, 2023, marks an important shift in India’s digital governance framework. But recent data breaches involving public sector banks have exposed the vulnerabilities that remain. With fresh provisions taking effect, organisations must move beyond regulatory formalities and build a culture of data security, transparency and accountability.

India’s rapid digital transformation has brought convenience, efficiency and new economic opportunities, but it has also created unprecedented challenges in protecting personal information. From banking and healthcare to e-commerce, telecommunications and government services, millions of citizens share sensitive information through digital platforms every day. Names, telephone numbers, residential addresses, identity details, financial records and health information have become part of an expanding digital ecosystem. The question is no longer whether personal data is being collected, but whether it is being adequately protected and responsibly used.

Recent data breaches involving two major public sector banks have brought this concern into sharp focus. Incidents reported at the State Bank of India in October 2026 and Bank of Baroda in July 2026, involving allegations that customer information had been exposed and offered for sale on the dark web, have raised serious questions about the security of financial data. Such incidents are particularly concerning because banking information is closely connected to an individual’s financial identity and economic security.

Against this backdrop, the phased implementation of India’s Digital Personal Data Protection Act, 2023 (DPDP Act), assumes considerable significance. The legislation seeks to establish a framework that balances the legitimate needs of organisations to process personal information with the fundamental interest of individuals in protecting their privacy. However, the effectiveness of the law will ultimately depend not merely on its provisions but on how seriously businesses, government departments and digital platforms implement them.

A new framework for personal data protection

The DPDP Act establishes rules governing the processing of digital personal data. Its central principle is that organisations must collect and use personal information for lawful and clearly defined purposes. Such processing must generally be based on the individual’s consent or fall within the categories of legally recognised legitimate uses under the Act.

The legislation introduces specific responsibilities for different participants in the data ecosystem. An individual whose personal information is being processed is identified as the ‘Data Principal’. The organisation that determines the purpose and means of processing is known as the ‘Data Fiduciary’, while an entity processing information on behalf of the Data Fiduciary is referred to as the ‘Data Processor’.

This distinction is important because responsibility for protecting personal information cannot simply be transferred to an outside service provider. Organisations engaging third-party vendors, cloud platforms or technology companies must ensure that appropriate safeguards are maintained throughout the data-processing chain.

The Act also recognises several rights of individuals. These include the right to obtain information about personal data being processed, seek correction and erasure, access grievance redressal mechanisms and nominate another individual to exercise their rights in specified circumstances.

These provisions are intended to give citizens greater control over their digital identities. However, the exercise of these rights will depend on whether organisations establish accessible, responsive and effective systems to deal with individual requests.

The law also places responsibilities on Data Principals, including the obligation not to impersonate another person, suppress material information while providing personal data and file false or frivolous complaints. Violations of specified duties can attract penalties of up to Rs 10,000.

Data breaches and the cost of non-compliance

The most significant aspect of the legislation is the responsibility it places on organisations handling personal information. Data Fiduciaries must adopt appropriate technical and organisational measures to prevent unauthorised access, disclosure, alteration or loss of data.

They are also required to provide individuals with clear information about the purpose of data collection, obtain valid consent wherever necessary and ensure that personal information is not used beyond the stated purpose or legally permitted grounds.

In the event of a data breach, organisations must comply with the prescribed notification requirements and inform the Data Protection Board of India and affected individuals in accordance with the law.

The financial consequences of non-compliance can be substantial. Failure to implement reasonable security safeguards to prevent personal data breaches can attract penalties of up to Rs 250 crore under the Act. This provision reflects the seriousness with which the law treats data security.

Yet financial penalties alone cannot guarantee protection. Organisations must recognise that a data breach can damage public confidence, expose customers to financial fraud and create long-term reputational consequences. In sectors such as banking, insurance and healthcare, the consequences can extend far beyond regulatory liability.

The reported breaches involving major public sector banks underline the need for stronger internal security systems, continuous monitoring, timely vulnerability assessments and effective incident-response mechanisms. Data protection must become an integral part of institutional risk management rather than a responsibility addressed only after an incident occurs.

Understanding the three-phase implementation

The Government notified the Digital Personal Data Protection Rules, 2025, in November 2025, providing for an 18-month phased implementation of the regulatory framework. The staggered approach was intended to give organisations time to establish the systems and processes required for compliance.

The first phase, which began on November 13, 2025, brought certain preliminary provisions into effect, including the institutional framework and basic arrangements relating to the Data Protection Board.

The second phase, effective November 13, 2026, introduces provisions concerning the registration and obligations of Consent Managers. These entities are intended to provide individuals with a platform through which they can give, review, manage and withdraw consent for the processing of their personal information.

To qualify for registration, an applicant must be a company incorporated in India, demonstrate sufficient operational capacity and meet the prescribed financial requirements, including a net worth exceeding Rs 2 crore. Its proposed operations must also be consistent with the interests of Data Principals.

The introduction of Consent Managers could create a new segment within India’s digital services industry. By enabling individuals to manage consent through structured systems, these entities may help make data protection rights more accessible and practical.

The third and final phase is scheduled to take effect on May 13, 2027. It will bring most of the substantive compliance obligations into operation, including requirements relating to notices, consent, security safeguards, individual rights, grievance redressal and additional responsibilities for specified categories of Data Fiduciaries.

However, organisations should not interpret May 2027 as the point at which preparations can begin. The scale of operational changes required makes early planning essential.

Why organisations must start preparing now

The first step towards compliance is understanding what personal information an organisation possesses, where it is stored, how it is used and with whom it is shared.

Many businesses collect personal information through multiple channels, including websites, mobile applications, customer databases, employee records, vendor agreements and cloud-based services. In several cases, organisations may not have a comprehensive picture of the volume of information they hold or the number of external entities with access to it.

A detailed data inventory and data-flow mapping exercise is therefore essential. Organisations must identify the categories of personal information collected, the purpose of collection, the systems in which it is stored, the individuals and departments accessing it, and the third-party service providers involved in processing it.

The next requirement is transparency. Individuals must receive clear and understandable notices explaining what personal information is being collected and why it is required. Consent should not be buried in lengthy, complicated or ambiguous terms and conditions. Nor should organisations collect more information than is reasonably necessary for the specified purpose.

The principle of data minimisation is particularly important. Every additional piece of personal information collected increases the potential exposure in the event of a security incident. Organisations must therefore reconsider routine practices that encourage excessive collection or indefinite retention of customer information.

Data retention policies also require careful review. Personal information should not be retained indefinitely simply because storage capacity is available. Once the purpose for which data was collected has been fulfilled, organisations must ensure its erasure in accordance with the applicable legal requirements and prescribed exceptions. Where data is processed through an external Data Processor, the organisation must also ensure that deletion requirements are properly communicated and implemented.

Third-party vendors and employee accountability

One of the most overlooked areas of data protection is the involvement of third-party service providers. Businesses increasingly depend on external technology companies for cloud storage, customer support, payroll management, digital payments and data analytics.

Such arrangements can create vulnerabilities if contractual responsibilities and security standards are not clearly established.

Data Fiduciaries must ensure that their agreements with Data Processors contain appropriate safeguards and clearly define responsibilities relating to data security, access, retention, deletion and breach reporting. Compliance obligations must extend across the entire service chain.

Employee awareness is equally important. Even sophisticated technological safeguards can be undermined by weak passwords, phishing attacks, unauthorised data sharing or careless handling of sensitive information.

Regular training, access controls, internal audits and clearly defined incident-reporting procedures should therefore become standard organisational practices. Employees must understand that protecting personal information is not solely the responsibility of the information technology department. It is an institutional obligation.

Organisations must also establish effective mechanisms through which individuals can request access to their information, seek corrections or erasure, withdraw consent where applicable and raise complaints. Such requests should be recorded, tracked and addressed within the prescribed timelines.

From regulatory compliance to a culture of trust

India’s data protection framework represents an important development in the country’s digital governance journey. But legislation can achieve its intended purpose only when its principles are reflected in everyday institutional practices.

The challenge is particularly significant for smaller businesses and start-ups that may lack the financial resources and specialised expertise available to large corporations. They will need accessible compliance guidance, affordable security solutions and professional support to adapt to the new requirements.

Government departments and public sector institutions must also maintain high standards. Citizens routinely share sensitive personal information with government agencies while accessing welfare benefits, identity services and other public facilities. The responsibility to protect such information must be matched by effective safeguards and accountability.

The reported banking breaches serve as a reminder that data security cannot be treated as a secondary administrative concern. A single incident can expose thousands of individuals to fraud, identity theft and financial loss. Restoring confidence after such incidents can be considerably more difficult than preventing them in the first place.

Ultimately, the success of the DPDP Act will depend on whether it changes how organisations collect, process, store and protect personal information. Consent mechanisms, contractual safeguards and regulatory penalties are important, but they must be supported by strong technology, trained personnel and a genuine commitment to accountability.

India’s digital economy cannot grow sustainably without public trust. The real measure of data protection reform will not be the number of organisations that complete compliance documentation, but the extent to which ordinary citizens gain meaningful control over their personal information and confidence that it will not be misused.