Data protection
The Digital Personal Data Protection Act 2023 was activated by the notification of the DPDP Rules on 14 November 2025. Implementation is phased: procedural provisions immediately, consent manager rules from November 2026, and the substantive compliance obligations from May 2027. The Act creates a Data Protection Board with power to impose penalties up to 250 crore rupees.
Key points
| Rights | Access, correction, erasure, grievance redress and nomination of a representative |
|---|---|
| Consent | Must be free, specific, informed and unambiguous, with clear notice |
| Consent managers | A distinctive Indian mechanism, registered with the Board |
| Children | Verifiable parental consent required under 18, with tracking and targeted advertising prohibited |
| Penalties | Up to 250 crore rupees per breach |
| Exemptions | Broad exemptions for government processing, the main criticism of the Act |
| Timeline | Substantive obligations from May 2027 |
| Penalties to the state | The Act provides penalties but no compensation to individuals |
| Duties of data principals | Individuals themselves have statutory duties, including not filing false complaints |
In practice
- Use the grievance officer route first: the Act requires it before approaching the Board.
- For a personal remedy, consider a writ petition or a consumer complaint instead.
Cost and coverage
Free; complaints go to the Data Protection Board after exhausting the company's grievance process.
Recent changes
Because obligations are phased to 2027, many companies are not yet subject to the substantive duties — check which phase applies before complaining.
Where to go
- Data Protection Board of India, once operational.
- Grievance officers, whose details every significant service must publish.
- Internet Freedom Foundation for advocacy and guidance.
Worth knowing
The Act requires companies to publish a grievance officer's contact details, and you must use that route first. Screenshot the page: it is often hard to find later. The Act imposes duties on individuals as well as companies, including a penalty for frivolous complaints. That is unusual and worth knowing before filing.
The general article: Data protection · Compare with another country
Privacy
In Justice K.S. Puttaswamy v Union of India the Supreme Court held unanimously in 2017 that privacy is a fundamental right under Article 21 of the Constitution. The Digital Personal Data Protection Act 2023 followed, creating consent obligations, the role of Consent Manager and a Data Protection Board, and it is being operationalised progressively through rules.
Key points
| Constitution | Privacy a fundamental right under Article 21, held in Puttaswamy (2017) |
|---|---|
| Statute | Digital Personal Data Protection Act 2023, brought into force through rules |
| Regulator | Data Protection Board of India |
| IT Act | Section 43A and section 72A remain relevant for older facts |
| Remedy | Writ petition under Article 32 or 226 against the State |
| Penalties | Substantial financial penalties, but no statutory compensation for individuals |
| Proportionality test | Puttaswamy set a four-part test for any state intrusion |
| Aadhaar | The Supreme Court limited its mandatory use to specified purposes |
| Right to be forgotten | Recognised in several High Court decisions, without a statutory basis |
In practice
- Cite the proportionality test where a public body is involved: it is the operative standard.
Where to go
- Data Protection Board of India.
- High Court writ jurisdiction against public bodies.
- District consumer commissions for service failures.
Worth knowing
The 2023 Act deliberately provides penalties payable to the State rather than compensation to the individual: for personal redress you generally still need a writ petition or a consumer complaint. The right to be forgotten has been recognised case by case by High Courts. There is no statutory procedure, so it requires a petition.
Image rights
Criminal provisions on voyeurism and obscene transmission, plus IT Rules requiring removal of intimate imagery within 24 hours.
Section 66E of the IT Act criminalises capturing or publishing images of a private area without consent, and sections 67 and 67A cover obscene and sexually explicit transmission. The Information Technology Rules of 2021 require intermediaries to remove content showing an individual in a state of nudity or a sexual act, including impersonation and morphed images, within 24 hours of a complaint.
Key points
| IT Act | Section 66E: violation of privacy by capturing or publishing private images |
|---|---|
| Criminal law | Voyeurism and stalking offences under the penal code |
| IT Rules 2021 | 24-hour removal duty for intimate or morphed images |
| Grievance officer | Every platform must publish one, with defined response times |
| Reporting | National cybercrime portal, with an anonymous option for women and children |
| Deepfakes | Covered through impersonation and morphed-image provisions of the Rules |
| Grievance appellate committee | Can override a platform's refusal to remove |
| Proactive duty | Platforms must use measures to prevent re-upload of removed intimate content |
| Anonymous reporting | Available for women and children on the national portal |
In practice
- Escalate to the grievance appellate committee if the platform refuses: it is free.
Where to go
- cybercrime.gov.in, with a dedicated women and children reporting channel.
- Helpline 1930 for cyber financial and related crime.
- Local cyber police station.
Worth knowing
The 24-hour rule is enforceable against the platform even before any police action: quote it explicitly in your complaint to the grievance officer. The obligation to prevent re-upload is explicit in the rules. Cite it when content reappears after removal.
The general article: Image rights · Compare with another country
Speech and online harassment
Criminal defamation survives alongside civil claims, and platform rules impose fast takedown timelines.
The Supreme Court struck down section 66A of the IT Act in Shreya Singhal (2015) as unconstitutionally vague — a landmark for online speech. Criminal defamation, however, was upheld. The Information Technology Rules 2021 require significant platforms to remove flagged unlawful content within set timeframes and to appoint grievance officers, with parts of the framework under constitutional challenge.
Key points
| Criminal defamation | Retained; a complaint can lead to summons and trial |
|---|---|
| Civil defamation | Available, with damages |
| Section 66A | Struck down in 2015, though reports of continued police use persisted for years |
| IT Rules 2021 | Grievance officers, 36-hour removal for court or government orders, 24 hours for intimate images |
| Intimate images | Rules require removal within 24 hours of a complaint |
| Grievance Appellate Committees | Established in 2023 to review platform moderation decisions |
| Risk areas | Speech touching religion, national security or the courts carries real legal exposure |
| Criminal and civil | Defamation is both a crime and a tort, which is unusual |
| Section 69A | Government blocking powers, used for online content |
| Court orders | Geo-blocking and global takedown orders have both been made |
In practice
- Complain to the platform's grievance officer: the rules set deadlines for acknowledgement and action.
- Escalate to the grievance appellate committee if the platform refuses.
Cost and coverage
Police complaints are free; defending a criminal defamation complaint is costly and slow.
Recent changes
Grievance Appellate Committees give users a route to challenge a platform's refusal to remove content, or its decision to remove yours.
Where to go
- National Cyber Crime Reporting Portal and helpline 1930.
- Platform grievance officers, whose details must be published.
- Internet Freedom Foundation for guidance on rights.
Worth knowing
The 24-hour removal rule for intimate images is enforceable: cite it explicitly when complaining to a platform's grievance officer, and escalate to the Grievance Appellate Committee if ignored. The grievance appellate committee created by the 2021 rules can override a platform's decision. It is free and is the fastest route to removal.
The general article: Speech and online harassment · Compare with another country
Copyright
Life plus sixty years, a fair dealing clause with a long list of permitted acts, and statutory licences for broadcasting and cover versions.
The Copyright Act 1957, substantially amended in 2012, protects literary, dramatic, musical and artistic works for the author's life plus sixty years. Section 52 lists a long series of acts that do not infringe, including fair dealing for private or personal use, criticism and review, and reporting current events. The 2012 amendment strengthened authors' and performers' royalty rights, particularly in film music.
Key points
| Statute | Copyright Act 1957, amended in 2012 |
|---|---|
| Term | Life plus 60 years |
| Section 52 | Long list of non-infringing acts, including fair dealing for private use |
| Royalty rights | Authors and composers retain an unwaivable share of royalties since 2012 |
| Statutory licences | For broadcasting and for cover versions |
| Registration | Optional, but a registration certificate is useful evidence |
| Statutory licence for cover versions | Available after a waiting period, on prescribed terms |
| Registration evidence | Optional but strongly relied on by courts and police |
| Copyright Board | Functions transferred to the commercial courts and tribunal |
In practice
- Register significant works: police and courts give registered works far more weight.
Recent changes
The 2012 amendment rebalanced film music contracts in favour of authors and performers, and remains the reference point for royalty disputes.
Where to go
- Copyright Office, Department for Promotion of Industry and Internal Trade.
- IPRS, PPL and other societies.
- Commercial courts for infringement suits.
Worth knowing
The 2012 reform gave lyricists and composers a share of royalties that cannot be signed away — a provision with no equivalent in most other countries. The 2012 amendment gave authors and composers an unwaivable royalty share. Contracts purporting to remove it are ineffective.
The general article: Copyright · Compare with another country
Identity theft
Sections 66C and 66D of the IT Act, a national reporting portal, and a 1930 helpline with a golden hour for freezing transfers.
Section 66C of the IT Act punishes the fraudulent use of another person's electronic signature, password or unique identification feature; section 66D covers cheating by personation using a computer resource. Reports are made on the national cybercrime portal or by calling 1930, and rapid reporting can allow the transferred funds to be frozen before they are withdrawn.
Key points
| Statute | IT Act sections 66C and 66D, plus penal code cheating and forgery provisions |
|---|---|
| Helpline | 1930, the national cyber financial fraud helpline |
| Portal | cybercrime.gov.in for written complaints |
| Golden hour | Reporting within the first hour greatly improves the chance of freezing funds |
| Aadhaar | Biometrics can be locked and a virtual ID used instead of the number |
| Credit | Free annual credit report from each of the four credit bureaus |
| Aadhaar lock | Biometrics can be locked and unlocked on demand |
| Virtual ID | Use it instead of the Aadhaar number for verification |
| Limited liability | Reserve Bank rules cap customer liability where the report is prompt |
In practice
- Call 1930 immediately: speed determines whether the money can be stopped.
- Lock your Aadhaar biometrics and use a virtual ID for verification.
- File the complaint on the portal and get the acknowledgement number.
- Obtain your credit reports and dispute loans you did not take.
- Lock your Aadhaar biometrics: it takes minutes and prevents most misuse.
Where to go
- National cybercrime reporting portal, cybercrime.gov.in.
- Helpline 1930.
- Banking Ombudsman under the RBI integrated scheme.
Worth knowing
Reserve Bank rules limit customer liability for unauthorised electronic transactions where the customer reports promptly: the delay in reporting is what determines how much you bear. Reserve Bank rules make liability depend on how quickly you report. Reporting within three days can reduce your liability to nothing.
The general article: Identity theft · Compare with another country
Online shopping
No general cooling-off period, but the Consumer Protection Act 2019 and e-commerce rules impose strong duties on platforms.
The Consumer Protection Act 2019 created the Central Consumer Protection Authority and a three-tier commission system. The Consumer Protection (E-Commerce) Rules 2020 require platforms to display return, refund, warranty and seller details, appoint a grievance officer, and respond to complaints within fixed timeframes. Misleading advertisements and dark patterns have been the subject of specific guidelines.
Key points
| Cooling-off | No statutory right; platform policies govern returns |
|---|---|
| Mandatory disclosure | Seller identity, return policy, warranty and grievance officer details |
| Grievance officer | Must acknowledge complaints within 48 hours and resolve within a month |
| Product liability | Introduced by the 2019 Act, covering manufacturers, sellers and service providers |
| E-filing | Consumer complaints can be filed online through the national portal |
| Dark patterns | Guidelines prohibit specified manipulative interface practices |
| Mediation | Consumer commissions can refer disputes to mediation |
| Consumer Protection Act 2019 | Created a central regulator and e-commerce rules |
| E-commerce rules | Require platforms to display seller details and a grievance officer |
| Online filing | Complaints can be filed electronically at the consumer commissions |
In practice
- Complain to the platform's grievance officer first: the rules require a defined response time.
- File online with the district consumer commission if that fails; fees are modest.
Cost and coverage
Filing fees at consumer commissions are low and scaled to the claim value.
Recent changes
Guidelines against dark patterns and against surrogate advertising have made India one of the more assertive jurisdictions on manipulative online design.
Where to go
- National Consumer Helpline 1915 and the e-daakhil online filing portal.
- District, state and national consumer commissions.
- Central Consumer Protection Authority for systemic complaints.
Worth knowing
The National Consumer Helpline resolves a large share of complaints through convergence partners before any formal case — usually the fastest first step. The 2019 Act made e-commerce platforms directly accountable and created a product liability regime. Older guidance describing only the seller's liability is out of date.
The general article: Online shopping · Compare with another country
Romance scams
A national helpline with a genuine golden hour: report within minutes and the transfer can be frozen.
The national cybercrime reporting portal and its dedicated helpline allow a fraudulent transaction to be reported immediately. Where the report is made quickly, a citizen financial cyber fraud reporting system alerts the receiving bank and can freeze the funds before they are withdrawn. This is the single most effective mechanism available anywhere in the region, and it depends entirely on speed. A police report follows.
Key points
| Helpline | National cybercrime financial fraud helpline, 1930 |
|---|---|
| Portal | National cybercrime reporting portal, cybercrime.gov.in |
| Golden hour | Reporting within minutes allows the receiving bank to freeze the funds |
| Police report | To be filed separately at the cyber cell or local station |
| Banking ombudsman | Free scheme run by the central bank, for unresolved complaints |
| Unauthorised transactions | Limited customer liability if reported within three days |
| Cryptocurrency | Effectively unrecoverable |
In practice
- Call 1930 before doing anything else — including before calling your bank. Minutes decide the outcome.
- Report an unauthorised transaction within three days: liability rules are far more favourable inside that window.
- File the online complaint as well: it generates an acknowledgement number needed later.
- If the bank does not resolve within thirty days, escalate free of charge to the banking ombudsman.
Cost and coverage
The helpline, the portal and the ombudsman are all free.
Recent changes
The financial fraud reporting system, which freezes funds at the receiving bank, has recovered substantial sums where victims called within the first hour.
Where to go
- National cybercrime helpline 1930.
- National cybercrime reporting portal.
- Banking ombudsman scheme of the central bank.
Worth knowing
The three-day rule for unauthorised transactions is decisive and widely unknown: report within three working days and customer liability is limited by regulation, report later and it rises sharply.
Sources
- National Cyber Crime Reporting Portal — file online; call 1930 within minutes to freeze the transfer
- Reserve Bank of India — complaints — banking ombudsman scheme, free
The general article: Romance scams · Compare with another country
General sources
- India.gov.in — national portal of India
- India Code — central and state legislation