Data protection law (DPDP Act, GDPR)

Data protection law is the set of rules that says what a company may do with people's personal data, and what it owes those people. In India, the main law is the Digital Personal Data Protection Act, 2023, usually called the DPDP Act. In Europe, it is the General Data Protection Regulation (GDPR), which has applied since May 2018. Laws like these make protecting personal data a legal duty, with large penalties. Before them, a company had only limited legal duties. In India, for example, the Information Technology Act's rules covered mainly sensitive data, such as passwords, bank details and medical records. India notified the DPDP Rules in November 2025, and most of the Act's duties apply from 13 May 2027.

Here is how it works in general. Under the DPDP Act, the person whose data it is is called the data principal. The company that decides why and how the data is used is called the data fiduciary. The company must give the person a clear notice of what data it collects and for what purpose. It must get the person's consent, unless the use is one of the few the law allows without consent. It may use the data only for that purpose, and must delete it when the purpose is over. The person can ask to see the data, correct it or have it erased, and can withdraw consent at any time. If the data leaks, the company must report the breach to the Data Protection Board of India and to the affected people. The Board can fine a company up to ₹250 crore for failing to protect data. Under the GDPR, fines can reach €20 million or 4 per cent of a company's worldwide yearly turnover, whichever is higher. An Indian company that sells goods or services to people in Europe, or tracks what they do online, must follow the GDPR too.

So companies now need tools to obey these laws. Privacy management software records each consent and handles each request to see or delete data. Data security posture management finds where personal data is kept, which a company must know before it can delete it.

Take, for example, a shopping app that wants to send offers on WhatsApp. It must ask the customer for that purpose, and stop sending offers when the customer withdraws consent.

Consider a hospital that wants to share patient records with researchers. It can share de-identified data, with names and other identifying details removed.

Imagine a housing society's visitor management system, which records the name and phone number of every visitor and domestic worker. These are personal data too, and the society should keep them only as long as it needs them.

How is data protection law different from data security? Data security protects data from attackers. Data protection law decides what the company itself may do with the data, even when no attacker is involved. A company can keep data perfectly safe and still break the law, for example by using it for a purpose the person never agreed to.