India Passes Data Protection Act with Stringent Consent and Local...

India Data Protection Act 2025 received Presidential assent and came into force, establishing a comprehensive legal framework governing how personal data of Indian citizens is collected, processed, and stored. The Act mandates explicit consent for data collection, grants citizens the right to erasure, portability, and grievance redressal, and requires significant data fiduciaries to appoint a Data Protection Officer. Cross-border data transfers are permitted only to countries cleared by a Data Protection Board, ruling out transfers to nations deemed inadequate in protection standards. Critical personal data — defined as data related to health, finance, biometrics, and children — must be stored exclusively on servers within India. Heavy penalties of up to Rs 250 crore per violation can be levied. Industry groups acknowledged the framework provides long-awaited legal clarity, though several raised concerns about localisation compliance costs.