Today's Headlines

1. Most India GCCs still in early stages of DPDP compliance despite ticking 14-month deadline: Experts

Source: The Economic Times | Read Original →

Despite the DPDP Act having effectively been in force for 14 months, a significant number of India Global Capability Centres (GCCs) are reportedly still in the nascent stages of compliance. Experts warn that this lag, particularly concerning Section 8 — Data Fiduciary obligations, poses a considerable risk as the enforcement landscape is expected to harden. Businesses, irrespective of size, must prioritize a comprehensive review of their data processing frameworks.

2. SC issues notice to MeitY on PILs challenging DPDP Act

Source: Mint | Read Original →

The Supreme Court has sought a response from the Ministry of Electronics and Information Technology (MeitY) regarding Public Interest Litigations (PILs) challenging various aspects of the DPDP Act. This development introduces an element of legal uncertainty, with the potential for judicial review impacting how businesses interpret and implement their compliance strategies, particularly concerning the constitutional validity of certain provisions.

3. RTI Under Threat as Data Protection Law Removes Key Public Interest Safeguard

Source: Countercurrents | Read Original →

Concerns are mounting that the DPDP Act could weaken the Right to Information (RTI) Act by removing crucial public interest safeguards, potentially limiting access to information that involves personal data. This presents a complex challenge for data fiduciaries, as they navigate the balance between data privacy under the DPDP Act (especially concerning Section 17 — Exemptions) and the public's right to information. Businesses dealing with public data or subject to RTI requests must carefully assess their disclosure policies.

4. Instagram is dropping end-to-end encryption soon: Here are 5 secure messaging apps you can use instead

Source: Livemint Tech | Read Original → Meta has announced that Instagram will discontinue end-to-end encryption (E2EE) on May 8, 2026, advising users to download their data and consider alternative secure messaging platforms. For Indian businesses relying on Instagram for customer engagement or data collection, this change necessitates an immediate review of their data handling practices and communication channels to ensure continued adherence to Section 9 — Security Safeguards of the DPDP Act, as the removal of E2EE increases their responsibility for securing personal data.

---

DPDP Impact Analysis

Today's news highlights a multi-faceted challenge for Indian businesses grappling with the Digital Personal Data Protection Act 2023. On one hand, we see a concerning trend of compliance lag, even among large entities like India GCCs. This indicates that many organizations are underestimating the complexity and scope of the Act, despite the significant time that has passed since its notification. Businesses must recognize that the "grace period" is effectively over, and proactive implementation of robust data governance frameworks, aligning with Section 8 — Data Fiduciary obligations, is non-negotiable to mitigate future penalties.

Compounding this operational challenge is the legal uncertainty introduced by the Supreme Court's decision to issue notices on PILs challenging the DPDP Act. While the outcome of these challenges is yet to be determined, they signal potential shifts in the Act's interpretation or even its specific provisions. Businesses, particularly those that have invested heavily in compliance, must stay agile and closely monitor these legal developments to adapt their strategies as needed. This situation underscores the dynamic nature of data protection law and the need for flexible compliance frameworks.

Furthermore, the perceived conflict between the DPDP Act and the RTI Act adds another layer of complexity, particularly for entities (both public and private) that handle information subject to public disclosure. Balancing the right to privacy with the public interest in transparency is a critical tightrope walk. Data Fiduciaries must meticulously define their data retention, access, and disclosure policies, ensuring they are compliant with both statutes, especially where Section 17 (Exemptions) of the DPDP Act might be invoked.

Finally, platform-level shifts, such as Instagram's decision to drop end-to-end encryption, reinforce the message that data protection is not solely an internal matter. Businesses are increasingly reliant on third-party platforms for operations and customer engagement. Each change in a platform's security posture directly impacts the Data Fiduciary's responsibility under Section 9 — Security Safeguards. This necessitates continuous vendor due diligence and a proactive approach to understanding and mitigating risks across their entire data ecosystem, ensuring data minimisation and purpose limitation even on external services. The collective message is clear: vigilance, adaptability, and comprehensive understanding of the DPDP Act are paramount for survival and growth in India's evolving data economy.

---

Stay Compliant

Not sure if your business meets DPDP standards? Start with a free check:

🔍 Run Your Free DPDP Audit →

16 questions. 60 seconds. Instant risk report.

---

Published by DPDP News, a Meridian Bridge Strategy initiative. For compliance consulting, book a free call.