Does the Act reach an IFSC unit?
Section 3 of the Act applies it to the processing of digital personal data within the territory of India, and to processing outside India where it is connected with offering goods or services to individuals in India. GIFT IFSC is in Gujarat. A unit there that collects or uses personal data in digital form, or digitises it, is within the Act. Nothing in the Act or the Rules treats an IFSC differently.
Two features of the Act matter particularly to IFSC businesses, many of which serve clients outside India:
- Foreign data principals under foreign contracts. Section 17(1)(d) disapplies most of Chapter II, all of Chapter III and section 16 where personal data of individuals not within India is processed under a contract with a person outside India by a person based in India. Section 8(1) (general accountability) and section 8(5) (reasonable security safeguards) still apply. Whether a given client book falls within section 17(1)(d) depends on where the individuals are and how the contracts run, and should be tested line by line.
- Employees and Indian-resident clients. Staff in GIFT City and any resident Indian clients, for example under the Liberalised Remittance Scheme, are data principals in India in the ordinary way.
When each part comes into force
Rule 1 of the Rules sets three commencement points, counted from publication in the Gazette on 13 November 2025:
| Rules | Subject | In force |
|---|---|---|
| 1, 2 and 17 to 21 | Title, definitions, the Data Protection Board and its procedure | 13 November 2025 |
| 4 | Registration and duties of consent managers | One year after publication: 13 November 2026 |
| 3, 5 to 16, 22 and 23 | Notice, security safeguards, breach intimation, retention, contact details, children's data, significant data fiduciaries, data-principal rights, transfers outside India, appeals | Eighteen months after publication: 13 May 2027 |
For most IFSC entities, 13 May 2027 is the date to plan against.
What the substantive duties require
- Notice and consent, or a legitimate use. Personal data may be processed only for a lawful purpose with consent or for a legitimate use under section 7 (section 4). Rule 3 requires a stand-alone notice in clear and plain language, with an itemised description of the data and the specified purpose.
- Security safeguards (Rule 6). At minimum: encryption, masking or tokenisation; access controls; logging and monitoring; backups for continuity; retention of logs and personal data for one year for detection and investigation, unless another law requires otherwise; and security terms in the contract with any data processor.
- Breach intimation (Rule 7). Each affected individual must be told without delay. The Board must be told without delay and then, within 72 hours of becoming aware (or longer if the Board allows on a written request), given a detailed report covering causes, mitigation, findings about the person responsible and the intimations made.
- Retention of processing logs (Rule 8(3)). Personal data, traffic data and processing logs are kept for at least one year from the processing, for the purposes in the Seventh Schedule, and then erased unless another law requires longer.
- Contact point and rights. The contact details of a Data Protection Officer, or a person who can answer questions, must be published (Rule 9). The means of exercising rights must be published, and grievances answered within a period not exceeding 90 days (Rule 14).
- Transfers outside India. The Central Government may restrict transfers to notified countries (section 16(1)), and Rule 15 subjects transfers to any requirements it specifies about making data available to a foreign State. Section 16(2) preserves any other Indian law that imposes a higher degree of protection or restriction on transfers.
- Significant data fiduciaries. If notified under section 10, an entity must appoint a Data Protection Officer based in India and an independent data auditor. Rule 13 adds an annual Data Protection Impact Assessment and audit, due diligence on algorithmic software, and compliance with any localisation of data the Central Government specifies.
Enforcement
The Data Protection Board of India inquires into breaches and may impose penalties under section 33 and the Schedule to the Act, having regard to factors such as gravity, duration, mitigation and proportionality. The Government's published summary gives the maximum amounts: up to Rs 250 crore for failure to maintain reasonable security safeguards; up to Rs 200 crore each for failure to notify a breach and for breach of the obligations relating to children; and up to Rs 50 crore for other breaches. Appeals from the Board lie to the Telecom Disputes Settlement and Appellate Tribunal (Rule 22).
For boards and compliance teams
Notices, consent flows, rights-handling and breach procedures take longer to build than most organisations expect, so work should start well before 13 May 2027. Points specific to IFSC entities:
- Map the data. Separate foreign-client data that may fall within section 17(1)(d) from data of employees and Indian-resident clients, and record the basis for each.
- Join up the incident clocks. A cyber incident may also be a personal data breach. IFSCA expects a report within six hours of detection, CERT-In within six hours of noticing, and the Board without delay with a fuller report within 72 hours. One playbook should drive all three. See cyber security and incident reporting.
- Reconcile retention periods. The one-year minimum in the Rules sits beside longer periods in IFSCA's AML guidelines and other sectoral rules. Keep a single retention schedule. See AML, CFT and KYC.
- Paper the processors. Group service providers, cloud hosts and fund administrators are data processors. Their contracts need security terms (Rule 6(1)(f)) and log retention (Rule 8(3)). See cloud, outsourcing and data location.