Data Protection by Design under the Digital Personal Data Protection Framework: Emerging Obligations and Regulatory Challenges in India

Data Protection by Design represents an important transition from reactive privacy protection towards preventive data governance. In an increasingly data-dependent economy, individuals cannot reasonably be expected to protect themselves against every consequence of complex and invisible data-processing operations. Responsibility must therefore also rest upon organisations that determine how personal information is collected, processed, stored, shared, and deleted. India's DPDP Act, 2023 and Rules, 2025 establish an important foundation for this approach through obligations relating to Data Fiduciaries, security safeguards, accountability, consent, children's data, and other aspects of responsible data processing. Nevertheless, the framework does not yet articulate Data Protection by Design with the same explicitness and conceptual coherence found in Article 25 of the GDPR. The future development of India's data protection regime should therefore focus on converting broad statutory principles into practical, risk-sensitive, and technologically adaptable design standards. Such an approach would enable privacy to become an integral feature of digital systems rather than a corrective measure applied after harm has occurred. Ultimately, the effectiveness of India's data protection framework will depend not only upon the existence of statutory rights and regulatory institutions but upon whether privacy is embedded within the architecture of India's digital ecosystem itself.

1.                Article 29 Data Protection Working Party. (2018). Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679. European Commission. 2.                Article 29 Data Protection Working Party. (2018). Guidelines on transparency under Regulation 2016/679. European Commission. 3.                Bennett, C. J., & Raab, C. D. (2006). The governance of privacy: Policy instruments in global perspective. MIT Press. 4.                Bygrave, L. A. (2014). Data privacy law: An international perspective. Oxford University Press. 5.                Cavoukian, A. (2011). Privacy by design: The 7 foundational principles. Information and Privacy Commissioner of Ontario. 6.                Committee of Experts under the Chairmanship of Justice B. N. Srikrishna. (2018). A free and fair digital economy: Protecting privacy, empowering Indians. Ministry of Electronics and Information Technology, Government of India. 7.                De Hert, P., Papakonstantinou, V., Malgieri, G., Beslay, L., & Sanchez, I. (2018). The right to data protection in the era of the General Data Protection Regulation. Computer Law & Security Review, 34(2), 179–194. 8.                De Hert, P., & Papakonstantinou, V. (2016). The new General Data Protection Regulation: Still a sound system for the protection of individuals? Computer Law & Security Review, 32(2), 179–194. 9.                Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India). 10.             Digital Personal Data Protection Rules, 2025, Ministry of Electronics and Information Technology, Government of India.