India: Digital Personal Data Protection (Amendment) Act (277/2024) including data protection regulation was introduced in Parliament

On 5 December 2025, the Digital Personal Data Protection (Amendment) Act, 277/2024, was introduced in the lower house of the Indian Parliament (Lok Sabha). The proposed amendment revises Section 9 of the Digital Personal Data Protection Act, 2023, to require data fiduciaries processing children’s personal data to adhere to the principle of data minimisation. This includes collecting only data that is necessary, retaining it for the minimum possible period, and deleting it upon termination of the service or withdrawal of consent. The amendment further requires data fiduciaries processing a substantial volume of children’s personal data to conduct a Data Protection Impact Assessment. The assessment must identify risks to children’s safety and privacy and be submitted annually to the Data Protection Board of India, together with the measures taken to address the identified risks. Data fiduciaries that fail to conduct or submit the assessment, or to protect children from systemic harm, are subject to additional penalties under the Act. The amendment also modifies Section 12 to specify that the right to request erasure may be exercised by a child’s parent or guardian until the child reaches 18 years of age. In addition, it clarifies that disputes between a child and a parent or guardian are to be resolved by the Data Protection Board of India.