Taxmann Digital Personal Data Protection An Essential Guide to India’s DPDP Law By Narasimhan Elangovan Edition September 2026

Digital Personal Data Protection By Narasimhan Elangovan Edition 2026

Digital Personal Data Protection By Narasimhan Elangovan Edition 2026

Description

Digital Personal Data Protection – An Essential Guide to India’s DPDP Law is a practitioner’s guide to the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025. It is written for professionals who must make compliance happen, and it takes them from the statutory text to a working programme: what must change, who must be accountable, and what evidence proves compliance.

The book is written for the period before enforcement begins, when organisations must design compliance without Indian precedent to guide them. It bridges the text of the law and the reality of its implementation, and answers practical questions that cut across legal, technology, and business functions.

The result is a working reference for building data-governance programmes that earn and preserve trust in India’s fast-evolving digital economy.

The Present Publication is the 2026 Edition, authored by CA Narasimhan Elangovan. The law stated in this book is as updated till 15^th September 2026, with the following noteworthy features:

• [Anchored in the Text] The analysis is anchored in the text of the Act and the Rules, cited down to the section, sub-section, clause and rule, rather than in summaries or secondary commentary
• [Recurring Disciplines] Across its implementation sections, the book returns to the same habits: classify each processing activity separately, record who decided and when, and review at least annually and whenever a material change occurs
• [Illustrative Templates] Thirteen templates give working formats, from a model notice and a Data Processing Agreement clause checklist to a Data Protection Impact Assessment (DPIA) structure, a first-90-days readiness checklist and a Board inquiry response protocol. They are designed as starting points, to be adapted to each organisation, reviewed by legal counsel and maintained as living documents
• [Audit Considerations] Twelve chapters (3 to 14) state what an auditor will test and list the findings that recur in practice, 57 in all. Eight of them (Chapters 3 to 10) also list the evidence to keep ready. The guidance serves both the organisation preparing for an audit and the auditor conducting one
• [Consolidated Requirements Register] Appendix A restates the obligations under the Act and the Rules as 49 testable requirements across 15 subject areas. Each carries its legal reference and a numbered list of audit evidence, 239 items in all, ranging from registers, logs and screenshots to sign-offs and test results. Obligations that apply only to Significant Data Fiduciaries are marked, and Consent Manager obligations are grouped separately. It is built to work as a structured checklist, so that no obligation is overlooked
• [Case Study Boxes] Thirty boxed notes (case studies, comparative notes, practical scenarios and short explainers) support the analysis. The case studies draw on decisions of the Supreme Court of India and the Court of Justice of the European Union, and on enforcement actions by regulators in France, Norway, Portugal and Ireland. The comparative notes set the book’s analysis against the GDPR, the EU AI Act and the RBI Account Aggregator framework, and flag where habits formed under the GDPR do not carry over
• [Regulatory Overlap Mapping] The book shows how to map DPDP duties against existing obligations, such as those set by the RBI, SEBI, IRDAI and CERT-In, one obligation at a time: where they overlap, where the Act adds to them, where they conflict, which requirement is more restrictive, and which control satisfies both. It also shows how far existing ISO 27001 and SOC 2 controls go, and where gaps remain
• [Worked Scenarios] Scenarios from everyday Indian practice make the discussion concrete. They include a compliance officer at a mid-size NBFC asking on what basis data is being processed, a chartered accountant handling a client’s tax return, a paper visitor register that is later scanned, an e-commerce breach confirmed at 9 a.m. on a Monday, and a steering committee formed only in January 2027

The coverage of the book is as follows:

• Part I | The Law and its Architecture
• Part II | Obligations of Data Fiduciaries
• Part III | Rights of Data Principals
• Part IV | Significant Data Fiduciaries and Special Provisions
• Part V | Compliance and Enforcement
• Glossary and Appendices

The Chapters follow a common pattern:

• Most open with the practical problem they address, often through a question or a scenario, and set out what the chapter covers
• The analysis is organised in numbered sections and sub-sections, up to three levels deep
• Case study boxes are set into the text where they apply
• Implementation guidance then turns the analysis into operational steps. From Chapter 3 onwards, it carries the templates as numbered Figures and is followed by Audit Considerations.

About the Author

CA. Narasimhan Elangovan leads the data protection, cybersecurity and privacy advisory practice at Ascentium (formerly InCorp Advisory Services), where he is the Cybersecurity & Privacy Practice Leader. A Fellow Chartered Accountant (FCA) with a Bachelor of Laws (LLB), he is a Certified Information Systems Auditor (CISA), Certified Data Privacy Solutions Engineer (CDPSE) and Certified Information Privacy Manager (CIPM), and holds the Certificate of Cloud Security Knowledge (CCSK).