Privacy Map

India. Sectoral privacy. Rules (subordinate legislation)

SPDI RulesInformation Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

In force
Partly verifiedMedium confidence. DLA Piper confirms the 2011 'Privacy Rules' continue until 13 May 2027. Lapse is inferred from omission of parent provisions; no express repeal notification seen. Grievance officer is required (not a DPO).

§1Summary

Synopsis

Requires body corporates collecting sensitive personal data (passwords, financial, health, biometric data, etc.) to publish a privacy policy, obtain written consent, appoint a grievance officer and follow reasonable security practices such as ISO/IEC 27001. Restricts onward disclosure and limits overseas transfers to recipients offering equivalent protection.

Key themes
  • privacy policy
  • consent for SPDI
  • grievance officer
  • reasonable security practices
  • ISO 27001
  • transfers
Unique features

Only covers a closed list of 'sensitive' categories; compliance with ISO 27001 or an approved code is deemed reasonable security.

SaaS relevance

Governs SaaS handling of Indian SPDI until DPDP's main phase on 13 May 2027.

§2Obligations

Extraterritorial
Limited
Breach notification
None (see CERT-In Directions)
DPO
No
Cross-border transfers
Transfer of SPDI only where recipient ensures the same level of protection and transfer is necessary for a lawful contract or consented
Maximum penalty
Compensation under IT Act s43A (uncapped)

§3Dates

Key dates
  • Adopted
  • In force
  • Made under IT Act s43A/s87(2)(ob). Expected to lapse when DPDP Act s44(2) omits s43A and s87(2)(ob) on 2027-05-13.

§4Text and authority

Text
Authority
MeitY / adjudicating officers under IT Act

§5Where it applies

Domestic law of
India

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. DLA Piper confirms the 2011 'Privacy Rules' continue until 13 May 2027. Lapse is inferred from omission of parent provisions; no express repeal notification seen. Grievance officer is required (not a DPO).