On 12 August 2023, the Parliament of India passed into law the Digital Personal Data Protection Act, 2023 (DPDP Act) after a marathon period of public consultations, draft iterations and revisions. The mandate for this framework was envisioned by the Hon’ble Supreme Court in its landmark verdict in KS Puttaswamy v. Union of India (2017) , where the court ruled in favour of the existence of an implicit ‘right to privacy’ as a fundamental right, in relation to the ‘right to life’ under Article 21 of the Constitution of India, 1950.

The right to privacy as understood by the Supreme Court is applicable to all forms of personal information of all persons. The DPDP Act has itself been enacted with a scope applicable to the automated, and partially automated, processing of personal data in digital space.

Until the enforcement of the DPDP Act is initiated by Central Government, the existing light-touch privacy framework currently operative in India will continue to remain in force. This older framework was devised under Section 43A of the Information Technology Act, 2000 (IT Act), which specified the liability of body corporates possessing, dealing with, or handling any ‘sensitive personal data or information’ stored in a computer resource. In addition to the IT Act, the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (RSPDI Rules) were notified to guide the information security and data handling processes undertaken by body corporates, which would include online gaming entities.

It is expected that transitioning from this light-touch IT Act framework to the DPDP Act will require significant adjustments on the part of online gaming companies.

The DPDP Act introduces multiple new compliances on entities processing personal data in India to provide services to users. While the impact of these compliances will be felt across sectors, this report has been prepared with special focus on gaming companies offering services to users within the country as detailed below.