India's Digital Personal Data Protection Act And Its Interplay With Intellectual Property Regimes

Author: LawSphereX

Category: Technology, Cyber & Privacy

Published: 2026-08-23T20:19:08.389125+00:00

Updated: 2026-08-26T17:11:09.894+00:00

INDIA'S DIGITAL PERSONAL DATA PROTECTION ACT

AND ITS INTERPLAY WITH INTELLECTUAL PROPERTY

REGIMES

Monika Pandey, Himachal Pradesh National Law University, Shimla

ABSTRACT

India's recent enactment of the Digital Personal Data Protection Act (DPDPA), 2023, marks a pivotal moment in the nation's legal landscape, establishing its first comprehensive privacy legislation following the Supreme Court's landmark 2017 Puttaswamy judgment. While traditionally perceived as distinct legal domains, personal data protection and intellectual property (IP) law are increasingly intersecting in the digital age. This article explores the complex dynamics, alignments, and tensions between the DPDPA and India's existing IP frameworks, including copyright, patents, trade secrets, and database rights. It analyzes how the DPDPA, by elevating individual data rights and autonomy, introduces a paradigm shift that affects the creation, management, and enforcement of IP assets, ultimately shaping India's ambition as a leading digital economy.

1. Introduction: The DPDPA and the Evolving Data Landscape

The Digital Personal Data Protection Act, 2023, is a significant legislative stride for India, primarily aimed at safeguarding personal data in the digital realm while simultaneously enabling its lawful utilization. This legislation was deeply influenced by the Supreme Court's seminal Puttaswamy judgment, which unequivocally recognized privacy as a fundamental right. The DPDPA fundamentally shifts the understanding of personal data, moving it from a potentially commodifiable asset to information over which individuals retain core rights and autonomy. This re-conceptualization inherently brings forth intricate challenges, particularly where personal data converges with intellectual property (IP) assets and rights.

While IP law traditionally focuses on incentivizing and protecting creative or innovative works, and data protection on privacy and individual autonomy, their overlap is undeniable in the data-centric digital economy.

2. The DPDPA's Interface with Intellectual Property Regimes

The DPDPA introduces a framework where personal data is subject to rights that can run parallel to, and occasionally override, established IP rights. This dynamic necessitates a detailed examination of its impact across various IP disciplines: • Copyright and Data: Indian copyright law generally does not extend protection to factual data per se. Copyright in databases or compilations is contingent upon demonstrating sufficient creativity in selection or arrangement, rather than mere "sweat-of-the-brow". Consequently, raw collections of personal data are typically not copyrightable. However, conflicts frequently arise when personal data is embedded within a copyrighted work, such as an image or video depicting an individual's likeness. While the creator holds the copyright, the depicted individual possesses personal data rights.

A notable tension emerges when individuals invoke their data protection rights, such as the "right to be forgotten," which can directly clash with the copyright holder's rights. The DPDPA attempts to balance this through exemptions for publicly available data or journalistic/research uses. Nevertheless, if privacy rights demand the removal of content copyrighted by others, the DPDPA generally prioritizes personal data protection. This means that if consent for personal information within a copyrighted database is withdrawn, the Data Fiduciary may be compelled to delete or anonymize it, potentially impacting the completeness of the work. Indian courts have

already begun to grapple with these issues, sometimes ordering the removal of online content in "right to be forgotten" cases, and the DPDPA formalizes the need for platforms to navigate these privacy-IP overlaps during takedown requests. • Patents and Data: Personal data itself is not patentable, though data-driven processes or algorithms can be. The DPDPA can indirectly affect patent activities by restricting the collection of personal data for research and development (R&D). Using Indian personal data, for instance, in training data for AI models (which themselves can be IP assets) necessitates consent or a lawful use ground. Noncompliance in data acquisition could lead to legal issues, irrespective of the patentability of the resulting algorithm.

Patent disclosures in fields like biotechnology may contain patient data, raising significant privacy concerns; however, patent law allows for the withholding of personally identifying details. Generally, patent law and the DPDPA operate in distinct spheres, but companies must ensure that data collection pertinent to invention aligns with privacy regulations. A key alignment exists in the DPDPA's exemptions for processing data for research or statistics, which may cover R&D activities, especially when data is anonymized. Additionally, processing data for enforcing legal rights, such as patent rights, is also exempt, enabling patent holders to use personal data as evidence in litigation without violating the DPDPA. • Trade Secrets and Confidential Data: Trade secrets frequently encompass data compilations, including customer lists, user engagement data, or proprietary algorithms.

India lacks a specific trade secret statute, relying on contractual agreements and common law principles for protection. Many businesses traditionally considered user data compilations as proprietary trade secrets. The DPDPA, however, challenges this by affirming individuals' rights over their data, even when it resides within a company's database. This implies that a company must be prepared to disclose, correct, or erase data upon a legitimate request, which can directly conflict with the imperative of keeping such data assets secret. For example, an access request could inadvertently reveal proprietary company analytics techniques. Notably, unlike the GDPR which provides explicit grounds to refuse disclosure if it affects trade secrets, the DPDPA does not explicitly list trade secret protection as a limitation on data access rights.

Consequently, companies may need to meticulously segregate raw personal data from proprietary logic or derived insights. Furthermore, erasure requests mean the potential

loss of data regarded as a critical component of a competitive knowledge base (e. g. , a valuable client list), highlighting a clear instance where data protection mandates override a business's IP-like interest. While trade secret law incentivizes data collection and guarding, data protection mandates openness and deletion. Critically, contractual clauses cannot override these statutory data rights, demonstrating that the DPDPA significantly tilts the balance towards the data principal's control, compelling businesses to adopt innovative approaches to safeguard proprietary information. • Database Rights and Data Ownership: India does not possess a sui generis database right akin to that in the European Union. Protection for databases typically derives from copyright (if sufficiently creative), contractual agreements, or trade secret law.

The DPDPA effectively grants individuals a quasi-ownership over their personal information, while companies generally lack an equivalent ownership claim over compilations of personal data. The DPDPA frames companies as custodians, not owners, of personal data, necessitating that processing occurs only for consented or legally permitted purposes. Selling a database containing user information to a third party, for instance, would require fresh consent or a distinct legal basis. Although certain provisions are exempted in M&A contexts, the acquiring entity must still honor the data rights. Consequently, the protection and value of databases in India will increasingly depend on DPDPA compliance.

Policymakers have also contemplated a framework for non-personal data (NPD), which could introduce "community data rights" or sharing mandates, significantly impacting the treatment of large datasets. Until such legislation, companies rely on existing IP tools, but DPDPA requirements like deletion mean that data sets are dynamic, user-influenced collections, rather than static IP assets.

3. Overlaps and Tensions between Data Protection Rights and IP Rights

The simultaneous existence of robust data protection rights and strong IP rights creates a nuanced interplay marked by both overlaps and inherent tensions: • Personal Data as Asset vs. Autonomy: Intellectual Property law typically views creations as a form of property. In contrast, the DPDPA and modern privacy laws frame personal data primarily through a rights lens, actively resisting its commodification. Individuals possess ongoing control rights, rather than traditional ownership. This

fundamental philosophical difference generates conflict when personal data forms part of an IP asset, such as user-generated content on a social media platform. While the platform may hold IP licenses to the content, the user unequivocally retains data privacy rights (e. g. , withdrawing consent for profile data use, requesting erasure). The company's IP rights do not extinguish the user's data rights, demanding careful management of this overlap between user autonomy rights and corporate economic interests. Future Indian jurisprudence will need to articulate balancing mechanisms, potentially drawing from EU approaches that safeguard trade secrets or IP during responses to data requests. • Data Privacy vs.

Innovation Incentives: A significant policy concern is that stringent data protection regulations might stifle data-driven innovation in fields like AI and analytics by limiting access to essential raw data. The DPDPA introduces new compliance hurdles, potentially slowing development and escalating costs, particularly for training AI models, which are critical IP assets. The principle of purpose limitation restricts data repurposing without fresh consent, a point of friction with the technology industry's desire for flexible data utilization. The core tension lies in IP encouraging innovation through protection, while data law restricts data use based on individual terms. However, overlaps exist where privacy fosters consumer trust, which can indirectly boost product adoption and value, thereby incentivizing innovation.

Furthermore, DPDPA compliance can enhance the global competitiveness of Indian IP. The DPDPA may also encourage companies to develop and adopt Privacy-Enhancing Technologies (PETs) such as anonymization or differential privacy, which themselves can be patented or guarded as trade secrets, representing a constructive synergy of innovation for privacy. • Licensing and Data Portability: IP relies heavily on licensing models for commercialization. Data protection, conversely, introduces the concept of data portability, allowing users to retrieve and transfer their data. While the DPDPA currently lacks a formal, explicit portability right, systems like India's Account Aggregator exist, and future legislation might mandate it.

Portability effectively creates a statutory license for the user to migrate their data, which could conflict with exclusive licenses or proprietary claims a service asserts over compiled data (e. g. , workout data in a fitness application). Companies express concerns about losing competitive

advantage if users transfer data to rivals. Crucially, contractual terms asserting company ownership or perpetual licenses cannot override statutory rights like erasure or potential portability. Data portability could disrupt exclusive licensing models, promoting competition but potentially eroding the "walled garden" value of proprietary datasets. Clarity is still required regarding whether derived data (involving company analytics or IP) must be ported, or if only raw data is subject to portability. • Enforcement and Defense: Privacy laws can impact IP enforcement mechanisms; for example, the GDPR led to the redaction of WHOIS data, which was traditionally used by trademark holders. The DPDPA's exemption for legal proceedings suggests that personal data required for IP enforcement (e. g. , identifying online infringers) is largely exempt from consent requirements or user rights.

This provision helps align IP enforcement with privacy law. Courts might also issue orders for data release based on a "court order" ground. Conversely, a company might seek to leverage IP rights as a defense against data requests, for example, by redacting information that reveals trade secrets. While the DPDPA does not explicitly allow this defense, future jurisprudence could evolve to balance privacy and IP, potentially drawing insights from EU court cases.

4. Emerging Issues at the Data-IP Intersection in India

Several nascent issues at the confluence of data protection and intellectual property are gaining prominence in India: • Protection of Non-Personal Data (NPD): While the DPDPA exclusively covers personal data, Non-Personal Data (NPD)—such as anonymized, industrial, or aggregated datasets—holds immense economic value. India is actively exploring governance frameworks for NPD, with an Expert Committee in 2020 proposing a structure to harness NPD for public interest and innovation. Key issues include determining whether companies should possess quasi-IP rights over large NPD datasets or if such data should be treated as public goods. Proposals for mandated sharing of "community" NPD have raised industry concerns about diluted investment incentives. Without regulation, dominant firms could potentially hoard NPD, stifling competition.

Balancing these aspects, potentially through compulsory licensing for critical datasets, is crucial. Ensuring that data is genuinely anonymized to mitigate privacy risks is

another complex challenge. While no specific NPD law exists yet, it is an "underexplored" area anticipated to see future legislation, with significant implications for innovation. • Data Anonymization and Re-identification Risks: Anonymization is often viewed as a means to utilize data freely, outside the purview of the DPDPA. Companies frequently anonymize personal data for analytical insights or research. However, with advancements in analytics, significant re-identification risks persist through the combination of various datasets. If purportedly anonymized data is successfully reidentified, it reverts to being personal data, creating privacy risks and potential legal liability. Although the DPDPA does not explicitly penalize re-identification attacks, unauthorized processing provisions might cover such incidents.

Rigorous anonymization standards, such as k-anonymity or differential privacy, are emerging as industry best practices. Anonymized datasets themselves can constitute valuable IP, serving as trade secrets or supporting patent claims. Nonetheless, re-identification triggers DPDPA obligations, potentially jeopardizing the value of the data asset and a company's legal standing. Generally, individuals do not retain rights in data truly derived from their personal information once it is genuinely anonymized. Regulators may impose duties on companies releasing inadequately protected "anonymized" data. This issue pits the data controllers' desire for value extraction (IP) against privacy advocates' concerns about latent risks. • Data Portability vs. IP/Contractual Restrictions: As noted, the DPDPA's lack of a formal portability right is a current gap.

A key debate surrounds the scope of portability: whether it includes derived data (which companies, having invested in analytics, often view as proprietary IP) or only raw data. Frameworks may exclude derived data to protect IP interests. International portability presents additional complexities, including navigating cross-border rules and compliance with foreign laws like GDPR. While portability can foster competition and innovation by enabling new market entrants to leverage user data, incumbent companies fear that their data IP "moats" could be undermined. India's proposed Digital Competition Act may even mandate portability as a tool to curb anti-competitive practices. The specific method of portability implementation in India (via DPDPA amendment or sectoral laws) will significantly shape this balance, likely incorporating technical standards and limits to protect

confidential business information. • Data-Driven AI and IP Rights: Artificial intelligence and machine learning models are central assets in India's digital economy, and they are frequently trained on personal data. An emerging issue questions whether individuals' data rights could extend to AI models or their outputs. For instance, if a user deletes data used for training an AI model, should the model be compelled to "forget" that individual? This is a complex area, generally not required unless specific personal information was memorized by the model. The AI model itself can be protected as IP (e. g. , trade secret, copyright). While individuals do not own the AI model, their data may have contributed to its creation. The concept of a "data donor" right is being contemplated but is not yet law. AI outputs can also potentially infringe on privacy or existing IP rights.

India must delineate how the DPDPA interacts with AI-related IP laws (e. g. , copyright for AI-generated output, patenting AI inventions). Companies developing AI must ensure they use compliant data, implement privacy-by-design principles (like data minimization and filtering), and meticulously document that their IP (the AI model) was created legally. This proactive approach reduces risk and enhances the value of their IP in privacy-conscious markets. • "Privacy as IP? ": Conceptually, some scholars have explored whether privacy could be protected through IP-like mechanisms, treating personal information as a form of intellectual property. The DPDPA did not adopt this approach. However, Indian courts might borrow IP concepts for privacy enforcement, such as utilizing injunctions for misuse of personal data akin to remedies for IP infringement.

Indeed, Indian courts have previously issued injunctions for privacy violations in ways reminiscent of copyright enforcement. Future jurisprudence might witness a convergence, where IP remedies are adapted for data protection breaches. The idea of personal datasets as property under Article 300A of the Constitution has been raised but remains untested; the prevailing view regards privacy as a liberty right. These emerging issues largely revolve around drawing clear distinctions: between personal and non-personal data, between what constitutes a protected right versus a freely usable resource, and between fostering innovation and safeguarding individual rights. India's regulatory

strategy appears to be incremental, starting with personal data law and then addressing other gaps like non-personal data.

5. Judicial and Regulatory Perspectives

The implementation of the DPDPA will be significantly shaped by judicial interpretations and regulatory developments: • Judicial Interpretations: Indian courts have increasingly engaged with data protection, a trend that will only accelerate with the DPDPA's full implementation. The foundational Justice K. S. Puttaswamy (Retd. ) v. Union of India (2017) judgment established privacy, including informational privacy, as an integral part of the fundamental right to life and liberty. The Court underscored the necessity for data protection legislation and even outlined guiding principles like necessity and proportionality for state interference with privacy.

Subsequently, in Puttaswamy II (2018) (the Aadhaar case), the Supreme Court struck down provisions of the Aadhaar Act that permitted unlimited private sector use of national ID data due to privacy concerns, while upholding its core compulsory use for government benefits with safeguards. These decisions emphasize the critical need to balance privacy with other rights and interests, a theme directly relevant to IP and free speech. High Courts in India have also begun addressing the "Right to be Forgotten" (RTBF) even in the absence of a specific statute. Cases from the Delhi and Karnataka High Courts have seen requests for removal of personal information from online platforms, with courts demonstrating a willingness to order takedowns or anonymization in certain circumstances, effectively prioritizing privacy over publication (and implicitly over content IP rights).

This suggests that Indian courts will adopt a case-by-case balancing approach under the DPDPA. Once operational, individuals may petition the Data Protection Board directly, but contentious cases, particularly those involving media or IP issues, are likely to reach the courts for final resolution. Courts have also sought to harmonize intermediary liability rules with privacy, considering issues like global versus local content removal, potentially drawing parallels from copyright takedown handling. Constitutional challenges against the DPDPA's provisions, particularly broad government exemptions, are anticipated, requiring the Supreme Court to balance national security with privacy rights. Critically, if a company refuses a data erasure

request citing its copyright or trade secret rights, Indian courts might consider precedents from EU courts that have balanced privacy restrictions against the protection of IP in specific contexts. • Regulatory Developments: Alongside the establishment of the Data Protection Board, the Indian government and sectoral regulators are actively aligning their norms with the DPDPA. The Reserve Bank of India (RBI) had already mandated data localization for payments data and stringent cybersecurity norms for banks, which complement DPDPA's security requirements. Other regulators, such as the Insurance Regulatory and Development Authority of India (IRDAI), are updating privacy guidelines for customer data.

Upcoming legislation, including the Digital India Act and the Telecom Bill 2023, is also expected to incorporate data provisions, potentially covering non-personal data sharing mandates and child privacy. The draft Digital Personal Data Protection Rules

2025 further elaborate on DPDPA procedures, detailing aspects like consent

mechanisms, breach reporting, and Board inquiry protocols. One crucial anticipated regulatory action is the issuance of a "whitelist" or "blacklist" for cross-border data transfers. The DPDPA permits data export except to banned jurisdictions. The government is expected to notify either a list of prohibited countries or specific criteria for such prohibition. This is closely watched by global businesses. Early indications suggest a permissive regime (banning only a few "rogue states"), which would facilitate India's IT business internationally by leveraging the DPDPA's flexibility.

6. Practical Implications for Businesses, Creators, and Consumers

The convergence of data protection and IP in India’s digital economy has multifaceted practical implications for various stakeholders: • For Businesses: Virtually all businesses handling personal data must ensure DPDPA compliance. This necessitates significant operational changes, including deploying consent management platforms, revising privacy policies, implementing data retention and deletion workflows, and employee training. Contracts with vendors and partners require updates to include DPDPA-compliant data processing terms. Robust data security measures are paramount, as breaches incur heavy fines and can compromise proprietary data sets or trade secrets. Many companies are appointing or upskilling Data Protection Officers (DPOs) and establishing internal privacy compliance teams.

Beyond compliance, businesses must integrate their data strategies with IP strategies. Companies heavily reliant on data analytics may shift towards aggregated or anonymized data to reduce compliance burdens. If personal data is a core asset (e. g. , user behavior for targeted advertising), companies must invest in building consumer trust and incentivizing voluntary data sharing, effectively making users partners in datadriven IP creation. Businesses must also prepare for individuals exercising their rights, such as managing a surge in deletion requests, as improper denial can lead to legal disputes or reputational damage. In sectors like ad-tech or social media, the DPDPA incentivizes transparency and potentially less intrusive, consent-based business models. Cross-border businesses must coordinate global compliance efforts, ensuring consistency across jurisdictions like the EU (e. g.

, data purging across mirrored systems). While DPDPA might not immediately grant India EU "adequacy status," alignment with international norms could benefit India's IT/BPO industries. Companies should build documentation (e. g. , privacy impact assessments) to demonstrate accountability, potentially mitigating penalties. Cyber liability insurance is also likely to gain importance. Proactive compliance can serve as a competitive advantage, attracting privacy-conscious consumers and streamlining data management, leading to reduced storage costs and security risks. • For Creators and Innovators: Content creators (e. g. , documentary filmmakers, journalists) who use personal data must be mindful of the DPDPA. Publishing personal data requires consent or adherence to legal exceptions (like journalistic purpose).

Photographers or YouTubers may need to obtain releases and consents from featured individuals, not only for IP clearance but now for data privacy. Individual creators also become data fiduciaries for collected fan/audience data (e. g. , email lists). Software developers and tech innovators will need to integrate privacy-by-design principles, such as incorporating privacy settings and user controls into applications. Those in AI or data science may prioritize synthetic or anonymized data to mitigate personal data handling issues. In IP creation, researchers seeking patents might anonymize personal data in publications to avoid future complications. Trade secret holders will need to differentiate between ephemeral data-driven insights (subject to data rights) and core, strictly internal algorithms. For startups whose value proposition hinges on unique datasets (e. g.

, a biotech startup with a genomic database), ethical and lawful data acquisition is critical, as the value of their IP (the database and derived AI) depends on

it. Thus, data provenance becomes a crucial part of IP due diligence for investors. • For Consumers (Individuals): Indian consumers, designated as Data Principals under the DPDPA, are empowered with greater transparency regarding data usage and the ability to exercise rights like correction or deletion. This enables users to demand deletion of profiles or purchase histories from e-commerce sites (subject to legal retention) or removal of photos from social networks. This newfound leverage could enable consumers to negotiate better terms or opt for services that respect their data preferences. Consumers also benefit from enhanced security and accountability mandates, ensuring better data protection and notification in case of breaches. This fosters a trust environment, encouraging engagement with digital services.

However, the actual exercise of these rights depends on consumer awareness and ease of use. Cumbersome processes or a slow Data Protection Board could hinder immediate change. Consumers acting as creators or copyright owners might also face scenarios where their privacy rights conflict with their own or others' IP rights (e. g. , an author facing takedown requests for including personal stories in a memoir). This reinforces that rights are not absolute and require balancing. The DPDPA is critical for building digital trust in India's large digital market, especially after global incidents of data breaches or misuse. Conversely, strict data laws globally have prompted debate about the sustainability of ad-driven "free" services, potentially leading to a shift towards subscription models in India if targeted advertising becomes more challenging.

Overall, the interplay between data protection and IP will fundamentally shape India's digital economy. A robust data protection regime can facilitate international data flows and partnerships, while increasing user confidence in the domestic digital market. However, miscalibration could impose excessive compliance costs, deterring smaller enterprises. The government's approach appears to seek a middle ground: protecting citizens without unduly hamstringing businesses. Companies that effectively navigate both IP creation and data compliance can set precedents for "privacy-respecting innovation," transforming a potential tension into a competitive advantage.

7. Conclusion

India’s Digital Personal Data Protection Act, 2023, signifies a seminal shift in the country’s legal framework, elevating the protection of personal data to a statutory right and

responsibility. This new regime is not isolated but intricately interwoven with existing laws, including those governing intellectual property. As this analysis has demonstrated, data protection and IP law are profoundly interrelated, influencing how companies leverage data for competitive advantage and how individuals control their information, even when it forms part of another entity's creation. The DPDPA decisively tilts the balance towards individual data autonomy, which may, at times, restrict the utilization of IP assets built on personal data. However, this framework also lays the groundwork for more sustainable innovation founded on trust and legal certainty. The forthcoming years will be crucial as jurisprudence evolves, rules are finalized, and the Data Protection Board assumes its role.

Stakeholders across government, industry, creators, and civil society must continuously engage to address ambiguities, particularly concerning non-personal data, anonymization standards, and cross-border harmonization. India’s approach, if successful, could serve as a global model for reconciling economic growth fueled by data with the fundamental right to privacy. Challenges persist, notably ensuring state actors adhere to high data use standards, empowering an independent regulator, and translating compliance from mere paperwork into substantive change. From an IP perspective, businesses and innovators must recognize that the "data advantage" is now inextricably linked with "data responsibility". Those who proactively integrate privacy throughout their IP lifecycle—from R&D to product deployment—are poised to thrive in this new regulatory environment.

Concurrently, consumers gain new instruments to exercise control, ensuring that their personal data is no longer treated as a resource devoid of oversight. In essence, India's data protection law and IP framework need not be antagonistic; with judicious interpretation, they can complement each other, with privacy law safeguarding individuals in the information age and IP law continuing to incentivize creativity and innovation, both converging towards the common goal of a fair and flourishing digital economy. The balance achieved in India will be observed globally as a pivotal test case for how a populous democracy manages "the new oil" of data, while simultaneously upholding individual rights and collective progress.