The data privacy practice of King Stubb & Kasiva works from our head office in New Delhi, where four of its five partners are based. We advise businesses across Delhi NCR on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
New Delhi is where India’s data protection framework is administered. The Ministry of Electronics and Information Technology, which frames the DPDP Rules, and CERT-In are based here. The Data Protection Board of India has its head office in the National Capital Region, and appeals from the Board go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) in New Delhi.
Businesses across Delhi NCR, from e-commerce and consumer platforms to telecom and media companies and organisations that handle government data, come to us for DPDP gap assessments, notices and consent flows, breach readiness and representation before regulators.
For the full picture of the law, read our one-page guide to the DPDP Act in India.
Advice on the DPDP Act and Rules from readiness through to breaches and proceedings before the Data Protection Board.
Gap assessments, data mapping, privacy notices, consent design and a compliance roadmap to 13 May 2027.
Learn moreSetting up and supporting the DPO function, including for Significant Data Fiduciaries that must appoint one.
Learn moreAnnual DPIAs, independent audits and governance for entities notified as Significant Data Fiduciaries.
Learn moreBreach intimation to the Data Protection Board and affected individuals, CERT-In reporting and regulator engagement.
Learn moreRNM Tower, 5th Floor, Metro Pillar No. 331, i4, B1, NH-19, Mohan Cooperative Industrial Estate, New Delhi 110044
Four of the practice’s five partners are based in our New Delhi head office, with Managing Partner Jidesh Kumar in Bengaluru.
The DPDP Rules, 2025 bring the Act into force in three stages.
Yes. The DPDP Act applies across India to digital personal data, whether collected online or collected offline and later digitised. It also applies to businesses outside India that offer goods or services to people in India.
The DPDP Rules, 2025 were notified on 13 November 2025. The Consent Manager provisions apply from 13 November 2026, and the core obligations on notice, consent, security safeguards, breach intimation, data principal rights and retention apply from 13 May 2027.
The Board was established on 13 November 2025 with its head office in the National Capital Region, and it is designed to work as a digital office. As of September 2026, no Chairperson or Members had been reported as appointed. Appeals from its orders go to TDSAT in New Delhi.
Complaints under the DPDP Act go to the Data Protection Board of India, and appeals from the Board go to TDSAT within 60 days. Civil courts cannot hear matters the Board can decide, but writ petitions and constitutional challenges can be brought before the Delhi High Court.
Call the New Delhi office on +91-11-41318190, visit us at Mohan Cooperative Industrial Estate, or send an enquiry through our contact form. A member of the data privacy team will respond.
The same data privacy team advises from each King Stubb & Kasiva office.
Tell us what your organisation does with personal data and what you need. A member of the data privacy team will respond.
Last reviewed 29 September 2026. General information, not legal advice.
