NEW DIGITAL PERSONAL DATA PROTECTION REGIME

 

NEW DIGITAL PERSONAL DATA PROTECTION REGIME

 

The Digital Personal Data Protection Rules, 2025 (DPDP Rules), published on November 13, 2025, together with the phased launch of the Digital Personal Data Protection Act , 2023 (DPDP Act).

 

A Small write up on it:

 

1.     Scope & Applicability

 

DPDP Act – What It Covers

   (a)         Applies to digital personal data: that is, personal data, which is collected in digital form, or collected in non-digital form and subsequently digitised.

  (b)         Also applies extraterritorially: If an entity outside India processes digital personal data in connection with offering goods or services to individuals in India (data principals) or monitoring their behaviour, the Act applies.

   (c)         Exemptions: The Act does not apply to (i) personal data processed by an individual for purely personal or domestic purposes; (ii) personal data made publicly available by the data principal (or any other person legally obliged to publish it).

  (d)         While the Act was passed in 2023, many provisions will be brought into force in phases via notifications.

 

Rules – What They Establish

   (a)         The DPDP Rules, 2025 (notified 13/14 November 2025) set out the detailed operational compliance framework: procedures, timelines, governance, breach-reporting, cross-border flows etc.

  (b)         These Rules mark the full operationalization of the Act (i.e., moving from legislative framework to implementation requirements) for many entities.

 

2.     Key Obligations on Organizations (“Data Fiduciaries”)

 

Under the Act and Rules, organizations processing personal data must comply with several obligations. Some of the main ones:

 

Lawful Processing & Consent

   (a)         Processing of personal data must be for a specified purpose (which must be informed to the data principal) and cannot be broader than necessary.

  (b)         Consent must be free, specific, informed, unambiguous, given by a clear affirmative act.

   (c)         Data principals have the right to withdraw consent at any time, and the withdrawal should be as easy as giving consent.

  (d)         The notice to the data principal must be in clear language, and in one of the languages in the Eighth Schedule of the Constitution (per the Act).

 

Minimisation, Purpose Limitation, Accuracy & Retention

   (a)         Only data that is necessary for the specified purpose may be collected.

  (b)         Data must be processed fairly and transparently.

   (c)         Organisations must ensure data is accurate, kept up-to-date, and should not be kept longer than required for the purpose (storage limitation implied in the Rules).

 

Governance, Security Measures & Accountability

   (a)         Data fiduciaries must implement reasonable security safeguards (both technical and organisational) to protect against unauthorised access, loss, disclosure, etc.

  (b)         Entities designated as “Significant Data Fiduciaries” (SDFs) carry stricter obligations: e.g., appointing a Data Protection Officer (DPO), conducting Data-Protection Impact Assessments (DPIAs), independent audits.

   (c)         There is a requirement for governance structures (including internal policies, training, compliance mechanisms) to ensure accountability.

 

Breach Notification & Enforcement

• In the Rules, entities must notify the competent authority / data protection board and the data principals of data breaches within prescribed timelines.
• The Act provides for a Data Protection Board of India (DPB) to adjudicate non-compliance, receive complaints, impose penalties.

 

Cross-Border Data Transfers

• The Rules set out conditions for transfer of personal data outside India – these may include adequacy / assurance of similar protection or prescribed safeguards.

 

Special Categories / Children / Consent Managers

• The Rules also address processing of children’s data (e.g., verifiable parental consent) in more detail.
• The concept of a “Consent Manager” (on behalf of data principals) is present in the Act – enabling nomination of a person to manage rights on behalf of the principal.

 

3. Rights Of Individuals (Data Principals)

 

Under the Act and Rules, individuals whose data is processed have certain rights:

   (a)         Right to access information: About what personal data is processed, the purpose, categories, etc.

  (b)         Right to correct or erase their personal data (subject to certain limits of law).

   (c)         Right to withdraw consent at any time.

  (d)         Right to lodge a complaint with the Data Protection Board for non-compliance by the fiduciary.

 

3.     Exemptions & Balancing with Public Interest

 

   (a)         The Act provides that certain processing by State (government) or its instrumentalities may be exempt if necessary for tasks like prevention of offence, detection, investigation, for regulatory/judicial functions, national security, public order etc.

  (b)         The Rules emphasise the need to balance individual privacy with innovation-friendly, digital economy goals, and national interest.

 

4.     Implementation Timeline & Compliance Strategy

 

   (a)         The Act was passed in August 2023. The notification of the Rules on 13/14 Nov 2025 triggers many of the operational obligations.

  (b)         Now is the time to assess current data-processing-practices, gap-analyse consent/notice/security frameworks, map cross-border flows, define whether they are a “Significant Data Fiduciary”, and begin aligning policies, systems, and contracts.

   (c)         The expectation will be that businesses move from legacy compliance (IT Act structures) into this regime.

POSH Act & Requirement of filing Annual report

 

POSH Act & Requirement of filing Annual report for 2023 by 31st January, 2024

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act was passed in 2013 and it got amended in 2023 with certain important stipulations. As an employer, it is very important for you to be aware of the provisions, the compliance requirements and the penalties for non-compliance.

 

As gender equality and women’s rights are in the forefront of the social and governance attention, any lapse in the compliance may have far-reaching implications.

 

Let us see a gist of the POSH Act compliance.

 

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act was passed in 2013, laying down the procedures for a complaint and inquiry, and the action to be taken.

 

1.    POSH Act is applicable on every Company, workspace, establishment or organization employing 10 or more employees whether full time, part time, interns or on contract, irrespective of its nature of industry of location.

 

It is applicable to all including proprietary, firms, companies or any other entity.

 

2. Internal Committee: Internal Complaints Committee has to be mandatory set up in each establishment with 1 Presiding Member, 2 Employee Members and  & 1 external members in case of bigger entities.

 

Presiding Officer who shall be a woman employed at a senior level at workplace from amongst the employees and at least one-half of the total Members so shall be women.

 

3.     Formulation of Internal POSH Policy.

 

Entity should formulate a POSH Policy and circulate it amongst its employees.

 

4.  Workshops, Awareness and Orientation Programs has to be Organized by the employer to the employees.

 

5.   Submitting Reports under the Act: The Internal Complaints Committee or the Local Committee, in every calendar year, shall prepare and submit an annual report to employer and district officer.

 

There is a specific format for this Annual Report.

 

The due date to file the report with the District Officer is 31st of January for every year for the preceding calendar year.

 

6.     Penalties: When the employer fails to constitute an Internal Committee or breaches provisions of this Act or any rules made thereunder, they shall be punishable with fine of fifty thousand rupees.

Extended penalties shall be:

·       Cancellation or withdrawal of his license.

·       Non-renewal, or cancellation of the registration.

·    The employer shall be punishable with fine which may extend to Rs. 50,000/- for the first offence.

 

7.     Disclosure regarding the POSH act compliances must be reported every year in Board report of the Company.

Very important amendment in Income Tax relating to MSME

You buy goods or services from an MSME:

You have to pay the amount _within 45 days from the date of acceptance of goods of services_ (or within such shorter time as agreed between the parties)

But If you fail to pay the amount due to an MSME within 45 days, then what is the consequence?

1.  You have to pay interest @ 20.25% from the 45^th day till the date of payment.

(This interest is not deductible as an expenses under Income Tax Act)

2. But most importantly, there is an amendment in the Income Tax Act from FY 2023-24 which says “YOU CANNOT CLAIM THAT PURCHASE OF GOODS OR SERVICES AS AN EXPENSE”. But you can claim the expense in the year in which you have paid the MSME.

 For example, if you buy Rs. 10 lakhs worth of goods from an MSME which is overdue for more than 45 days and is outstanding as on 31^st March,  then you will have to pay about Rs. 3.40 lakhs plus interest additionally, as Income Tax.

You have to identify, out of your creditors,  who all are MSMEs and ensure that their dues are settled in time.

So please take care that you pay all your MSME creditors within 45 days and clear the all dues to MSME outstanding for more than 45 days before March 31^st.

To MSME suppliers : Do not forget to mention your MSME registration number in your quotes, contracts, invoice and other communications with your customers.

 

 

• •     Are you a company (Private Limited or Limited)?
• •     Are you using any software for maintaining your accounts?
• •    Then you are required to ensure that your software has the feature of Audit Trail from April 1, 2023.

 

What is audit trail?

 

Simply speaking, it the record that tells you:

• •    When was a particular entry made in the software
• •    Who has done it
• •  If that entry is subsequently modified, when was it modified, who made the modification, what was the modification.
• •   If that entry is subsequently deleted, when was it deleted, who made the deletion, what was the entry before deletion.

 

Modification can be in any field including date, party name, particulars, narration, inventory values, amount etc. – any correction or change or deletion in any of the data already entered.

 

Importantly, the audit trail feature should not be disabled or deleted.

 

What can be the possible impact of this?

 

This requirement is as per direction of Ministry of Corporate Affairs. But, once your software has the audit trail feature, any other department including Income Tax, GST or ED can verify the audit trail – which means they will come to know what modifications/ deletions you have made in the accounts.

 

So, you will have to be extra cautious when you make:

•       A back dated entry

•       Any modification of data already entered, including splitting of entries

•       Any cancellation or deletion of entry already made

 

You will have to explain why it happened and have to establish that such entries/modification/deletion are made for genuine reasons and not for the purpose of any tax evasion or not for covering up any violation of law.

 

Only exemption to this requirement is that you are maintaining books of accounts manually. But how far it is possible is a question.

 

So make sure that your accounting is uptodate, accurate and complies with all laws that are applicable. If you have any doubts, consult your CA before making the entry.

 

You should not pass an entry, modify it or delete it at your whims and fancies. Ensure that the entry is correct in all respects,  before passing it.

 

Any subsequent correction / deletion may invite unnecessary questions. It may open a pandora’s box, in many cases!

 

- CA. James Antony

Blood bath in Wall Street! - What happened to Silicon Valley Bank and how it collapsed in just 48 hours!

 

Blood bath in Wall Street!

 

The Biggest Bank fail since 2008 global financial crisis!

 

What happened to Silicon Valley Bank and how it collapsed in just 48 hours!

 

It was another Black Friday yesterday. All over the world, the stock exchanges bled.

 

All because of the collapse of the Silicon Valley Bank (SVB). California State Authorities closed down SVB and kept under receivership of the Federal Deposit Insurance Corporation.

 

Let us try to understand what happened in the last 48 hours

 

Silicon Valley Bank was a commercial bank headquartered in California. SVB was the 16^th largest bank in the United States and is the biggest bank in Silicon Valley based on local deposits, with a 30% market share.

 

Everything started with Bank’s announcement of its intention to raise funds to the tune of $ 2 billion. 

Strange! Isn’t it?

 

Yes, this announcement created panic among the investors as the rumor about the gaps in its balance sheet was coming true and there was a massive sell off and run for the deposits.

 

As the panic grew, SVB shelved its plan for the fund raising, but the damage was already done, share price went down 60%. And the rest is history, now.

 

Is Federal Reserve the Villain?

 

Analysts say SVB was the victim of recent hikes in interest rates Federal Reserve and the fears of more hikes in 2023.

 

After a period of continued low interest regime during the covid pandemic, central banks led by the US Federal Reserve, started raising rates aggressively to tackle inflation. 

 

How did it affect SVB?

 

Investors normally do not take risk, when the money available to them is costly. Due to the increased interest rates, money become expensive.

 

SVB was mainly catering to Technology companies and Start-ups. Tech and Start-ups are considered high risk. So investors put SVB in the high risk investment category. Further, the customers of SVB were all Tech and Start-ups. They also were reluctant to take risk.

 

High interest rates led to shortage of funding to Start ups which are otherwise considered to be highly risky. So they started withdrawing money from SVB for their liquidity needs. So SVB had to meet higher demands of withdrawals from customers. On the other side, investors were not ready to bet funds on SVB.

 

So, there was a fund shortage in SVB. To rescue themselves from collapse, SVB sold $ 21 Billion investment portfolio at a  huge loss of $ 1.80 Billion.

 

This was the biggening of the end

 

To compensate this loss, SVB decided to issue $ 2 billion equity and preference shares.

 

But this sudden announcement created doubts about the strength of the Balance Sheet of SVB, among investors. Adding the woes, Silvergate Capital, a Crypto focussed bank closed its shutters on the same day.

 

The result was a panic selling in SVB shares as well as a mad rush to withdraw the deposits.

 

Desperately, SVB tried to sell the company on Friday, which also was not successful and the authorities stepped in and put the bank under receivership.

 

The crash in the Wall Street was contagious and it spread all over the world, including Indian stock markets. Stocks of major banks and Financial Institutions took the hit worldwide, affecting the investor sentiments.

 

SVB collapse is the second biggest bank failure after Washington Mutual failure in 2008, which was followed by Lehman Brothers and Bear Stearns which triggered a systemic banking crisis and led to collapse of a lot of small and medium banks.

 

Will it trigger another financial crisis?

 

At this point to time, it is not very clear whether it will lead to another financial crisis like 2008.

 

Many reasons for it:

 

There were a lot of stricter regulations implemented after 2008 crisis, especially in the case of bigger banks, including capital adequacy.

 

Secondly, SVB was more focussed on Tech and start-ups.

 

Thirdly, even though the SVB was the 16^th biggest bank in USA, it was still a smaller bank compared to other big banks. So its reach and influence was limited to that extent only.

 

As the regulatory oversight was less in the case of SVB and capital adequacy norms were not stringent, SVB could invest aggressively without keeping adequate  reserves to tackle this kind of situations.

 

So, most analysts think that this will not have a cascading effect on the economy. But certainly, it is a wake up call for banks like SVB whose deposit base and business are not adequately diversified.

 

Is it a failure of the Federal Reserve?

 

Some analysts think Federal Reserve miscalculated the impact of rising interest rates and so these are self-inflicted damages. If more banks are going to be failed, then situation will be very tough and Federal Reserve may be forced to reduce the interest rates.

 

So, who will be hurt most by the SVB crisis?

 

1.    Uninsured depositors of SVB. Reports say 90% of the $ 175 Billion deposits are un-insured.

2.    Investors of SVB

3.    Investors who suffered losses due to sudden crash of indices world over. Sensex lost nearly 1450 points in just 2 days.

4.    Tech and Startup customers of SVB

 

Conclusion

 

Even though SVB may not trigger another global financial crisis, it caused huge loss to depositors and innocent investors. But it is a lesson to all that any big corporates can collapse any time, if not governed properly. It took only 44 hours to a banking behemoth like Silicon Valley Bank to collapse like a pack of cards.

Should we, CA’s, ask for due date extension?

Should we, CA’s, ask for due date extension?

Remember when we filed the salary returns by June 30 and non-audit returns by July 31 and Tax Audit returns by Sept 30?

That time the accounts were all manual. Tallying the TB was the biggest challenge. We used to prepare final accounts with pencil and paper.

We had no 26AS, we had to get physical Form 16/16A,

We had to go to IT office and get the return forms  and challans from there, at time, we had to carry a request letter in our letterhead to get the forms!

We had to write the income tax returns by hand, attach final accounts and TDS certificates and physically file them before 5:00 PM. Remember how we did the comparison of figures with the draft and the type written one and made corrections with white ink and black pen!

At times, we used to keep a staff  in the queue at the IT office and others will shuttle between our office and IT office with filled up returns. Remember we did not have this much travel facilities that time.

And, we had to run to the bank several times to pay the taxes, that too before the banking time.

Still we managed to file most of the returns within due date!

Now compare the above with the current scenario.

TB tallying is only a nostalgic memory! ☺️

We can even get the Final accounts itself from the software. We can export it into the return filing software and get the return prepared.

We do not even need to remember the tax rate or surcharge applicability or rules of loss carried forward etc.

All will be taken care by the software.

Who is even opening the Income Ready Reckoner now?😜

We will get the TDS details and most of the income particulars from the Portal itself. We just need to download the same into our software.

We do not have to go to Bank to pay the tax

We do not have to go to IT office to file the ITR

We can even file the ITR upto 11:59 PM!

But, our client delivers the accounts at the last day only!☹️

What should you say to a salaried employee who gives you the Form 16 on 30th or 31st, where he must have got it at least 45 days before? Above all, he will be having share trading which he has not disclosed to us.

I do agree the intricacies and complexities of the business are increased manifold. But the facilities available to the clients also improved proportionately.

He has all other information in his figure tips. He will even teach us the income tax  and GST law. Everything is available to him through Internet.

It is sheer irresponsibility and don’t care attitude from the side of the client is the issue in most of the case. Now the responsibility of filing of return is CA’s responsibility, not theirs.

Rather, over the period, we made them think like that.😫

But the core fact is, the importance given by the businessman to the accounts have reduced over time and the responsibility and accountability have been very conveniently and subtly, shifted to our shoulder. And the respect given to our advices and directions also reduced.

Earlier, how they used to do the bank reconciliation from the manual bank passbook? How did they do the intra group reco? How did they do the customer / vendor reco? All these were done then also, in that paper – pencil era also. Now what prevents them from doing the same in time now, in this era of digital accounts and mobile & e-mail communication facilities?

And no client or trade bodies is bothered at all about all these. Only we, CA’s beg for extension. Why should we do so, when the delay is from the client side?

This is exactly what Gujrat High Court asked last year. Why CA’s only have this request, why trade associations not bothered?

Okay, if the delay is from our office, then we can’t blame IT department or client for that.☹️ Other than that, why should we take all the blame and responsibility on our shoulder?

I do agree that the client has so many other issues like complicated tax laws, changed business environment, increased competition et al. But they have equally beneficial opportunities also.

Secondly, the department also made them like that. Earlier there was an additional income tax if there is a tax demand. Interest rates were higher, there was more scrutiny. Now the assessee is the KING. 😳

Yes, the client has to learn good manners and discipline. (We also)☺️

Are you a director of a private limited company having a website?

 Are you a director of a private limited company having a website?

 Here are 3 disclosures that are mandatory else you may face dire penal consequences.

 

1.     Contact details on Home/Landing Page

a)     Name

b)    CIN

c)     Regd  Office Address

d)    Contact No., Name & Email of person to contact for grievances

 

2.     Notice of Shareholder Meeting (AGM & EGM)

Every Co. has to hold AGM (Annual General Meeting) every year for adopting financials etc. EGM is held on need basis. Notices of meetings are mandatorily required to be uploaded on website.

 

3.     Annual Return of the Company

Annual Return (Form MGT-7/7A) which is required to be filed with ROC (Registrar of Companies) every year is also required to be uploaded on website.

 

4.     Resignation of a Director

The fact of "Resignation of a Director" needs to be put up on the website within 30 days.

The above disclosures were mandatory website disclosures that apply to all companies irrespective of their type & size.

 

5.     Penalty for violation of the above:

		Penalty on Company			Penalty on each director
	Violation	Flat Amount	Variable Penalty per day	Maximum Limit	Flat Amount	Variable Penalty per day	Maximum Limit
1	Contact details NOT on Home/Landing Page	Nil	1000/-	1 lakh	Nil	1000/-	1 lakh
2	Notice of Shareholder Meeting NOT on website	10,000/-	1000/-	2 Lakhs	10,000/-	1000/-	50,000/-
3	Annual Return of the Company NOT on website	5,000/-	500/-	No Limit	5,000/-	500/-	No Limit
4	Resignation of Director NOT on website	10,000/-	1,000/-	2 lakhs	10,000/-	1,000/-	50,000/-

 

6.     Related Provisions

 

Sec 12 read with Rule 26 of Incorporation Rules

Sec 101 read with Rule 18 of Management & administration Rules

Sec 92

Sec 168 read with Rule 15 of Appointment & Qualification of Director Rules