The DPDP Act and Evidence Collection: Balancing Privacy with Proof

The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection statute. It applies to any processing of digital personal data within India, and that includes the acquisition, storage and production of digital evidence. Forensic practitioners, in-house legal teams and litigators now need to answer a question they could previously ignore: on what basis are we holding this data?

The core obligations

The Act treats the organisation deciding why and how personal data is processed as a Data Fiduciary. Fiduciaries must process data only for a lawful purpose, with consent or under a recognised legitimate use, must limit collection to what the purpose requires, must keep the data accurate and secure, and must erase it once the purpose is served.

Where evidence collection fits

Section 7 of the Act lists legitimate uses for which consent is not required, including compliance with any judgment, decree or order. Section 17 goes further and exempts processing that is necessary for enforcing a legal right or claim, processing by courts and tribunals in the exercise of their functions, and processing for the prevention, detection or investigation of offences.

These provisions mean that collecting evidence for a genuine dispute is lawful without the consent of the people whose data appears in it. They do not mean that anything goes. The exemption covers what is necessary, and necessity has to be demonstrated.

Practical rules for evidence teams

Scope the acquisition

Define the matter, the custodians and the date range before collecting anything. Acquiring an entire mailbox to find three emails is difficult to defend as necessary. Where a full device image is unavoidable, record why, and restrict examination to the relevant scope.

Record the legal basis

Each acquisition in the custody log should state the legitimate use or exemption relied upon and the proceeding it relates to. If the dispute is anticipated rather than filed, note the facts that make it reasonably likely.

Secure the data

The Act requires reasonable security safeguards and imposes significant penalties for breaches. Evidence repositories should be encrypted at rest, access-controlled and logged. A forensic archive that leaks is both a data breach and a spoliation risk.

Plan for erasure

Once the matter concludes and appeal periods expire, the legitimate use ends. Retention policies should specify when evidence is returned, destroyed or anonymised, and the custody log should record that final step.

• Which proceeding or legal claim does this collection support?
• Which custodians and date ranges are genuinely necessary?
• Where will the data be stored, who can access it, and how is access logged?
• When and how will the data be erased once the matter ends?

The DPDP Act does not stop anyone from proving their case. It asks that proof be gathered with the same discipline that courts already expect: a clear purpose, a limited scope and a documented trail. Teams that have those habits will find compliance is largely a matter of writing down what they already do.