Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{198457,
        author = {Pallavi Dixit and Dr. Juhi Saxena},
        title = {Data Protection Responsibilities of Corporations in India: Evaluating Compliance Frameworks and Enforcement Gaps.”},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {11},
        pages = {8492-8504},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=198457},
        abstract = {The rapid expansion of digital technologies and data-driven business practices in India has significantly heightened concerns regarding the protection of personal data and the responsibilities of corporations managing such information. This research paper critically examines the data protection responsibilities of corporations in India, with a specific focus on evaluating existing compliance frameworks and identifying enforcement gaps within the legal regime.
The study traces the evolution of India’s data protection framework from the Information Technology Act, 2000 to the more comprehensive Digital Personal Data Protection Act, 2023, highlighting the transition from a negligence-based liability model to a structured, compliance-oriented framework emphasizing corporate accountability. It analyses key principles such as due diligence, data governance, and fiduciary obligations, while assessing the extent to which corporations are required to ensure transparency, security, and lawful processing of personal data.
Further, the paper identifies critical challenges affecting the effectiveness of these frameworks, including ambiguities in regulatory provisions, limited institutional capacity, compliance burdens on organizations, and delays in breach detection and reporting. Particular attention is given to enforcement gaps, such as the absence of well-defined procedural mechanisms, inconsistencies in regulatory oversight, and the evolving role of enforcement authorities.
Through doctrinal analysis, supported by case law and comparative insights from international data protection regimes, the research evaluates whether the current legal framework adequately ensures corporate accountability. The study finds that while the Digital Personal Data Protection Act, 2023 marks a significant advancement in strengthening compliance obligations, its success largely depends on effective enforcement, regulatory clarity, and institutional preparedness.
The paper concludes by recommending measures to bridge enforcement gaps, enhance compliance mechanisms, and foster a proactive approach to data governance. It argues that meaningful corporate responsibility in data protection requires not only adherence to statutory obligations but also the integration of accountability and risk management practices within organizational structures.},
        keywords = {Corporate Data Protection, Corporate Responsibility, Data Breach, Compliance Frameworks, Enforcement Gaps, Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, Data Governance},
        month = {April},
        }