DPDP Act Compliance During a Subsidiary's CIRP

During a subsidiary's Corporate Insolvency Resolution Process under the Insolvency and Bankruptcy Code, 2016, the subsidiary itself remains the Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023, with the resolution professional acting for it rather than becoming a fiduciary personally, though the point remains untested in India. Most substantive obligations under the Digital Personal Data Protection Rules, 2025 do not take effect until 13 May 2027, so present exposure is contractual rather than regulatory, but a resolution plan concluded before then hands the data estate to a transferee bound by the full regime. This post covers notice, consent, erasure, and breach duties for the parent.

What Is Actually in Force, and From What Date

Precision matters here because a good deal of commentary treats the Digital Personal Data Protection Act, 2023 (the DPDP Act) as though it has bound Indian companies since 2023. It has not. The Act received Presidential assent on 11 August 2023, but section 1(2) left commencement to notification and no substantive obligation arose on assent. The operative framework arrived with the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, which carry a staged commencement. Rules 1, 2 and 17 to 21, standing up the Data Protection Board and its procedure, took effect on publication. Rule 4, on registration of consent managers, takes effect one year after publication. Rules 3, 5 to 16, 22 and 23, which carry the working compliance architecture of notice, security safeguards, breach reporting, retention and erasure, children's data and the duties of Significant Data Fiduciaries, take effect eighteen months after publication, on 13 May 2027.

Two consequences follow for a process running today. The enforcement machinery for most substantive obligations is not yet switched on, so immediate exposure is contractual and reputational rather than regulatory. But a CIRP admitted now can easily still be alive in 2027, and a resolution plan implemented before then hands a data estate to a transferee who will hold it under the full regime. Building the plan around the position as at assent is a mistake with a known expiry date.

Who Is the Data Fiduciary Once the Board Is Suspended?

Section 2(i) of the DPDP Act defines a Data Fiduciary as any person who alone or in conjunction with other persons determines the purpose and means of processing personal data. Section 17 of the Code provides that from the insolvency commencement date the management of the corporate debtor vests in the interim resolution professional, the powers of the board of directors stand suspended and are exercised by him, and the officers and managers of the company report to him; section 23 carries that position forward through the resolution professional's tenure. Set the two provisions side by side and the question writes itself. If the person now determining purpose and means is the resolution professional, has the Data Fiduciary changed?

The Better View, and Why It Is Only a View

The better view is that the corporate debtor remains the Data Fiduciary and the resolution professional is the person through whom it acts, in the way a board acts for a company without itself becoming the fiduciary. Corporate personality is untouched by admission. Section 17 redistributes internal authority; it does not manufacture a new controller of data. That is a reasoned position rather than a settled one. No Indian court or tribunal has decided it, the Data Protection Board has not addressed it, and neither statute cross-refers to the other. Counsel advising a parent board should present it that way and record the reasoning.

The nearest authority on the character of the office is Swiss Ribbons Pvt. Ltd. v. Union of India [(2019) 4 SCC 17]. Upholding the constitutional validity of the Code, the Supreme Court described the resolution professional in deliberately narrow terms: administrative rather than quasi-judicial powers, a duty to receive, collate and verify claims, no power to reject a claim, with adjudication reserved to the tribunal. The judgment says nothing whatever about data protection and should not be cited as though it did. What it supports is the characterisation of the resolution professional as a functionary running an enterprise under statutory duties rather than a principal in his own right, and that characterisation is what keeps the Data Fiduciary label on the company.

Is the Resolution Professional Personally on the Hook?

Section 25 requires the resolution professional to preserve and protect the assets of the corporate debtor and to keep its operations running as a going concern, and section 25(2)(a) requires him to take immediate custody and control of its assets, which includes its records. Reading those duties as importing personal liability for data protection compliance goes further than the text allows. The penalties in the Schedule to the DPDP Act, which run to Rs 250 crore for failure to implement reasonable security safeguards and Rs 200 crore for failure to give breach intimation, are imposed on the Data Fiduciary, and the Act carries no officer-in-default mechanism of the sort familiar from the Companies Act, 2013. Nor should any general immunity be assumed in the other direction: the Code confers no blanket protection on a resolution professional against liability arising under other legislation, and an insolvency professional who knowingly lets a notification obligation lapse invites disciplinary action from the Insolvency and Bankruptcy Board of India even where the monetary penalty lands on the company.

Transferring the Data Estate Under a Plan or a Slump Sale

Personal data is often the most valuable thing a distressed consumer-facing business owns, and resolution plans routinely transfer it without a line on the lawful basis. Section 31(1) of the Code makes an approved plan binding on the corporate debtor, its creditors and other stakeholders, and that binding effect is frequently assumed to sanitise everything inside the plan. It does no such thing across statutory boundaries. Data principals are not creditors, their consent is not a claim capable of extinguishment under section 31(6), and a tribunal approving a plan is not adjudicating on the lawfulness of processing.

Is Fresh Consent Required From Data Principals?

Nobody knows yet, and the analysis has to begin from the closed structure of the DPDP Act. Processing is lawful on consent under section 6 or on one of the legitimate uses in section 7, and section 7 is an exhaustive list that does not include corporate reorganisation or business transfer. There is no Indian counterpart to the legitimate interests basis that carries most European transaction processing. The workable argument is that where the transferee continues the same processing for the same specified purpose, the original consent survives, because the purpose has not changed and the identity of the fiduciary was not the object of the consent. That argument is untested. The conservative course, and one a resolution applicant should be asked to accept in the plan itself, is fresh notice to data principals under section 5 on completion, purpose limitation written into the plan, and a contractual undertaking against repurposing.

Cross-Border Transfer Where the Acquirer Is Foreign

Section 16(1) permits the Central Government to restrict transfer of personal data to countries it notifies, and the Rules attach conditions to making personal data available outside India. Sectoral requirements survive alongside: section 16(2) preserves higher standards imposed by other law, so Reserve Bank of India directions on storage of payment system data continue to apply whatever the plan says. A foreign resolution applicant intending to migrate the estate onto offshore infrastructure should be asked for its hosting map during diligence rather than after approval, because a hosting change that breaches a sectoral requirement is a failure of plan implementation and not a compliance footnote.

Erasure Against Record Preservation: The Conflict Nobody Has Reconciled

Section 8(7) of the DPDP Act requires a Data Fiduciary to erase personal data on withdrawal of consent, or once the specified purpose is no longer being served, unless retention is necessary for compliance with law. Regulation 39A of the IBBI (Insolvency Resolution Process for Corporate Persons) Regulations, 2016 pulls hard in the opposite direction, requiring the interim resolution professional or resolution professional to preserve records giving a complete account of the process, electronically for at least eight years and physically for at least three years from completion, at a secure place and available for production. Claim forms, employee dues workings, homebuyer and customer claim annexures and creditor correspondence are dense with personal data.

The conflict is narrower than it first appears, since the erasure obligation carries an express carve-out for retention necessary for legal compliance and Regulation 39A is exactly that. It is narrowed, not removed, and two operational points follow. The carve-out justifies retaining the process record, not the corporate debtor's entire live operational database, so somebody has to draw the boundary between the two, and a resolution professional will not draw it unprompted. And retention under a carve-out is not a licence to use: process records held for eight years should be segregated, access-controlled and kept out of any system the transferee operates commercially. Recording that reasoning while the process is running costs almost nothing and is far harder to reconstruct later.

Breach Notification While the IT Function Is Falling Apart

Section 8(6) requires intimation of a personal data breach to the Board and to each affected Data Principal, with the Rules prescribing an immediate initial intimation followed by a detailed report within seventy-two hours. Nothing in the Code suspends that clock. A CIRP is precisely when breach risk peaks: security staff resign, tooling licences lapse because the vendor has not been paid, credentials of departed employees are never revoked, and there is often nobody with clear authority to sign a regulatory notification. The realistic exposure for a parent is that the subsidiary misses the window and the parent learns of the incident from a customer or a journalist.

Where the Parent Sits, and What It Should Be Tracking

A parent is not automatically answerable for its subsidiary's processing. It becomes exposed on its own account in three situations common in Indian groups. Where it runs the group customer relationship system, human resources platform or cloud tenancy, it is determining the means of processing for subsidiary data and is a Data Fiduciary in its own right, or jointly with the subsidiary. Where it acts as a processor under a group services arrangement, the subsidiary's obligations have to be reflected in a contract that the resolution professional inherits and may decline to fund. And where group data is commingled in shared systems, a transfer of the subsidiary's data under a plan cannot be executed without touching the parent's own records.

Obligation	Responsible during CIRP	Conflict with the Code	Practical step for the parent
Notice and consent (sections 5 and 6)	The subsidiary as Data Fiduciary, acting through the resolution professional	No direct conflict, but nothing in section 25 mandates a consent refresh	Extract and hold a copy of the consent and notice records before admission risk crystallises
Security safeguards (section 8(5))	Subsidiary through the resolution professional; degradation is the live risk	Security spend competes with other insolvency resolution process costs	Offer to fund or host critical controls under a written arrangement placed before the committee of creditors
Breach intimation (section 8(6))	Subsidiary; in practice the resolution professional signs	Nothing in the Code suspends the seventy-two hour reporting clock	Agree an escalation contact and hand over a notification template; do not assume the obligation is known
Erasure (section 8(7))	Subsidiary through the resolution professional	Regulation 39A requires eight years electronic and three years physical preservation	Insist on a written line between process records and live operational data, with the basis for each recorded
Transfer of data under a plan	Resolution applicant and resolution professional jointly	Section 31(1) binds stakeholders but supplies no lawful basis for processing	Ask for plan wording on purpose limitation, fresh notice on completion and a no-repurposing undertaking
Cross-border transfer (section 16)	The transferee, from completion	None, though a sectoral localisation requirement can block a plan step	Obtain the acquirer's hosting map during diligence, before the plan is filed

One further item deserves a named owner inside the parent. Where the parent processes on the subsidiary's behalf, the group services agreement should be read for what happens on admission: whether the resolution professional can terminate it, whether the parent can suspend service for non-payment without leaving the subsidiary in breach of its own security obligations, and whether the parent has a contractual right to extract and delete subsidiary data on exit. Those clauses are usually missing from intra-group paperwork, and a CIRP is a poor moment to find that out.

Frequently Asked Questions

Do data protection obligations pause when a subsidiary is admitted to CIRP?

No. The moratorium under section 14 of the Code stops proceedings and enforcement against the corporate debtor; it does not suspend statutory compliance obligations owed to regulators or individuals. What changes is who discharges them, not whether they exist.

Who is the Data Fiduciary once the board is suspended under section 17?

The point is untested in India. The better analysis is that the company remains the Data Fiduciary under section 2(i) of the DPDP Act and the resolution professional acts for it, because section 17 of the Code redistributes internal authority without altering corporate personality. Treat that as a reasoned position to be recorded in the board papers, not as settled law.

Can a resolution professional be personally penalised under the DPDP Act?

The penalties in the Schedule are directed at the Data Fiduciary, and the Act has no officer-in-default provision, so on the face of it the company bears them. That does not make the resolution professional indifferent: regulatory default during his tenure is a disciplinary matter before the Insolvency and Bankruptcy Board of India, and the Code gives him no immunity from other statutes.

Does a resolution plan transferring customer data need fresh consent?

There is no ruling on it. Section 7 of the DPDP Act lists legitimate uses exhaustively and business transfer is not among them, so consent remains the operative basis. The defensible argument is that consent survives where the purpose is unchanged, and the safer course is to require fresh notice under section 5 on completion together with purpose limitation in the plan.

How should an erasure request be handled when the Code requires records to be kept?

Section 8(7) itself allows retention necessary for compliance with law, and Regulation 39A of the CIRP Regulations is such a law. Use the carve-out for the process record only, erase or restrict the rest, segregate what is retained, and write down the basis at the time rather than reconstructing it years later.

What should the parent do in the first fortnight after admission?

Write to the resolution professional identifying the personal data the subsidiary holds and the systems it sits on, state which of them the parent operates, ask for a single named contact for security incidents, and confirm in writing whether group services continue and on what payment terms. Doing this early also protects the parent's position if a breach later occurs on shared infrastructure.

When do the substantive obligations under the Digital Personal Data Protection Rules, 2025 actually take effect?

In stages. Rules setting up the Data Protection Board took effect on publication on 13 November 2025. Consent manager registration under Rule 4 takes effect one year later. The working compliance architecture, covering notice, security safeguards, breach reporting, retention, erasure and Significant Data Fiduciary duties, takes effect eighteen months after publication, on 13 May 2027.

Is the parent company itself a Data Fiduciary for its subsidiary's personal data?

Only where it determines the purpose and means of that processing. A parent that operates the group's customer relationship system, human resources platform, or cloud tenancy on the subsidiary's behalf is a Data Fiduciary, or joint Data Fiduciary, in its own right under Section 2(i) of the DPDP Act, independent of whatever happens in the subsidiary's CIRP.

What is the deadline for reporting a personal data breach during a subsidiary's CIRP?

Section 8(6) of the DPDP Act requires intimation to the Data Protection Board and affected Data Principals, and the Rules prescribe an immediate initial intimation followed by a detailed report within seventy-two hours of becoming aware of the breach. Nothing in the Insolvency and Bankruptcy Code, 2016 extends or suspends that clock during CIRP, so the resolution professional needs a named contact able to act on short notice even while other functions are being wound down.

Does the DPDP Act apply when a foreign resolution applicant acquires an Indian subsidiary's data estate?

Yes. The DPDP Act governs processing of personal data within India and processing outside India connected to offering goods or services to persons in India. A foreign acquirer taking over the data estate through a resolution plan becomes the Data Fiduciary from completion and is bound by the Act regardless of where it is incorporated.

What penalties can apply to a Data Fiduciary under the DPDP Act's Schedule?

The Schedule to the DPDP Act sets penalties running up to Rs 250 crore for failing to implement reasonable security safeguards and up to Rs 200 crore for failing to give breach intimation, among other specified defaults. These penalties attach to the Data Fiduciary, which during CIRP remains the corporate debtor rather than the resolution professional personally.

Can a resolution professional face consequences if a data breach occurs because IT security lapsed during CIRP?

The monetary penalty under the DPDP Act's Schedule falls on the corporate debtor as Data Fiduciary, not the resolution professional personally. But a resolution professional who lets security safeguards or notification duties lapse without reasonable cause risks disciplinary proceedings before the Insolvency and Bankruptcy Board of India for failing the duty under Section 25 of the Code to preserve and protect the corporate debtor's assets.

What should a resolution plan include to address data protection risk before it is approved?

A well-drafted plan should specify the lawful basis for continued processing after transfer, commit the resolution applicant to fresh notice under Section 5 of the DPDP Act on completion, restrict repurposing of the data beyond its original specified purpose, and address the hosting location for any cross-border transfer under Section 16, particularly where sectoral rules such as Reserve Bank of India data localisation directions apply.

Vikrant D. Shetty | Vikrant D. Shetty leads the Insolvency, Corporate and Commercial Practice at the Mumbai-based law firm Vikrant D. Shetty & Associates, Advocates & Solicitors, which advises holding companies, financial creditors and corporate debtors in proceedings before the National Company Law Tribunal (NCLT), Mumbai Bench, and advises Indian and international clients on regulatory compliance, group services arrangements and commercial contracts.

Related reading: Can Directors Be Personally Liable for a Company's Unpaid Tax Dues.

This article is for general informational purposes only and does not constitute legal advice. For advice specific to your situation, please seek direct consultation with an advocate.