There are big changes happening in India’s rules about corporate governance and data protection. The Companies Amendment Bill (cabinet note finalised) and the Digital Personal Data Protection (DPDP) Rules 2025 are two big changes that show the government’s plans to modernize oversight, make people more accountable, and bring India up to date with international standards.
This article explains the changes, what they mean for businesses and professionals, and what needs to be done right away.
1. MCA finishes the Cabinet Note for the Companies Amendment Bill
The Ministry of Corporate Affairs is getting closer to a full rewrite of the Companies Act framework by finishing the cabinet note for the Companies Amendment Bill. The changes that are being suggested are meant to make it easier to follow the rules, make audits more accountable, and open up the professional services sector.
Key Changes Suggested:
a) Multidisciplinary Firms (MDFs)
A big change that lets professional firms offer legal, accounting, bankruptcy, financial, and advisory services all in one place.
This could change the way professionals work together, how they set up their businesses, and even the way they compete with each other.
b) More power for NFRA
The National Financial Reporting Authority may have more power over:
- Reviews of the quality of audits
- Ways to enforce rules and punishments
- Supervision of firms that do statutory audits
- Expect more scrutiny of corporate disclosures, risk reporting, and the work of auditors.
c) Streamlining Governance and Compliance
Even though the details are still coming out, some likely areas are:
- Making independent directors more powerful
- Better timelines and clearer filing instructions
- Changes to the rules for how CSR money can be spent
- Better fit with international standards for audits and audit committees
Why This Is Important?
For businesses and professionals alike:
- More responsibility for financial reporting
- MDFs give you a chance to restructure.
- Boards and audit teams may be more liable.
- Compliance changes across all governance frameworks
2. India announces the Digital Personal Data Protection (DPDP) Rules 2025
The DPDP Rules 2025 make India’s long-awaited data protection system work. They make it clear how to follow the Digital Personal Data Protection Act.
The Rules make privacy, consent, security, retention, and transparency much more important.
Big requirements under the DPDP Rules, are:
a) Clear, informed, and specific consent
There must be a clear affirmative action to get consent.
No pre-checked boxes, bundled consent, or unclear notices.
b) Strong Security Duties
Data Fiduciaries must put into place:
- Encryption
- Controls for access
- Audit trails
- Ways to tell people about a breach
- Periodic assessments of the impact on data protection, when necessary
c) Responsibilities of Individuals (Data Principals)
India’s law uniquely places duties on individuals, including:
- Giving information that is true and real
- Not filing frivolous complaints
- Working together to check your identity (Co-operation in identification verification)
d) Required Deletion After 3 Years of No Activity by the User
Companies must delete inactive user data after 36 months, unless the law or a contract says they have to.
e) A phased 18-month timeline for compliance
India lets people take their time with implementation, unlike instant compliance regimes.
But big companies and platforms that deal with a lot of data should start now.
1. Update privacy and consent documents for lawyers, compliance officers, and bankruptcy professionals
Change your privacy notices, consent screens, internal policies, and client onboarding papers.
2. Do audits of data protection
Look over the data flows, security holes, and contracts with vendors.
3. Set up controls for deleting and keeping data
Set up automated workflows that are based on inactivity thresholds.
4. Measures for insolvency
CIRP and liquidation processes often use large sets of data.
IPs have to:
- Make sure that personal data is handled safely
- Stop illegal storage or transmission
- Make rules for deleting old customer information
Final Thoughts
The Companies Amendment Bill and the DPDP Rules are very important changes to India’s system of government. They work together to push businesses to be more responsible, open, and careful with their data.
This is a good time for lawyers, insolvency professionals, accountants, and compliance officers to rethink their advice strategies and help their clients adjust to the new rules.