The Missing Link in Intellectual Property Law
Abstract
Data has emerged as an important economic asset, but there is no specific intellectual property regime to protect data in India. Current laws like copyright, patents, trade secrets and the Digital Personal Data Protection Act, 2023 offer only fragmented protection. This article examines the gaps in Indian legal architecture; discusses the intersection of intellectual property and privacy law; and argues for a balanced sui generis framework to safeguard valuable datasets and spur innovation.
Introduction
In 2006, economists declared oil to be the most important resource in the world, and in 2017, they changed their minds and called data the most important resource in the world. Which is true in today’s world of technology, from big companies like Apple and Google to small startups; everyone needs data, and they use it to create it. But here is the paradox: data has no dedicated IP protection in India. A company can spend crores collecting, curating, and structuring a dataset, and a competitor can walk in and copy it, and the law offers no clear remedy.
What kind of IP protection for data does Indian law provide?
Data can be protected through copyright law, but there is a catch that data should come under literary work, and it will only be possible if the data possesses a creative arrangement or selection; raw datasets simply cannot be protected through copyright law in India.
Second, patent law in India patent law does not protect data at all. Because data is not an invention in itself. Section 3(k)indian patent act 1970 excludes mathematical methods, business methods, and computer programs per se from patentability.
The most accessible way to acquire IP protection for data in India is through a trade secret, and that’s also partially the case. A company can try to protect it by claiming it’s confidential information, but it can be protected only from those who have signed an NDA.
DPDP Act 2023
The DPDP Act is India’s first crucial step towards data protection. The Digital Personal Data Protection Act was passed by parliament on August 11, 2023. The DPDP Rules were published on 13 November 2025, bringing the enforcement framework into force.
It is a cornerstone of laws related to data protection, but it protects data privacy, not data ownership, as IP does. There is a difference
- Privacy law asks: Can this company collect and use my personal data? It gives individuals rights over their own data — the right to consent, correct, and erase.
- IP law asks: who owns the economic value created by this data? It gives creators and collectors exclusive rights to exploit their work commercially.
Although the DPDP Act clarifies privacy rights, it also creates new legal questions where privacy intersects with intellectual property. Some of the most significant conflicts are discussed below.
Key conflicts
Withdrawal of consent vs. IP ownership:
An AI model based on personal data has been developed by a company. The principal withdraws their consent regarding the use of their data according to the DPDP Act and asks for its erasure. However, that model, which is an IP asset, was developed based on that data. Is it possible to continue operating the model? Would the erasure of the data destroy the model? There is no legal answer to that question.
Database copyright vs. right to erasure:
A company develops a database with customer preferences and registers copyright over it since it is considered to be a creative compilation. Then one of the customers invokes their right to erase according to the DPDP Act. In such a case, whose right will prevail? Will the copyright give the right to keep using the database?
Ownership Over Aggregated Non-Personal Data
Under the DPDP Act, there is a framework where the protection of personal data is achieved through a consent regime. Yet, the status of aggregated and anonymized non-personal data is still unclear. The National Strategy for Artificial Intelligence has made a recommendation that some government datasets be made available to the general public as well as the need to share high-value datasets in the public interest. In the case where business organizations will be required to make aggregated non-personal data public, a pertinent question that arises is whether the process of mandatory disclosure would affect the commercial value of the datasets collected with great effort.
There is no sui generis property right under Indian law regarding datasets similar to the rights granted to patents or copyright. Companies putting a lot of resources into the collection and organization of non-personal data will end up without sufficient legal protection in case of any mandatory disclosure in the public interest.
Critical analysis
India’s intellectual property architecture is not keeping pace with the rising economic value of data. No one can copyright facts or raw data. Copyright only protects the creative selection or arrangement of data. Under patent law, the data itself cannot be patented, and trade secret protection applies only to confidential information and provides no remedy if the data is made public. Therefore, companies that invest considerable time and money in the collection, structuring and analysis of data are still at risk of lawful copying by competitors.
The Digital Personal Data Protection (DPDP) Act, 2023, is a landmark legislation but deals mainly with privacy of an individual and not ownership or commercial rights in data. This leads to ambiguity where privacy rights conflict with intellectual property interests.
India should consider introducing a balanced sui generis database protection framework, drawing guidance from the EU Database Directive (96/9/EC) and the EU Data Act, 2023. Protection should extend only to databases involving substantial investment in collecting, verifying, or presenting data, not to raw facts themselves. The framework could provide a limited term of protection with exceptions for research, education, interoperability, and public interest. Such a regime would encourage innovation and investment while preventing monopolisation of information and filling the existing gap between data protection and intellectual property law.
Conclusion
India’s existing legal framework copyright, patents, trade secrets, and the DPDP Act offers only fragmented protection for data as IP. DPDP Act, 2023 may be viewed as a major milestone in protecting personal data in India, but it addresses privacy and not ownership or any kind of use for commercial purposes. With the development of artificial intelligence and data-related technologies, India would have to address issues associated with the use of data as AI training material and database rights as well as data ownership other than personal data. The country needs to go beyond the fragmented regime and develop a balanced legal system that would ensure adequate protection of data investment without creating obstacles for innovations and competition in the data market.
References
Maheshwari & Co., Intellectual Property Rights, https://www.maheshwariandco.com/blog/intellectual-property-rights/(last visited June 25, 2026).
a Tyagi, Data Protection: Personal Data as Intellectual Property, Int’l J.L. Legal Rsch., https://www.ijllr.com/post/data-protection-personal-data-as-intellectual-property (last visited June 25, 2026).
Where Data Meets IP, Data Protection Rep. (Sept. 2021), https://www.dataprotectionreport.com/2021/09/where-data-meets-ip/.
WIPO, Frontier Technologies: Data, https://www.wipo.int/en/web/frontier-technologies/data (last visited June 25, 2026).
Digital Personal Data Protection Act, No. 22 of 2023 (India), https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf.
Council Directive 96/9, 1996 O.J. (L 77) 20 (EC).https://digital-strategy.ec.europa.eu/en/policies/protection-databases?utm_source=chatgpt.com
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on Harmonised Rules on Fair Access to and Use of Data and Amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act), 2023 O.J. (L 2023/2854) 1.https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1706794291234&uri=CELEX%3A32023R2854&utm_source=chatgpt.com