With the increasing use of cyberspace for business operations, regulation of data protection has become a pertinent issue. The Information Technology Act 2002,though originally not intended to cover data protection, filled the legal gap on this aspect for both the individuals and the business entities. The Act has been subjected to amendments to tighten the data protection regime in India. The insertion of Section 43A and the issue of Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 aim to protect sensitive personal information and bring the safeguards at par with international standards. The rules put greater responsibility on the corporates to ensure protection of data which is in their possession. Body corporates will have to implement comprehensive security practices and standards for protection of information assets. Information Technology (Intermediaries Guidelines) Rules, 2011 have spelt out the responsibilities of the intermediaries more clearly. However, there is still a long way to bring the entire data protection regime in India at par with global standards.