Worldview Advisory
India

India notifies DPDP Rules to operationalize its personal data protection law

The rules put the Digital Personal Data Protection Act into full effect, setting consent, transparency and security obligations that businesses must meet.

Photo: The Economic Times

What happened

The Government of India has notified the Digital Personal Data Protection Rules, 2025, marking the full operationalization of the DPDP Act, 2023. pib.gov.in The Act sets out obligations for entities handling digital personal data, called Data Fiduciaries, and the rights and duties of individuals, called Data Principals. pib.gov.in The framework is guided by seven core principles, including consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. pib.gov.in Organizations must be transparent about what personal data they collect, why they collect it and how long they keep it. The Economic Times

Around it

Parliament enacted the DPDP Act on 11 August 2023, and the Ministry of Electronics and IT released draft rules for public comment before finalizing them. pib.gov.in The second phase of the DPDP Act is due to begin on 13 November 2026, prompting businesses to prepare for obligations covering consumer data use, data retention, cloud security and data disposal. India Briefing News Commentators describe the law as a structural shift that requires companies to rethink how they value, manage and protect data, comparable in scale to the rollout of GST. The Economic Times A NASSCOM figure cited in coverage indicates that about 87 per cent of enterprises in India use artificial intelligence solutions, raising questions about how AI systems handle personal data under the law. India Briefing News

What comes next

The second phase of the DPDP Act is scheduled to begin on 13 November 2026. India Briefing News

Sources

  1. pib.gov.inGovernment notifies DPDP Rules to empower citizens and protect privacy
  2. India Briefing NewsHow Do India's IT Act and DPDP Act Apply to Businesses Using AI?
  3. The Economic TimesData, a consensual relationship: How India's DPDP Act is forcing companies to rethink trust, transparency and privacy

More from India

Worldview Advisory

Welcome to Worldview Advisory. We're a public affairs and capital markets advisory firm, focused on political risk for asset owners, investors, boards and executives. How can we help?