India’s long-awaited data privacy law, the Digital Personal Data Protection Act, 2023 (DPDP), has finally come into force. The government notified the Rules on 14 November 2025, more than two years after the Act was passed. This move gives citizens greater control over their personal digital data.
Under the law, companies and organisations that handle personal data must follow rules on consent, transparency, and data security. The implementation will happen in phases to allow businesses time to adjust.
A key feature is the creation of a four-member Data Protection Board of India. This board will oversee compliance, handle complaints, and resolve issues related to personal data.
Phased deadlines for companies: Within 12 months, businesses must appoint consent managers and start obtaining clear permission from users before collecting personal data. Within 18 months, they must set up systems for consent notices, reporting data breaches, and appointing data protection officers.
The law also provides extra protection for minors. Platforms must get verifiable parental consent before processing data of children under 18. Targeted advertising or tracking children’s online activity is restricted.
For cross-border data, personal information can be stored outside India under certain safeguards. Transfers may be restricted to some countries, and stricter rules will apply to companies handling large amounts of sensitive data, called “significant data fiduciaries.”
For citizens, the law allows them to access, correct, update, or erase their personal data. Companies must clearly explain how the data is collected and used.
For businesses, compliance will require updating policies, training staff, and setting up governance systems. While phased deadlines give clarity, some experts have raised concerns over broad exemptions granted to government agencies.
The notification of the Rules finally puts India on track with global digital privacy standards.
Also Read: India, Canada partner on critical minerals, green energy
