Digital Personal Data Protection Rules, 2025 Notified

The Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, turn the 2023 Act into clear, actionable obligations for anyone handling digital personal data.

This framework is India's key legal standard for governing how data is collected, used and protected. It applies to any organization acting as a Data Fiduciary when processing personal data of individuals.

Why This Matters - Compliance is a legal obligation backed by substantial penalties - Controls like encryption, masking, backups and strict access governance are now legal requirements - Full compliance required within 18 months - Clear privacy notices and rights such as access and erasure give individuals more control