India’s new data privacy law, the Digital Personal Data Protection Act, 2023 (DPDP), has officially come into force. The government notified the Rules for implementing the law on 14 November 2025, more than two years after it was passed. The law is designed to give citizens greater control over how their personal digital data is collected, stored, and used by companies and organisations.
Under this law, businesses must follow strict rules on consent, transparency, and data security. The implementation will happen in phases, giving companies time to adjust.
A four-member Data Protection Board of India has been set up to monitor compliance, resolve complaints, and handle issues related to personal data.
Deadlines for companies: Within 12 months, businesses must appoint consent managers and start obtaining clear permission from users before collecting their data. Within 18 months, they must put in place systems for consent notices, reporting data breaches, and appointing data protection officers to ensure compliance.
The law also provides extra protection for children. Platforms must get verifiable parental consent before collecting data from children under 18. Tracking children online or targeted advertising aimed at them is restricted.
For cross-border data, personal information can be stored outside India under certain safeguards. Transfers to some countries may be restricted, and stricter rules will apply to large companies handling sensitive data, called “significant data fiduciaries.”
For citizens, the law gives rights to access, correct, update, or delete their personal data. Companies must clearly explain how the data is collected and used.
For businesses, compliance will require updating policies, training staff, and establishing governance systems. While phased deadlines help companies adjust, experts have raised concerns over broad exemptions granted to government agencies.
The law’s success will depend on how effectively citizens and businesses adapt to the new framework in the coming months.
