The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025, giving operational effect to the Digital Personal Data Protection Act, 2023.
Phased commencement
Per the Ministry of Electronics and Information Technology (MeitY) notification G.S.R. 843(E) dated 13 November 2025, the Act's provisions come into force in stages:
- On publication of the notification: section 1(2), section 2, sections 18 to 26, sections 35, 38 to 43, and sub-sections (1) and (3) of section 44 — this includes the provisions relating to the Data Protection Board of India
- After one year: section 6(9) and section 27(1)(d)
- After eighteen months: sections 3 to 5, section 6(1) to (8) and (10), sections 7 to 17, section 27 (except 27(1)(d)), sections 28 to 34, 36, 37 and section 44(2)
PIB describes this as an 18-month phased compliance timeline for organisations to adjust their systems and practices.
What the Rules emphasise (per PIB)
- Standalone, clear consent notices that explain the specific purpose of data collection
- Personal data breach notification to affected individuals in plain language
- Verifiable consent for processing children's personal data, with limited exemptions
- Published contact details for a designated officer or Data Protection Officer
- Enhanced duties for Significant Data Fiduciaries, including independent audits and impact assessments
- Responses to data principal requests within a maximum of 90 days
- A digital-first Data Protection Board, with appeals to TDSAT
Penalties under the Act (per PIB)
PIB states that failure to maintain reasonable security safeguards can attract penalties of up to INR 250 crore; failure to notify a breach or violations relating to children, up to INR 200 crore; and other violations by a Data Fiduciary, up to INR 50 crore.
What foreign companies should do
- Map the personal data your India operations and teams handle
- Review consent notices, vendor contracts and breach processes against the Rules
- Confirm whether any obligations apply to you as a Data Fiduciary or Data Processor, with qualified counsel
Official sources
- MeitY notification G.S.R. 843(E), Gazette of India (Extraordinary), 13 November 2025
- PIB press release, "Government notifies DPDP Rules to empower citizens and protect privacy", 14 November 2025
- PIB explainer, "A Citizen-Centric Framework for Privacy Protection and Responsible Data Use", 17 November 2025
- MeitY: Digital Personal Data Protection Rules 2025 and Enforcement Timeline (meity.gov.in)
Advisory note: This summary reflects the official sources listed above as at the date shown. It is not legal advice, and later notifications or amendments may apply. Confirm the current position with qualified counsel and the official sources.
Advisory note: This article is for general information and awareness purposes only. Inaac Advisors provides advisory and execution support — not legal, tax, or regulatory opinions. Legal, tax, immigration and regulatory conclusions require qualified professional review.
Related Services
Speak with Inaac Advisors
Our practitioners can discuss your India entry requirements and help you assess the right path forward.
Book India Entry Consultation