Government notifies DPDP rules, sets 18-month roadmap for data protection regime

The government on Friday (November 14) notified the much-awaited rules under the Digital Personal Data Protection (DPDP) Act, laying out a staggered implementation roadmap of up to 18 months for India’s new data protection regime.

A key provision of the notified rules relates to data localisation, a move being watched closely by global technology companies.

The rules mandate that large data fiduciaries store certain categories of personal data — as specified by the government — within India. At the same time, the rules permit the transfer of personal data outside India, subject to additional requirements that may be prescribed by the Centre.

Implementation timeline

The rules provide a phased rollout:

1. Immediate effect: Rules governing the setting up and appointment of the Chairperson and members of the Data Protection Board come into force immediately.


2. 12 months: Rules related to the registration and functioning of Consent Managers will take effect after 12 months.


3. 18 months: Core compliance requirements for companies and government entities that collect personal data — including consent notices and operational processes — will become effective after 18 months.

Consent requirements

Entities collecting personal data must provide clear, plain-language notices detailing the data being collected and the purpose of collection. They must also offer a dedicated link for users to withdraw consent.

Consent managers

Individuals or organisations seeking to act as Consent Managers can apply for registration with the Data Protection Board and will be subject to specific obligations under the rules.

Data breaches

Users must be informed of any data breach without delay, with details on the nature of the breach, likely consequences, and recommended safety measures. A detailed breach notification — covering cause, impact and mitigation steps — must be filed with the Data Protection Board within 72 hours.

Data erasure

If a user remains inactive, the data-collecting entity is required to erase the personal data held, after issuing a notice to the user 48 hours prior to deletion.

Children’s data

Entities collecting children’s data must obtain verifiable parental consent. Exemptions from parental consent apply to healthcare establishments, educational institutions and childcare facilities.

Additional compliance for entities handling significant user data

Such entities must conduct a Data Protection Impact Assessment and a compliance audit. They are obliged to ensure that algorithmic software used does not pose risks to users’ rights and must prevent the overseas transfer of personal data categories that the government may prescribe.

Exemptions

The Act does not apply to the processing of personal data necessary for research, archiving or statistical purposes — a move expected to benefit AI development and related research activity.

National security and government powers

For national security purposes, the government may seek personal data from any intermediary or entity and may also prohibit them from informing users about such requests.Read about our editorial guidelines and ethics policy