A law arriving in stages

The Digital Personal Data Protection Act, 2023, read with the Rules notified on 13 November 2025, governs how every organisation collects, uses, stores and shares personal data in digital form. It is not a sectoral circular or a voluntary standard. It is a law of general application, with its own regulator, the Data Protection Board of India, and its own schedule of penalties.

• 11 Aug 2023The Act receives Presidential assent. The Digital Personal Data Protection Act, 2023 is passed and receives Presidential assent.
• 13 Nov 2025Rules notified. Rules for the Act are notified. Provisions establishing the Data Protection Board come into force.
• 13 Nov 2026The Consent Manager framework opens. The Consent Manager framework comes into force, with key operational provisions starting.
• 13 May 2027Full enforcement. Notice, consent, security, breach reporting, individual rights and the remaining duties become enforceable.

Prudent planning treats that date as the outer limit, not the target.

What the law requires of you

Ten duties fall on every Data Fiduciary, whatever its size or sector, stated here in ordinary language.

• 01. Tell people plainlyGive a clear, itemised notice of what you collect and why, readable in English or a scheduled Indian language.
• 02. Ask properlyConsent must be free, specific, informed and given by a clear affirmative act. Withdrawing it must be as easy as giving it.
• 03. Keep to the purposeUse the data only for what was stated. Erase it once that purpose is served, unless another law requires retention.
• 04. Secure itEncryption or masking, access controls, logging and backups, with logs kept for at least a year. The heaviest-penalty duty.
• 05. Report every breachInform each affected individual and the Board without delay, and file a detailed report within 72 hours. No materiality threshold.
• 06. Answer individualsPeople may ask to see, correct or erase their data. Publish a grievance channel and resolve complaints within 90 days.
• 07. Bind your vendorsA processor may be engaged only under a valid contract. You remain answerable for the data it handles.
• 08. Protect childrenFor anyone under 18, obtain verifiable parental consent. Tracking and targeted advertising to children are prohibited.
• 09. Regularise old dataWhere data was collected before the Act, a compliant notice must now be issued as soon as reasonably practicable.
• 10. Watch transfers abroadPermitted, except to countries the Government restricts, and subject to conditions it may impose.