The notification of the Digital Personal Data Protection Rules 2025 represents a decisive shift in India’s data privacy and governance landscape, operationalising the Digital Personal Data Protection Act 2023 and establishing a comprehensive framework for how organisations must collect, process, store, retain, and share digital personal data. The Rules introduce stringent expectations around consent management, user rights enablement, breach notification, cross-border data transfers, vendor oversight, and enhanced security safeguards. For organisations, this is not merely a regulatory change. It is a strategic and operational transformation that requires structured and immediate action. The DPDP Act received Presidential assent on 11 August 2023, and the Rules were officially notified on 13 November 2025, beginning an 18-month phased compliance rollout. [1][2]
Download the Pierag DPDP Act POV: Applicability, Impact and Our Perspective (PDF)
Who Does the DPDP Act Apply To?
The DPDP Act applies in two scenarios. [1] First, processing of digital personal data within India, whether by Indian entities or foreign entities with a physical or digital presence. Second, processing outside India where it is connected to offering goods or services to individuals within India. This extraterritorial scope means any organisation, anywhere in the world, that processes data of Indian residents is potentially subject to the Act. Data processed for personal or domestic purposes and data made publicly available are excluded from scope.
Key Roles: Data Principals, Data Fiduciaries, and Significant Data Fiduciaries
Data Principal is any individual whose personal data is being processed, with rights including access, correction, erasure, withdrawal of consent, and grievance redressal.
Data Fiduciary is any entity that determines the purpose and means of processing personal data. Data Fiduciaries bear the primary compliance obligations under the Act and Rules, including consent management, security safeguards, breach notification, and data retention and erasure. [2]
Significant Data Fiduciary (SDF) is a category designated by the Central Government based on the volume and sensitivity of data processed, potential risk, and national security considerations. SDFs face enhanced obligations including mandatory Data Protection Officers, independent annual audits, and Data Protection Impact Assessments. [2]
Core Compliance Obligations
Consent. Data Fiduciaries must issue a clear, separate consent notice for each specific purpose of data collection. Consent must be freely given, specific, informed, unconditional, and signified through affirmative action. Withdrawal must be as easy as giving consent. [2]
Security safeguards. Organisations must implement appropriate technical and organisational measures to prevent personal data breaches, including maintaining access logs and governance structures appropriate to their scale and risk profile.
Breach notification. When a personal data breach occurs, the Data Fiduciary must notify the Data Protection Board of India and all affected Data Principals within 72 hours of identification. [3] The notification must explain what happened, what data was exposed, potential impact, and remediation steps taken. Failure to notify carries penalties of up to INR 200 crore per incident.
Data retention and erasure. Personal data must be erased once the purpose for which it was collected is fulfilled. Data Fiduciaries must notify Data Principals at least 48 hours before completing erasure.
Children’s data. Processing personal data of individuals under 18 requires verifiable parental consent, with approved verification methods including DigiLocker integration. [3]
Penalties. Violations carry penalties of up to INR 250 crore per instance for Data Fiduciaries and up to INR 10,000 for Data Principals who violate their own obligations. [1]
What Organisations Must Do During the 18-Month Compliance Window?
The phased implementation timelines emphasise the need for early readiness planning to mitigate compliance gaps, reputational risks, and regulatory penalties. Priority actions include conducting enterprise-wide personal data discovery and mapping, redesigning consent and user rights workflows, automating retention and erasure mechanisms, building 72-hour breach response protocols, strengthening audit trails, and formally designating Data Protection Officers where required as an SDF. [4]
As data continues to become central to digital transformation and customer engagement, aligning with the DPDP Rules 2025 will be critical to building trust, ensuring regulatory resilience, and enabling responsible data-driven growth.
Pierag’s Technology Risk Advisory practice supports organisations in assessing DPDP compliance gaps, designing data governance frameworks, and implementing the technical and organisational controls required under the Act and 2025 Rules.
Frequently Asked Questions
When did the DPDP Act come into force?
Presidential assent was received on 11 August 2023. The DPDP Rules 2025 were notified on 13 November 2025, beginning an 18-month phased compliance rollout. [1][2]
Does the DPDP Act apply to foreign companies?
Yes. The Act applies extraterritorially to any entity processing digital personal data in connection with offering goods or services to individuals in India. [1]
What is a Significant Data Fiduciary?
A category designated by the Central Government based on data volume, sensitivity, and associated risk. SDFs must appoint Data Protection Officers, conduct independent audits, and perform Data Protection Impact Assessments. [2]
What are the penalties for non-compliance?
Up to INR 250 crore per instance for Data Fiduciaries. Failure to notify a breach within 72 hours carries penalties of up to INR 200 crore per incident. [1][3]
References
[1] University of Arizona, Privacy Office. (2023). India Digital Personal Data Protection Act: Overview, applicability and penalties. Retrieved from https://privacy.arizona.edu/international-data-privacy/india-digital-personal-data-protection-act-dpdp-act
[2] Lexology. (2025, December 1). Digital Personal Data Protection Rules 2025: Operationalising consent, security, and governance obligations. Retrieved from https://www.lexology.com/library/detail.aspx?g=7e3af947-10aa-4712-bc1e-54179a613409
[3] Seclore. (2026, March 20). DPDP Rules 2025: India’s complete compliance guide. Retrieved from https://www.seclore.com/fundamentals/dpdp-rules-2025-compliance-guide/
