Introduction
India is on the cusp of a major shift in its data governance landscape. The country’s long-awaited Digital Personal Data Protection (DPDP) Act, 2023, its first comprehensive data privacy law, is set to be notified within days, according to Union IT Minister Ashwini Vaishnaw. Speaking on September 18, the Minister confirmed that the DPDP Rules, 2025, have been finalised after extensive stakeholder consultations and will be formally released by September 28, 2025. This announcement follows the Ministry of Electronics and Information Technology’s (MeitY) official update on July 28, which confirmed the closure of the public consultation process that received an unprecedented 6,915 responses.
The cautious and deliberate approach to drafting reflects the government’s effort to balance business concerns, user rights, and the need for a strong enforcement framework. Once notified, the DPDP regime will move India from legislative intent to enforceable obligations, creating clear rules on consent, data retention, breach reporting, and cross-border transfers. Alongside, it will provide much-needed clarity on the powers of the Data Protection Board of India and the compliance obligations for entities classified as Significant Data Fiduciaries.
This development is not just a legislative milestone but also a business imperative. For companies operating in India’s digital economy, the DPDP framework marks a decisive transition to structured privacy compliance, requiring proactive implementation of consent systems, privacy by design, data audits, and breach readiness. In this article, we unpack the key changes businesses must prepare for under the DPDP Act and the forthcoming 2025 Rules.
Digital Personal Data Protection Act, 2023:
It emerged from the Supreme Court's 2017 recognition of privacy as a fundamental right and aligns with global norms like the EU’s GDPR. The Act applies to digital personal data processed in India or abroad if tied to services offered in India. However, it excludes data used for personal purposes or made public by the individual or under legal obligations.
Under the Act, personal data can only be processed with the informed consent of the individual, known as the Data Principal. Consent must be free, specific, and revocable. For minors under eighteen or individuals with disabilities, it must come from a parent or guardian. The Act prohibits harmful processing of children’s data and targeted advertising to minors. Data Principals have rights to access, correct, or delete their data, withdraw consent, and seek grievance redressal. They must also act responsibly; false complaints can attract a fine of up to ₹10,000.
Entities handling data, called Data Fiduciaries, are required to ensure data accuracy, implement security measures, notify users and authorities of breaches, and erase data once its purpose is fulfilled. The government may designate certain entities as Significant Data Fiduciaries (SDFs), subjecting them to stricter rules like mandatory audits, Data Protection Officers, and impact assessments. The Act also allows exemptions for government functions, legal proceedings, research, and processing by startups or for public benefit schemes. It establishes the Data Protection Board of India (DPBI) to oversee compliance, handle complaints, and impose penalties, with appeals routed through the Telecom Disputes Settlement and Appellate Tribunal.
Digital Personal Data Protection Act, 2023:
The Digital Personal Data Protection (DPDP) Rules, 2025 lay out the operational roadmap for enforcing the DPDP Act, 2023, and aim to strengthen India’s data privacy regime through clear and enforceable standards. One of the key provisions relates to data transfers, where the rules permit certain categories of personal data to be transferred outside India, but only to countries or entities explicitly approved by the government. This ensures that cross-border data movement happens within a regulated and secure framework. On data retention, the rules mandate that personal data can be stored for a maximum of three years from the date of the last interaction with the Data Principal, or from the effective date of the rules, whichever is later. Importantly, Data Fiduciaries must notify individuals at least 48 hours before erasing their data, reinforcing transparency and user control.
The rules also establish a "digital, first" framework by mandating that the Data Protection Board of India (DPBI) be designed to function digitally by default. This is intended to streamline grievance redressal and consent, related procedures, enabling faster and more accessible resolution of user complaints. The DPDP Rules further implement a graded responsibility model, recognizing the varying capacities of different types of businesses. While startups and MSMEs benefit from reduced compliance burdens, large platforms handling massive volumes of data, such as Facebook, Instagram, YouTube, Amazon, Flipkart, and Netflix, are designated as Significant Data Fiduciaries (SDFs) and are subject to stricter obligations.
Another important feature is the formal introduction of Consent Managers. These are independent digital platforms or entities authorized to collect, store, and manage user consent. To operate, a Consent Manager must be an Indian-registered company with a minimum net worth of ₹2 crore and must adhere to high standards of transparency and accountability. The rules also require clear, standalone notices from Data Fiduciaries whenever personal data is collected. These notices must inform users about what data is being collected, the purpose of its processing, the goods or services linked to that data, and the methods available for withdrawing consent or filing complaints. Such measures ensure that data processing remains transparent, user-centric, and in line with the principles of informed consent and minimal data use.
Impact of the DPDP Rules, 2025 on Businesses and Users:
The implementation of the Digital Personal Data Protection (DPDP) Rules, 2025 is set to bring a fundamental shift in how businesses across India handle personal data. For many organizations, especially those that rely on digital data processing, these rules demand significant structural and operational changes. Legal experts anticipate a substantial compliance burden, particularly for small and medium enterprises (SMEs), which may struggle to invest in the necessary technology and processes to meet the law’s stringent standards. Businesses will be required to adopt robust consent management systems, update their privacy policies, and ensure secure data storage practices. Transparent communication about data rights and user control will now be legally mandatory, and this could necessitate redesigning websites, mobile apps, and customer relationship systems (CRMs).
One of the most significant changes is the stricter consent framework. Under the new rules, consent must be free, specific, informed, and unambiguous, and it must be obtained through clear affirmative action, no more pre-checked boxes or vague consent language. Businesses are also required to offer consent options in multiple languages and allow users to withdraw their consent at any time through a simple process. This change not only affects how data is collected but also how businesses interact with users at every stage of the digital journey. The legal risks of non-compliance are high, urging companies to conduct thorough audits of their data collection practices and user interfaces.
The 2025 rules also introduce strict provisions for the processing of children’s data. Companies must obtain verifiable parental consent for users under eighteen, refrain from behavioural tracking or profiling of children, and delete the data once its purpose is fulfilled. This particularly impacts sectors such as ed-tech, gaming, and social media, which must now implement age-verification systems and update their data processing protocols. Simultaneously, the formal rollout of the Significant Data Fiduciary (SDF) classification has begun. Companies designated as SDFs, typically large platforms that process vast amounts of personal or sensitive data, are now required to appoint Data Protection Officers (DPOs), conduct regular Data Protection Impact Assessments (DPIAs), and establish higher-level safeguards against misuse. For these organizations, compliance is no longer optional but a central part of governance and risk management.
Cross-border data transfer regulations under the DPDP regime also mark a significant development. Indian businesses may now transfer personal data outside the country, but only to jurisdictions explicitly approved by the government. Such transfers must ensure the same level of data protection as mandated in India and must be backed by enforceable contracts detailing safeguards. This has serious implications for companies using foreign cloud services, global data analytics platforms, or outsourcing models. Legal and IT teams will need to work closely to align infrastructure, contracts, and workflows with the new rules to avoid regulatory violations.
The establishment of the Data Protection Board of India (DPBI) adds further weight to the enforcement of these rules. Fully operational in 2025, the Board has the authority to investigate breaches, adjudicate complaints, order data audits or deletion, and impose penalties of up to ₹250 crore. The threat of these penalties means that businesses can no longer treat data protection as a compliance formality, it must now be a strategic priority. However, these rules also present serious concerns. Many critics argue that the law grants the state excessive exemptions, allowing it to collect and retain data without clear necessity, thereby risking overreach and undermining the right to privacy. Additionally, the absence of rights like data portability and the government's wide discretion over cross-border transfers raise questions about user autonomy and national data sovereignty. The legislation also lacks explicit provisions for harm prevention, leaving gaps in protection against identity theft, financial fraud, and discriminatory profiling.
Another complication lies in the overlapping compliance landscape. The DPDP Rules require businesses to report data breaches to the DPBI within 72 hours, but this timeline clashes with existing CERT-in guidelines under the IT Act, 2000, which mandate cyber incident reporting within just six hours. Navigating these parallel requirements may create confusion and increase compliance risks, especially for companies operating across sectors.
Despite the policy recognition challenges, new framework offers notable benefits for users. By enforcing clearer and more accessible rights, the DPDP Rules enhance individual control over personal data. Users now have greater visibility into how their data is collected, processed, and shared, and stronger mechanisms for redress in case of misuse. This not only fosters user trust but also encourages businesses to build more ethical, transparent, and accountable digital ecosystems. In the long run, while the rules may pose short-term hurdles, they have the potential to elevate data governance standards and increase public confidence in India’s digital economy.
Conclusion:
The DPDP Rules, 2025 mark a significant turning point in India’s data governance landscape. While they introduce much-needed clarity and control for users, they also impose substantial responsibilities on businesses, especially in terms of consent management, data security, and regulatory compliance. Although smaller enterprises may face challenges in adapting to the new framework, the long-term outcome is expected to foster greater transparency, accountability, and trust in the digital ecosystem. As the regulatory environment evolves, businesses will need to prioritize privacy by design and invest in robust data protection practices to remain compliant and competitive.
We at Data Secure (Data Privacy Automation Solution) DATA SECURE - Data Privacy Automation Solution can help you to understand EU GDPR and its ramificationsand design a solution to meet compliance and the regulatoryframework of EU GDPR and avoid potentially costly fines.
We can design and implement RoPA, DPIA and PIA assessments for meeting compliance and mitigating risks as per the requirement of legal and regulatory frameworks on privacy regulations across the globe especially conforming to GDPR, UK DPA 2018, CCPA, India Digital Personal Data Protection Act 2023. For more details, kindly visit DPO India – Your outsourced DPO Partner in 2025 (dpo-india.com).
For any demo/presentation of solutions on Data Privacy and Privacy Management as per EU GDPR, CCPA, CPRA or India DPDP Act 2023 and Secure Email transmission, kindly write to us at info@datasecure.ind.in or dpo@dpo-india.com.
For downloading the various Global Privacy Laws kindly visit the Resources page of DPO India - Your Outsourced DPO Partner in 2025
We serve as a comprehensive resource on the Digital Personal Data Protection Act, 2023 (Digital Personal Data Protection Act 2023 & Draft DPDP Rules 2025), India's landmark legislation on digital personal data protection. It provides access to the full text of the Act, the Draft DPDP Rules 2025, and detailed breakdowns of each chapter, covering topics such as data fiduciary obligations, rights of data principals, and the establishment of the Data Protection Board of India. For more details, kindly visit DPDP Act 2023 – Digital Personal Data Protection Act 2023 & Draft DPDP Rules 2025
We provide in-depth solutions and content on AI Risk Assessment and compliance, privacy regulations, and emerging industry trends. Our goal is to establish a credible platform that keeps businesses and professionals informed while also paving the way for future services in AI and privacy assessments. To Know More, Kindly Visit – Your Trusted Partner in AI Risk Assessment and Privacy Compliance | AI-Nexus