New Delhi: The government on Friday notified the rules under the Digital Personal Data Protection (DPDP) Act, officially bringing India’s first digital privacy law into force and starting the compliance countdown for all entities that handle personal data.
Under the new framework, social media platforms, online service providers, and other organisations processing personal information must clearly inform users about the data they collect and how it will be used. Users must also be provided simple options to withdraw consent or file complaints with the Data Protection Board (DPB) in case of violations.
Consent managers — entities authorised to act on behalf of users — have been given 12 months to register with the DPB, while companies have up to 18 months to meet administrative compliance norms. To qualify as a consent manager, an organisation must be headquartered in India, apply to the Board, and consistently meet its obligations, failing which its registration may be cancelled.
The DPB, based in New Delhi and comprising a chairperson and three members, will function as a fully digital adjudicatory body. Its responsibilities include enforcing the law, investigating data breaches, and imposing penalties. The rules also classify digital intermediaries based on their services and outline conditions under which user data must be deleted, unless retention is required by law.
Data fiduciaries must inform both the DPB and affected users of any data breach within 72 hours of becoming aware of it.
MeitY also issued a separate notification announcing the formal establishment of the DPB. The DPDP Act was passed by Parliament in August 2023, with the final rules released after extensive consultations following the draft notification in January 2025.
“The one-year deadline for Consent Managers essentially sets up the consent infrastructure in advance. By the 18-month enforcement mark, a network of certified, neutral consent-service providers will be ready to manage opt-in and opt-out workflows, smoothing the transition to the new regime,” said Vinay Butani, Partner, Economic Laws Practice.
