DPDP Act: Rules for personal data

An app’s request for personal information is at the centre of the Digital Personal Data Protection Act, which received assent on 11 August 2023. The law sets out a wider framework for how organisations collect and use identifiable digital information, and how individuals can seek information, correction or erasure. [1]

The framework reached another milestone in November 2025, when the government notified implementing rules and a commencement schedule. These did not switch on every obligation immediately. At the 16 October 2026 checkpoint, most substantive processing duties and individual rights remained in the eighteen-month stage set by the notification. [3] [4]

From sensitive information to digital personal data

India already had rules for sensitive personal information. The 2011 framework under the Information Technology Act required body corporates handling categories such as financial and health information to follow privacy, consent and security requirements. DPDP’s legislation therefore builds beyond an earlier regulatory base. [2]

Its scope includes personal information collected digitally, information collected on paper and later digitised, and overseas processing connected with offering goods or services to people in India. Personal or domestic processing and specified publicly available information sit outside its application. [1]

Processing can rest on consent or the Act’s specified legitimate uses. The law provides for consent withdrawal, grievance redress and correction or erasure, subject to its conditions. These provisions create responsibilities on the organisation deciding why and how data is processed, described in the Act as the data fiduciary. [1]

The timetable matters

The November 2025 notification commenced institutional provisions, including those concerning the Data Protection Board. It assigned certain consent-manager provisions to the one-year stage and most core obligations, rights and enforcement provisions to eighteen months after publication. That places the main substantive stage in May 2027 under the notified schedule. [4]

The Rules follow a corresponding sequence. They specify what notices should explain, security safeguards, breach reporting and arrangements for verifiable parental consent. The detailed rules about these activities belong to the later stage; publication of a rulebook is distinct from the date a particular duty becomes enforceable. [3]

The government corrected parts of the English Rules in December 2025. An October 2026 order also clarified wording about guardian consent and data audits in the Act. Those corrections form part of the current legal record without bringing the substantive timetable forward. [6] [7]

Privacy and public accountability

The law’s reach is qualified by exemptions, including powers concerning state instrumentalities. It also amends the Right to Information Act’s personal-information exemption. These provisions are part of the same legislative package as the new privacy rights. [1]

The Internet Freedom Foundation has criticised the breadth of exemptions, executive influence over the Board and the effect on public-interest access to information. Its December 2025 brief also raised the absence of a dedicated journalistic-purpose exemption. These are the organisation’s objections, rather than findings that a court has invalidated the framework. [5]

The next practical step is translating the notified duties into usable processes: an understandable notice, a workable withdrawal route and a grievance that receives an answer. The Rules describe those mechanisms; the phased schedule determines when their DPDP requirements take effect. [3] [4]