After many months of promising to do so, the Government of India has finally published the Digital Personal Data Protection Rules (‘Rules’), the subordinate legislation to India’s much vaunted new privacy law- The Digital Personal Data Protection Act 2023 (‘Act’).
The publication of the Rules is highly significant as it provides concrete timelines within which the Act will be brought into effect and be made enforceable.
As expected, there is a prep period of 18 months before the law is enforced, allowing businesses to take compliance measures by bringing their houses in order. Businesses however can no longer kick the can down the road in the hope that the law will remain a paper tiger. Compliance by 13 May 2027 shall be mandatory, no matter the size of your business, or how much such compliance will cost!
When does the DPDPA go into effect?
- Most provisions that should concern data fiduciaries (data controllers) shall become effective on 13 May 2027.
- Procedural provisions that relate to the commencement of the Act, allow the establishment of the regulator, the Data Protection Board of India (‘Board’), and rulemaking powers came into effect immediately upon the notification of the Rules (on 13 November 2025).
- Provisions concerning the registration of Consent Managers with the Board, as well as the power to take action against Consent Managers that have breached their obligations, shall come into effect on 13 November 2026. ‘Consent Managers’ are entities that while remaining ‘data blind’, act as intermediaries allowing individuals to manage the consent they have provided to multiple parties to process their personal data. These Consent Managers are intended to act as a single point of contact allowing the data principal (data subject) to manage, review or revoke consent.
Disclaimer: This update is for general information purposes only. It does not purport to provide comprehensive legal or other advice. The publisher and the contributors accept no responsibility for losses that may arise from reliance upon information contained in these publications.
