WHAT INDIA'S NEW 'DIGITAL PERSONAL DATA PROTECTION ACT' MEANS FOR CITIZENS, GIG WORKERS AND THE MEDIA

India's DPDP law traces back to the 2017 Puttaswamy privacy ruling and the 2018 Srikrishna draft, after multiple bill revisions, growing surveillance concerns, RTI debates and its 2023 enactment.

- RUCHIRA TALAPATRA

On November 14, 2025, the Indian government formally notified the Digital Personal Data Protection (DPDP) Rules, 2025, completing the framework set by the 2023 Act. The DPDP Act's amendment to the Right to Information (RTI) Act also took effect. Officially, this creates a “citizen-centred” data protection framework giving equal weight to individual rights and lawful processing. In practice the arrival of these “dry” rules has immediate real-world impact: they will shape how much government bodies, Big Tech and employers can collect about each person - and conversely what citizens can discover about them.

Still, civil liberties groups and media bodies greeted the notification with alarm. The Internet Freedom Foundation (IFF) warned that the rules, which phase in over 18 months, “will entrench the State's heavy-handedness in the collection and processing of digital personal data”. In IFF's view, the new scheme “create[s] new barriers to transparency and individual freedoms” while giving large data-holding entities “greater discretion”. Media groups echoed the concern. The Editors Guild of India and DigiPub (digital media bodies) pointed out that nothing in the Rules explicitly protects journalistic work. They cautioned that unclear consent requirements could “chill newsgathering and hinder accountability journalism”. In a joint statement DigiPub warned the DPDP Act and Rules “collectively cripple the Right to Information Act” and risk “indirect censorship” of the press.