Digital privacy law a reality after 14 years

DPDP rules notified; implementation planned in phases over 12-18 months

- AASHISH ARYAN

The government on Friday notified the administrative rules under the Digital Personal Data Protection (DPDP) Act, marking India's entry into a select group of countries with a federal digital personal data privacy regime.

Industry and legal experts welcomed the detailed rules, as India's digital ecosystem finally has a clear framework for handling data. The new rules allow for a staggered implementation road map, giving companies, data fiduciaries, data principals, and other stakeholders up to 18 months to comply with the administrative guidelines under the DPDP Act. By comparison, consent managers will have up to 12 months to register to act on behalf of users.