DIPPING INTO THE DPDP REGIME

NOVEMBER 14 was an important date in India’s digital journey, marking a milestone by bringing to life a comprehensive framework that fundamentally changes how companies handle personal data.

- ATUL N MENON

One of the major things that changes with the notification of the Digital Personal Data Protection (DPDP) Rules, 2025—at least in theory—is the way an individual’s browsing history, e-commerce trail, or social media use can be used by advertisers. We are all used to privacy policies posted on these platforms, though hardly anyone reads them. What's critical for the layman to note is that the DPDP framework transports privacy from a constitutional promise to enforceable rights and duties.

The good news is that companies can no longer hide behind impenetrable legal jargon. There has to bea clear and understandable request from the person determining the purpose and means of processing personal data (data fiduciary), for consent from the person whose data is being processed (data principal). The request shall be accompanied by a notice informing the principal of the purpose for processing the personal data, the way the principal can withdraw or modify consent, the grievance mechanism available, and the way complaints can be raised against the data fiduciary.

The rules provide timelines for data fiduciaries to maintain records before erasing them from their system. It is also significant to note that the rules apply to processing personal data outside India if it is in connection with offering goods or services within India.