Personal data get a safety net as DPDP rules go live

Firms get 18 months to align with new regime

- OJASVI GUPTA

THE GOVERNMENT ON Friday notified the Digital Personal Data Protection (DPDP) Rules 2025, thus setting in motion the phased rollout of the Digital Personal Data Protection Act, 2023.

Most of the compliance obligations affecting both consumers and companies will only take effect 18 months from the date of notification, giving firms across digital sectors, ranging from social media and e-commerce to fintech and telecom, a transition time to align their platforms, consent systems and data-retention practices with the law.

Once that 18-month window ends, companies and government departments will be required to seek specific, purpose-linked consent before processing personal data; provide users with itemised descriptions of the personal data being collected; offer simple mechanisms to withdraw consent; enable grievance redressal; and delete personal data when it is no longer needed for the stated purpose unless its retention is necessary for compliance with any law in force.

Firms will also have to report a personal data breach to the affected user and to the Data Protection Board within 72 hours of becoming aware of it, disclosing the nature, extent and timing of the breach, the consequences of the breach, the mitigation steps undertaken and the precautions the user should take. Children’s data has been placed under heightened protection, with companies required to obtain verifiable parental consent for processing data of any person under 18 through measures that confirm the identity and age of the consenting adult. However, platforms have been allowed to live-track the location of underage users for safety purposes only.