Personal data privacy is now law as rules notified

Companies will need to comply with the Act's provisions within 12-18 months

- Shouvik Das

India's long-awaited data-privacy regime formally kicked in on Friday. More than two years after the Digital Personal Data Protection Act, 2023 (DPDP Act) was passed by Parliament, the ministry of electronics & information technology (MeitY) notified the rules and established a fourmember data-protection board, bringing the law into effect.

Companies will need to comply with the Act's provisions within 12-18 months, including appointing consent managers and dataprotection officers, putting in place systems for express user permission, and reporting data breaches within 72 hours.

Platforms must also take parents' consent for users under 18, and cannot use certain data for children-like data that enables targeted ads a change industry had long sought.

The data protection board under the Act takes effect immediately. The chairperson will receive a remuneration of 4.5 lakh a month as notified in the gazette, while the other three members will be paid ₹4 lakh a month.

According to a government official who requested anonymity, a select committee under Meity will recommend names, after which appointments will be notified.

Reactions from analysts and observers were mixed. Some broadly welcomed the clarity on implementation timelines, lighter compliance requirements, and safeguards for children's data.

Others warned that the rules still lack clear checks on government data use and could leave industry carrying more obligations than the state.