Personal data privacy is now law as rules notified

ment various parts of the law in12-18 months. In12 months, that is, by 14 November 2026, they need to appoint consent managers—the person accountable for social media platforms seeking permission to use people’s personal data.

- 

And within 18 months, companies have to implement a mechanism to seek express permission from users before using their data for business purposes, such as targeted advertisements.

They will also be required to inform the newly notified data protection board of data breaches within 72 hours, and inform users about these “without delay”.

Further, all social media platforms and other parties that handle user data will be required to appoint a data protection officer in 18 months.

For users under 18, companies will need to seek “verifiable” parental consent before using their data. At the same time, certain types of data, such as those that enable general tracking of users for ads, will be completely barred to ensure children’s safety.