The Ministry of Electronics and Information Technology (MeitY) has formally notified the Digital Personal Data Protection (DPDP) Rules, 2025, marking a decisive step toward operationalising India’s new privacy framework. The rules, issued under Section 40 of the Digital Personal Data Protection Act, 2023, were published in the Official Gazette on 3 January 2025, following a 45-day public consultation period. The DPDP rules have set the stage for India’s privacy-first economy.
According to the notification, the government considered all objections and suggestions received from stakeholders before finalising the rules. The framework will be implemented in phases, with Rules 1, 2 and 17 to 21 taking effect immediately. Rule 4 will come into force one year from the notification date, while the remaining provisions, including key compliance and reporting obligations, will become applicable after 18 months.
Also read: Importance of Data Protection with the Advent of AI
For the first time, organisations that fail to protect personal data may face financial penalties of up to Rs 250 crore per violation. Despite the scale of the regulation, industry readiness remains uneven, with estimates suggesting that nearly 80 percent of Indian enterprises are not yet equipped to meet the new compliance, consent management, and breach-reporting requirements.
Ashok Hariharan, Co-founder and CEO, IDfy, said: “The notification of the DPDP Rules marks a pivotal shift in India’s data protection landscape. It isn’t simply about meeting obligations – it’s about redefining how we honour the trust placed in us by every individual whose personal data we steward. As an industry we must elevate our thinking from ‘Can we comply?’ to ‘How will we lead?’ – designing systems where consent is not an afterthought, breach-readiness is built-in, and privacy by design becomes the default. The real work begins now: translating policy into architecture, ambition into culture, and intent into impact. With the launch of the DPDP Act, the government has redeemed its pledge, not in half measure, but wholly and substantially, to guarantee, Privacy as a constitutational right for the people of Bharat, which it made in 2018.”
