DPDPA rules set India on path to stronger data rights and governance

India’s Digital Personal Data Protection Act (DPDPA) has entered a decisive new phase with the notification of its final rules, setting in motion what experts describe as one of the most significant overhauls of the country’s digital ecosystem. The rules introduce clear implementation timelines, new compliance expectations and sharper accountability for organisations that handle personal data.

For many in industry, the law represents a cultural shift in how businesses interact with citizens’ information. Santosh Singh, Senior Vice President for IT at DS Group, describes the moment as “a definitive pivot towards a Trust Economy”. According to him, the era of collecting large volumes of personal data is giving way to a more disciplined model centred on consent and purpose. “The industry must now invest in consent, making data protection a foundation for commerce and not a cost to it,” he notes.

Singh believes the implications for consumers are profound. The act formalises a framework in which individuals can“erase, correct, and truly control” their digital identities. For sectors such as FMCG, he argues, the law marks the end of passive data capture and pushes companies to rely on more precise datasets linked directly to customer value. This, he says, will encourage “data minimisation and purpose limitation”, resulting in more relevant insights and stronger customer trust.

The final DPDPA rules also bring technical clarity to several aspects of the law. Vikram Jeet Singh, Partner at BTG Advaya, explains that the rules largely reflect the draft released earlier this year but include targeted updates and defined timelines. Some provisions take effect immediately, such as the establishment of the Data Protection Board, while rules governing consent managers will come into force within a year. Requirements related to notices, breach reporting and data retention have been given an 18-month window.

The government has also added more specificity on children’s data and parental verification. Singh points out that the rules now define “adult”, “authorised entity” and “digital locker service provider”, and introduce a separate rule for processing the data of persons with disabilities. An additional ground allows organisations to process children’s data to determine real-time location for safety purposes.

Yet, despite the detail, Singh cautions that the ultimate test will lie in execution.“The establishment of the Data Protection Board assumes great significance now,” he says, noting that the regulator will hold wide discretion in interpreting the largely principles-based law. “How the regulator takes up this challenge will determine the success or otherwise of this new law.”

For enterprises, the compliance demands are substantial and immediate. Dr Sanjay Katkar, Joint Managing Director at Quick Heal Technologies, says the rules reshape organisational behaviour. “These requirements are not just regulatory checkboxes,” he notes, emphasising that businesses must now demonstrate transparency, obtain meaningful consent and provide timely breach notifications. Data retention and erasure, he adds, must become disciplined, auditable processes embedded into everyday operations.

As organisations reassess their digital infrastructure, Katkar underscores the need for structured governance and strong data-handling practices, warning that regulatory expectations will only intensify. “As the regulatory landscape evolves, the time to act is now,” he says.

With the legal framework finally in place, India enters a new era of data governance, one built on citizen rights, business accountability and a regulator poised to test the country’s readiness for a truly privacy-centric digital future.