- Introduction
The Digital Personal Data Protection Act, 2023 (DPDP Act) and
the DPDP Rules, 2025 have moved India's data protection regime
from principle to implementation, and government contractors and
regulated entities will be among the first to feel the impact.
The DPDP Act establishes a comprehensive framework governing how
"data fiduciaries" and "data processors"
collect, use, store and share personal data, backed by a
specialised Data Protection Board of India with inquiry and penalty
powers. The DPDP Rules, 2025 flesh out operational details such as
notice and consent formats, thresholds for classifying an
organisation as a significant data fiduciary (SDF), timelines for
breach notification and conditions for cross‑border transfer
conditions.
