India's Digital Personal Data Protection Law: Implications For Global Businesses

On November 14, 2025, the government notified the Digital Personal Data Protection Rules, 2025, providing detailed operational guidance on how to implement the provisions of the Digital Personal Data Protection (DPDP) Act (enacted in August 2023). The rules formalize requirements related to consent, breach management, transparency, risk assessments, and cross-border transfers. They also introduce procedural mechanisms for the newly formed Data Protection Board, which will serve as the central enforcement body. Thus, Indian gets its privacy law in place though the government has provided a transition period for compliance to be rolled out over a 12 to18-month window.

The DPDP Act is a significant step in regulating the processing of personal data while ensuring the privacy and security of individuals in an increasingly digital world. It creates a comprehensive framework for managing the collection, use, storage, and transfer of personal data, balancing individual