.svg)
In November 2025, India’s Ministry of Electronics and Information Technology operationalised the Digital Personal Data Protection Rules 2025 (DPDP), bringing the Digital Personal Data Protection Act 2023 into a unified, citizen-centred framework.
The rules signal a major shift in India’s digital economy, requiring firms to reassess how they collect, process, store and transfer data.
As one of Asia’s largest and fastest-growing digital markets, India’s approach is closely watched across South and Southeast Asia. Its scale and regulatory pace make the framework a benchmark for neighbouring jurisdictions calibrating digital data governance.
The DPDP framework aims to balance individual rights to privacy with the needs of a rapidly growing digital economy. The rules emphasise purpose limitation, transparency, consent and the accountability of organisations handling digital personal data.
For regulated entities, this signals a new phase of compliance. Firms must reassess how they collect, process, store and transfer data and embed governance and security frameworks aligned with the new regime.
Data Protection Board and compliance obligations
The new rules establish the Data Protection Board of India, which will be responsible for overseeing compliance with the DPDP framework, issuing directions, handling breach notifications and resolving complaints. It also has powers to order inquiries, request information from firms and impose financial penalties for non-compliance.
As guidance develops through 2026, the board is expected to play a central role in shaping supervisory expectations and building consistency across the market.
For example, consent manager registration and related obligations will apply from November 2026, and most other core processing obligations will apply from May 2027.
This refers to the requirement for entities that act as intermediaries managing user consent on behalf of data fiduciaries to register with the government and meet specific standards for transparency, security and consent portability.
Operational implications for firms
First, organisations processing digital personal data should map data flows, update notices and consent mechanisms and align storage and retention rules with new minimum requirements.
Second, cross-border transfers will be subject to a more structured regime, so global firms will need to assess how transfers into and out of India fit with the new rules.
Third, firms must implement reasonable security safeguards and be ready to meet breach notification obligations to the board and affected individuals.
Global businesses must decide whether to treat India as a standalone compliance environment or integrate the Indian regime into global data governance frameworks.
Strategic opportunities
Firms that embrace the changes can gain first-mover advantages, such as stronger trust among consumers, smoother regulatory interactions and a competitive edge in India’s digital economy.
During 2026, organisations should:
- Conduct detailed discovery of data processing value chains, including consent manager models.
- Update consent flows and privacy notices to clearly define processing purposes.
- Strengthen cross-border transfer frameworks and plan for localisation or destination restrictions.
- Prepare breach response and incident management plans aligned with Indian obligations.
- Engage proactively with regulators and industry groups to track evolving guidance.
India’s DPDP rules combine globally recognised principles such as consent-based processing, transparency and breach reporting with local features such as central government discretion over cross-border transfers.
Firms that reshape governance, controls and culture now will be best positioned to thrive as India’s data-driven economy accelerates in 2026 and beyond.
