Archive · 18 Nov 2025
India's New Data Rules Raise Industry Concerns
India has new rules about keeping people's private information safe.
Right now, companies can send some information outside of India.
But, these new rules let the government create a special group that can decide if certain types of information are not allowed to leave the country anymore.
This makes big technology companies worried because they often send data to other countries to work.
Some experts think this rule might have been added to help the government in trade talks with other countries.
The government says they want to protect privacy but also keep up with global tech trends.
Companies have more than a year and a half to get ready for these rules, but the government might make that time shorter.
There will be a new board to check if companies are following the rules, and they could be fined a lot of money if they don't.
India's Digital Personal Data Protection (DPDP) Rules, 2025, allow government to restrict overseas transfers of certain personal data.
This provision has revived data localization concerns among global technology companies operating in India.
A committee established under the rules can decide which data categories cannot be transferred outside India.
While currently permitted, the potential for future restrictions creates apprehension and operational uncertainty for tech firms.
The government aims to balance data protection with national interests, retaining flexibility for geopolitical and trade negotiations.
- Who
- The Indian government, global technology companies, legal experts, and industry stakeholders.
- What
- The operationalization of India's Digital Personal Data Protection (DPDP) Rules, 2025, specifically a provision that allows the government to restrict cross-border data transfers, has raised data localization concerns.
- When
- The DPDP Rules, 2025, have been issued, with compliance timelines stretching over 18 months, though amendments may shorten this period.
- Where
- India
- Why
- To empower the government to manage data flows based on geopolitical factors, trade negotiations, and national tech sovereignty concerns, while also aiming to protect personal data and ensure institutional accountability.
Industry Concerns & Legal Experts
Government & Proponents
Government Power Over Data Transfers
Industry Concerns & Legal Experts
The provision allowing a committee to restrict overseas data transfers introduces uncertainty for global tech companies, potentially leading to operational difficulties and legal challenges as it was introduced in the rules and not the Act. This power could be seen as a tool for negotiation in geopolitical and trade contexts.
Government & Proponents
The government has established these rules following extensive consultations, aiming to balance digital inclusion with privacy protection and institutional accountability. While cross-border transfers are currently permitted, the government retains the ability to impose future restrictions, possibly due to global tech sovereignty concerns and trade negotiations.
Implementation and Compliance
Industry Concerns & Legal Experts
Major tech companies face challenges in aligning their systems with the new DPDP Rules, with concerns about the timeline for compliance and the potential for the government to shorten the over 18-month window.
Government & Proponents
The government has provided a compliance timeline of over 18 months for major tech companies, though amendments to shorten this window are being considered. A Data Protection Board will be established to enforce the law and handle violations, with penalties of up to ₹250 crore for non-compliance.
- Law Name
- Digital Personal Data Protection (DPDP) Act, 2023 and Rules, 2025
- Key Provision
- Government committee can restrict categories of personal data from being transferred outside India.
- Current Status of Cross-Border Transfers
- Permitted, but subject to potential future restrictions.
- Timeline for Compliance
- Over 18 months for major tech companies, with possibility of shortening.
- Enforcement Body
- Four-member Data Protection Board
- Maximum Penalty
- ₹250 crore for non-compliance
- Consultations Held
- Nearly 7,000 inputs received nationwide.
Sources
Mint Quick Edit | India's data protection rules have finally been notified but much damage is already done
India's First Privacy-Focused Law DPDP Rules 2025 Goes Live: What It Means For Users
Digital Personal Data Protection Rules 2025: Cyberlaw expert Pavan Duggal breaks down India’s new data privacy framework
Government may accelerate DPDP compliance for large companies as discussions continue
Govt will shorten data protection compliance timeline from 18 months: IT Minister Vaishnaw
Digital Personal Data Protection rules notified: Key opportunities and challenges ahead
Government to compress transition period for tech companies on DPDP rules: Vaishnaw
Tracking of children under data privacy norms to be a challenge for institutions
Data localisation concerns resurface as DPDP Rules allow govt to restrict overseas data transfers
