Archive · 1 Dec 2025
India's Digital Personal Data Protection Act: Challenges and Implications
India has a new law called the Digital Personal Data Protection Act (DPDPA).
This law says that companies need to get very clear permission from people before they can use their personal information.
The law also has some special rules for kids' data and what to do if there's a data breach.
Companies have to tell people and the government if there's a problem within a few hours or days.
The law makes the companies responsible if something goes wrong, even if it's not their fault.
This can be hard for companies to follow, but it's meant to keep people's information safe.
The government will also need to teach people about their privacy rights for the law to work well.
India's DPDPA requires explicit, specific consent for processing personal data, with 'legitimate use' exceptions.
Minors' data requires verifiable parental consent, posing logistical challenges.
Cross-border data flows may face restrictions, impacting India's digital economy.
Breach notifications must be made within 72 hours to consumers and the regulator, and within 6 hours to Cert-In.
Data fiduciaries are solely liable for breaches, requiring contract revisions with vendors.
- Who
- Indian government, businesses, data fiduciaries, and citizens
- What
- Implementation of the Digital Personal Data Protection Act (DPDPA) and its Rules
- When
- Recently issued Rules, compliance window of 18 months
- Where
- India
- Why
- To protect personal data and align with privacy rights and international best practices
- Act Name
- Digital Personal Data Protection Act (DPDPA)
- Consent Requirement
- Free, specific, informed, unconditional, and unambiguous
- Legitimate Use
- Allows processing without consent unless objected
- Minors' Data
- Requires verifiable parental consent
- Breach Notification
- 72 hours to consumers and regulator, 6 hours to Cert-In
- Liability
- Data fiduciary solely liable for breaches
- Compliance Window
- 18 months