India Notifies DPDP Rules to Strengthen Citizen Privacy, Drive Responsible Innovation

The Government of India has issued the Digital Personal Data Protection (DPDP) Rules, 2025, completing the implementation of the DPDP Act, 2023. Together, the Act and Rules establish a clear, citizen-focused and innovation-friendly framework for the responsible use of digital personal data.

Passed by Parliament on 11 August 2023, the DPDP Act sets out a comprehensive system for safeguarding digital personal data. It outlines the obligations of organisations handling such data—referred to as Data Fiduciaries—and the rights and duties of individuals, known as Data Principals. Designed with the SARAL principles of Simple, Accessible, Rational and Actionable, the Act uses plain language and practical illustrations to support easier understanding and compliance.

The Act is built on seven core principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability.

Inclusive and Consultative Rule-Making
To ensure broad engagement, the Ministry of Electronics and ...