MeitY notifies Digital Personal Data Protection Rules, 2025
In brief
The Government of India introduced the Digital Personal Data Protection Act, 20231 (DPDP Act) with the objective of creating a comprehensive framework for handling digital Personal Data2, safeguarding the interests of individuals (Data Principals)3 and ensuring the accountability of all organisations (Data Fiduciaries)4 with respect to processing or using such Personal Data.
On 3 January 2025, the Ministry of Electronics and Information Technology (MeitY) released the Draft Digital Personal Data Protection Rules, 20255 inviting public feedback and comments. On 13 November 2025, MeitY has now notified the Digital Personal Data Protection Rules, 20256 (DPDP Rules) along with its implementation timelines.
The DPDP Act and DPDP Rules are hereinafter collectively referred to as the ‘DPDP law’.
Sources
- The DPDP Act received the assent of the President and was published on 11 August 2023.
- Personal Data means any data about an individual who is identifiable by or in relation to such data.
- Data Principal means the individual to whom the Personal Data relates and where such individual is—
• a child, includes the parents or lawful guardian of such a child;
• a person with disability, includes their lawful guardian, acting on their behalf. - Data Fiduciary means any person who, alone or in conjunction with other persons, determines the purpose and means of processing of Personal Data.
- Notification No. G.S.R. 02(E) dated 3 January 2025
- Notification No. G.S.R. 846(E) dated 13 November 2025
MeitY notifies Digital Personal Data Protection Rules, 2025
