India's data protection law moves from statute to rules: the DPDP Act

India had no comprehensive, standalone data protection statute until the Digital Personal Data Protection Act, 2023, which received Presidential assent on 11 August 2023. Before it, data protection rested mainly on provisions of the Information Technology Act, 2000, and the Sensitive Personal Data or Information Rules, 2011. The 2023 Act was designed to govern the processing of digital personal data, balancing the rights of individuals with the need for lawful processing by businesses and the state.

The Act uses two central terms. A data fiduciary is the person or organisation that determines the purpose and means of processing personal data, while a data principal is the individual to whom the data relates. The Act gives data principals rights including access to information about processing, correction and erasure of their data, and withdrawal of consent. It also requires fiduciaries to give clear notice, obtain consent where required, protect data, and notify breaches to the Data Protection Board of India and to affected principals.

The Act itself did not bring the whole regime into force at once. Its commencement was to be notified in stages, and detailed rules were needed to make it workable. On 3 January 2025, the Ministry of Electronics and Information Technology published the Draft Digital Personal Data Protection Rules, 2025, for public consultation. The draft covered consent notices, consent managers, parental consent for children's data, data breach notification, and the establishment and working of the Data Protection Board.

After consultation, the government notified the final Digital Personal Data Protection Rules, 2025, in November 2025, formally setting the implementation framework in motion. The Rules adopt a staggered commencement: some provisions, including those establishing the Board, take effect immediately, while other obligations for fiduciaries phase in over 12 to 18 months. That phasing matters, because a law that looks complete on paper can still take more than a year to bite in practice.

Critics have raised questions about exemptions for the state, about cross-border transfer conditions set by the government, and about whether individuals will in practice be able to exercise rights against large platforms. Supporters argue that a single national framework, with a dedicated Board and significant penalties, is a step forward from the earlier patchwork. Either way, the DPDP story shows why civil studies readers should track both the Act and its rules: the rules decide how a right is actually claimed.