The Digital Personal Data Protection Act (DPDP) was passed in Parliament in 2023. It was passed to “provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto,” as per the Ministry of Law and Justice.
Two years after the passing of the Act, the Ministry of Electronics and Information Technology (Meity) on Friday brought it into effect by notifying the rules as well as a four-member data protection board under the DPDP Act, 2023.
Also Read: AI in marketing: How customer-centric companies can benefit from data privacy regulations
In the instance of a breach, which will be assessed on its nature and severity, penalties will be levied on data fiduciaries for non-compliance, with fines reaching up to ₹250 crore per breach.
Ashok Hariharan, CEO and co-founder, IDfy, one of the companies selected to work on the systems, agrees. According to him, the rules coming into effect mark a pivotal shift in India’s data protection landscape. “It isn’t simply about meeting obligations—it’s about redefining how we honour the trust placed in us by every individual whose personal data we steward,” says Hariharan. He presses on the need for the industry to design systems where consent is not an afterthought, breach-readiness is built-in, and privacy by design becomes the default. “The real work begins now: Translating policy into architecture, ambition into culture, and intent into impact.”
Shashank Karincheti, co-founder and CPO of Redacto, another privacy company which was selected in Meity’s ‘Code for Consent: The DPDP Innovation Challenge’ explains that with the DPDP Rules now in force, enterprises are entering “a new phase of accountability”. Every organisation that collects or processes personal data will now be judged by the clarity of its systems and the discipline of its governance. With these rules, privacy has moved from being a legal topic to becoming an operational reality. “For most companies, compliance will not come from adding new paperwork but from rethinking how data flows within their systems. That means mapping every interaction, validating every access, and creating a single source of truth for personal information across teams and vendors. This requires precision and structure, not just policy,” says Karincheti.
Redacto is helping companies by giving them a live view of how data moves, who accesses it, and where the risks lie, so they can act before issues escalate.
Amit Kumar, Redacto’s CEO and co-founder, is of the view that the DPDP rollout changes how enterprises think about systems, not just data. “This is not an exercise in documentation. It is an exercise in design. Every organisation that handles personal data must now build the ability to see, trace, and justify its use in real time. That is the true test of digital accountability.”
Experts are of the view that DPDP Rules and their effective implementation will also shift power back to individuals in an ever-expanding digital economy and push companies toward higher standards of governance and accountability. “This moment signals the rise of a new infrastructure layer. Privacy-tech will stand alongside fintech and deeptech as a category that enables sustainable growth. The winners in this new phase will be the ones that treat regulation as a roadmap, not a restraint,” says Karthik Prabhakar, managing partner at PeerCapital.
Lagna Panda, partner at law firm AP & Partners, also raises concerns. She explains that the rules specify that entities will be designated as significant data fiduciaries (SDFs) by a committee constituted by the Central Government. However, there is no clarity on the criteria and the process to be followed for designating an entity as an SDF. The rules also say that the committee will specify the categories of personal data that must be localised by SDFs in India. She says the absence of guidance on how data localisation determination will be made, creates regulatory uncertainty.
“The provisions ought to have specified details of how the committee will be constituted including its composition, the process to be followed for designating SDFs, procedure for making submissions in relation to localisation proposals, and timelines for implementing data localisation mandates,” she says.
First Published: Nov 14, 2025, 18:16
Subscribe Now