Digital Personal Data Protection Act notified after two years, RTI Act amended

Large parts of the Digital Personal Data Protection Act (DPDP), 2023 were notified connected Friday (November 14, 2025), a important measurement guardant successful the Union government’s compliance of the 2017 K.S. Puttaswamy v. Union of India judgement of the Supreme Court, affirming the close to privacy, and the request for a instrumentality to support Indians’ data. The DPDP Rules, 2025, a draught of which was circulated successful January, and mulled implicit for a important play of time, were besides notified. 

The law, passed successful August 2023 successful Parliament, requires firms to safeguard Indians’ integer data, with exemptions for the “State and its instrumentalities,” and prescribes penalties for firms who breach these obligations. The instrumentality besides weakens the Right to Information Act, 2005, transparency activists person said, by removing the work of authorities bodies to supply “personal information” if the nationalist involvement outweighs a nationalist official’s close to privacy. 

While that amendment is successful unit from Friday (November 14, 2025) onwards, the existent obligations of “data fiduciaries,” who cod and usage idiosyncratic data, volition person until November 2026 to comply with immoderate provisions, specified arsenic putting retired the details of their designated Data Protection Officer (DPO). That period adjacent year, the Consent Manager framework, which allows firms to workout information removal and amendment rights connected behalf of “data principals” (users), volition besides travel into force. It volition instrumentality until May 2027 for ample tech firms to beryllium taxable to the afloat unit of the Act.

That includes the Data Protection Board of India (DPBI). Another notification (there were a full of 4 connected Friday) sets the fig of members astatine the DPBI astatine four. The committee tin clasp inquiries successful effect to complaints and enforce penalties successful lawsuit of information breaches. The board’s members, who person not yet been chosen, volition beryllium appointed by the Ministry of Electronics and Information Technology (MeitY). 

The DPDP Act, 2023 has gone done 3 large drafts since 2017, with the archetypal 1 successful 2018 imposing conditions similar information localisation that were furiously resisted by exertion firms. The 2023 Act, which strips retired galore of the requirements of that archetypal draft, has been comparatively much invited among ample Indian and planetary tech firms, who arsenic “significant information fiduciaries,” would look further compliance requirements.