Operationalising Digital Privacy - Analyzing India’s DPDP Rules, 2025
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
OPERATIONALISING DIGITAL PRIVACY: ANALYZING
INDIA’S DPDP RULES, 2025 Tushar Soni, Himachal Pradesh National Law University, Shimla Introduction On 14-15 November, The Ministry of Electronics and Information Technology (MeitY) has officially notified the Digital Protection Data Protection (DPDP) Rules, 2025, making the DPDP Act 2023, more authoritative. This move will offer the Indian users high-level privacy promises which will eventually be practical to them also. What’s special in this move is that the Indian Government didn’t rush in implementing these rules instead many obligations has been placed before the companies in over 12-18 months, giving them sufficient time to adopt these rules. Experts appreciate this movement citing it a thoughtful and measured, not a harsh or restrained step. Why The Delay Was Worth It? Two years ago, Parliament passed the DPDP Act.
But until now, much of the law remained aspirational:powerful on paper but lacking a robust mechanism for enforcement1. The newly implemented rules hopes to fill the gaps and and give clarity on how the data of the users is collected, protected and deleted. IT firms, startups, and civil society have welcomed the development, and this will eventually lead to smooth implementation of the act . As MeitY itself put it, the Rules are designed to be “citizen‐friendly and innovation‐friendly”, using simple language and a “SARAL” (Simple, Accessible, Rational, Actionable) design2. This step will eventually mark shift from opaque to transparent and accessible regulations.
1 Rules notified for DPDP two years after act passed, THE ECON. TIMES (Nov. 15, 2025),
https://m.economictimes.com/tech/technology/rules-notified-for-dpdp-two-years-after-actpassed/articleshow/125334086.cms. 2 Government notifies DPDP rules to empower citizens, protect privacy, ECON. TIMES – CIO (Nov. 15, 2025), https://cio.economictimes.indiatimes.com/news/big-data/government-notifies-dpdp-rules-to-empower-citizensprotect-privacy/125344934.
Key Provisions of The Act
1. Security and Breach Reporting
The news rules has implemented strong measures for the data fiduciaries such as encryption, access monitoring, logs etc. For any data breach that would happen in the future, the company has to inform the individual and the Data protection Board (DPB) about the breach within the 72 hours of the breach3. This move showcases the commitment ragarding the transparency of the act.
2. Phased-Roll Out
According to this, core definitions and DPB related rules will start immediately but the rules which demands heavier obligations ( data-retention, cross-border data transfer limits and consent-manager registration) will phase over 12-18 months4. This 12-18 month time period will give the companies, firms sufficient time to build the required workflows.
3. Consent-Managers
The user-centric approach emerged the idea of the Consent-Managers. These are the entities which will help the users give/ withdraw the consent of how their data will be accessed across various websites. These managers will have to register, and their registration can be suspended if they failed to follow the rules. This will give control to the users on how their data will be used, gone are the days where users just tog the consent on every app.
4. Data Retention and Deletion
Intermediaries like social media, gaming companies or e‐commerce platforms must delete a user’s data after 3 years of inactivity, unless there’s a lawful reason to retain it. But before doing so, they must give a 48-hour notice to the user5. This is one of the most appreciable move of the rule as it simply states that inertia should not be the reason for the eternal data collection.
5. Protection of Children’s Data
3 Inform users about data breaches immediately, TIMES OF INDIA (Nov. 15, 2025),
https://timesofindia.indiatimes.com/business/india-business/inform-users-about-data-breachesimmediately/articleshow/125336870.cms.
4 Ojasvi Gupta, Data privacy law comes into force, FIN. EXPRESS (Nov. 14, 2025),
https://www.financialexpress.com/life/technology/data-privacy-law-comes-into-force/4044656/. 5 Aashish Aryan, DPDP rules mandate deleting user data after three years of inactivity, BUS. STANDARD (Nov. 14, 2025), https://www.business-standard.com/industry/news/dpdp-act-user-data-deletion-ecommercegaming-social-media-rules-125111400938_1.html.
The Verifiable Parental consent is now mandatory to access the data of minors6. The prohibition of behavioral survey of the minors has also been enacted as to protect the data of minors who interact heavily with the apps.
6. Significant Data Fiduciary
The platforms which carry large number of users and their extra sensitive data is now classified as SDFs. These entities will now have to face stricter regulations and checks like Annual Data Protection Impact Assessments (DPIA’s), Independent Audits etc. to ensure that the algorithms that these companies are using are not infringing the individual rights7. But the problem is that the experts are very unsure about the companies which could be classified in this category.
7. Penalties and Enforcement
The Data Protection Board (DPB) how now full jurisdiction to suspend the Consent- Managers , or even in some extreme cases cancel their registrations. The breaches could impose a penalty upto Rs. 250 Crore. What The Rules Mean for Ordinary People:
1. Better Control Over your Data.
As an individual, we have a full authority to understand what data does the comapnies collect, how they collect and what they collect and moreover the ways to stop them from misusing our data. The consent of an ordinary individual becomes more powerful when there’s a Consent- Manager to mediate
2. Stronger Safety Nets
For a data breach, the law will now require to have a quick and effective communication to the individual. The 72-hour window is strict and will ensure privacy of the user.
3. Children and Privacy
With the verifiable parental consent idea, the parents will now feel a sense of relief about their
6 Aashika Jain, DPDP 2025 Rules Explained
What the New Data Protection Rules Mean for You, TIMES OF INDIA (Nov. 15, 2025), https://timesofindia.indiatimes.com/technology/tech-news/dpdp-rules-2025-rulesexplained-as-they-come-into-effect-what-they-mean-for-you/articleshow/125325252.cms. 7Aashish Aryan, DPDP Rules Notified: Digital Privacy Law Operationalised After 14 Years, BUS. STANDARD (Nov. 15, 2025), https://www.business-standard.com/industry/news/dpdp-act-rules-notified-digital-personaldata-protection-operationalised-125111400811_1.html. child’s data. The scope of data misuse and fraud is now minimised.
4. Trust in Institutions
With the DPB working fully online, the fear of long court room battle for filing complaints is gone. The user just has to log into the portal and file a complaint. Challenges To The Act: A few red-flags of the DPDP Rules are:
1 Uncertainty to Identify Big-Companies
While the SDFs are defined on paper, the experts are now facing a challenge to identify which companies would fall in this bracket. This uncertainty is making planning hard8.
2 Cost for Small Players
The strict regulations, regular checks, audits and impact assessments may be very hard for MSME’s and Startup’s, and obviously some will worry about how they will survive in the market.
4 DPB’s Capacity
The idea of DPB is very promising but it needs a staff, technical engineers having particular skill-set that will match their operations and robust processes. The ambiguity is whether this boards will be able to handle complex cases as their work is yet to be proven,
5. Public Awareness
All these rules are meaningful only if people know how to use them or have knowledge about these rules. The government should organize campaigns to let people know about these rules. Why Law Students and Young Professional’s Should Pay Attention:
1 Litigation Potential
Cases involving privacy, state access and violations of breach of data will report soon in the courtroom so, the litigators should be ready with proper knowledge about these laws.
8 Rules Notified for DPDP Two Years After Act Passed, ECON. TIMES (Nov. 15, 2025),
https://economictimes.indiatimes.com/tech/technology/rules-notified-for-dpdp-two-years-after-actpassed/articleshow/125334086.cms.
2 Regulatory Careers
With the formation of DPB, roles involving data governance, auditing and compliance will be in demand. Employment opportunities will rise among these fields.
3 Tech-Law Practice
Lawyers consulting in the field of AI, data protection and user consent will now have to understand these laws very carefully.
4 Policy Advocacy
The implementation of these rules also brings an opportunity to influence the modification relating to these rules, particularly around cross-border norms, localization and SDF classification. The Road Ahead: The effective implementation of the DPDP framework will require a mix of both the public awareness, institutional capacity, regulatory clarity, and international coordination to work. The biggest hurdle is to make sure that people know their rights under the law; and without vigorous education initiatives even the protection filed with the best intentions remains a paradise. Meanwhile, the Data Protection Board needs to develop internal capacity to enforce fairly quickly including hiring technical assistance, creating easy-to-use complaint portals, and making adjudicatory processes transparent, as the enforcement will only be as effective as the institution itself.
The second pressing activity is the apparent determination of Significant Data Fiduciaries (SDFs) by the government since the current ambiguity is making it hard to plan the compliance of businesses operating in the different sectors. More conflict between data protection and artificial intelligence will be experienced in the coming years as regulators seek to guarantee transparency in algorithms and risk assessments and companies strive to innovate and demand flexibility in regulation. Moreover , the conditional cross-border data transfer regime in India should change with the world data frameworks, particularly as digital platforms and cloud providers (as well as AI developers) continue to relocate data across jurisdictions on a regular basis.
How much India gets the balance between user rights, national security, innovation, and global interoperability right will decide the success of DPDP regime in carving out the future of India in the digital space. Conclusion With India entering a new age of digital governance, the DPDP Rules do not only signify the practicalization of a statute, but represent the change in perception of power, privacy, and responsibility in the digital era by the country. The months to come will determine whether these rules are able to transition off paper and onto reality, and whether a body of such laws as the Data Protection Board is capable of stepping up to the challenge of enforcing rights on a national level. The citizens will have to become active contributors to this change, learning how to agree, take control over their data, and punish companies.
Companies, in the meantime, are finding it difficult to avoid facing an acute necessity to consider privacy in the design and choices of their business instead of a compliance box. The questions that are still in the air: Which companies will be classified as Significant Data Fiduciaries, how will AI risks be regulated in India, and how the flow of data across borders can be reconciled with its domestic interests will decide the second round of legal discussion and policy development. Finally, the effectiveness of the data protection regime in India will be achieved by its ability to safeguard the autonomy of the individual and facilitate a successful and sustainable digital economy.
The decisions that will be taken in the coming few years will help either to create a framework that can be described as compliant or the rights-affirming, globally credible, and future-ready framework in India.
References:
1. Rules notified for DPDP two years after act passed, THE ECON. TIMES (Nov. 15,
2025), https://m.economictimes.com/tech/technology/rules-notified-for-dpdp-twoyears-after-act-passed/articleshow/125334086.cms.
2. Government notifies DPDP rules to empower citizens, protect privacy, ECON. TIMES
– CIO (Nov. 15, 2025), https://cio.economictimes.indiatimes.com/news/bigdata/government-notifies-dpdp-rules-to-empower-citizens-protectprivacy/125344934.
3. Inform users about data breaches immediately, TIMES OF INDIA (Nov. 15, 2025),
https://timesofindia.indiatimes.com/business/india-business/inform-users-about-databreaches-immediately/articleshow/125336870.cms.
4. Ojasvi Gupta, Data privacy law comes into force, FIN. EXPRESS (Nov. 14, 2025),
https://www.financialexpress.com/life/technology/data-privacy-law-comes-intoforce/4044656/.
5. Aashish Aryan, DPDP rules mandate deleting user data after three years of
inactivity, BUS. STANDARD (Nov. 14, 2025), https://www.businessstandard.com/industry/news/dpdp-act-user-data-deletion-ecommerce-gaming-socialmedia-rules-125111400938_1.html.
6 Aashika Jain, DPDP 2025 Rules Explained
What the New Data Protection Rules Mean for You, TIMES OF INDIA (Nov. 15, 2025), https://timesofindia.indiatimes.com/technology/tech-news/dpdp-rules-2025-rulesexplained-as-they-come-into-effect-what-they-mean-foryou/articleshow/125325252.cms.
7 Aashish Aryan, DPDP Rules Notified
Digital Privacy Law Operationalised After 14 Years, BUS.
STANDARD
(Nov. 15, 2025), https://www.businessstandard.com/industry/news/dpdp-act-rules-notified-digital-personal-data-protectionoperationalised-125111400811_1.html.
8. Rules Notified for DPDP Two Years After Act Passed, ECON. TIMES (Nov. 15, 2025),
https://economictimes.indiatimes.com/tech/technology/rules-notified-for-dpdp-twoyears-after-act-passed/articleshow/125334086.cms.