MeitY releases DPDP Rules, operationalises India's first data protection act

The Ministry of Electronics and Information Technology (MeitY) on November 14 released the rules for the Digital Personal Data Protection (DPDP) Act, effectively operationalising India’s first dedicated law governing the processing of individuals’ personal data.

The draft rules were first released for consultation in January 2025. After reviewing submissions and holding inter-ministerial consultations, MeitY finalised and released the rules on November 14.

The rules outline detailed obligations for platforms, including clear and itemised notice requirements for users, stringent standards for obtaining verifiable consent, especially in the case of children, and strict data retention limits. They also mandate erasure deadlines for large platforms such as e-commerce, gaming, and social media intermediaries.

The DPDP Act was passed by Parliament in August 2023, but awaited implementation until the rules were issued.