India has officially notified the DPDP Rules, 2025, activating core provisions of the Digital Personal Data Protection Act, 2023 — marking a major leap toward GDPR-style data protection.
Key Components of the New Framework
Consent Management
Clear, verifiable consent required, including for children and persons with disabilities.
Stronger Security Requirements
Encryption, access controls, and other safeguards now mandatory.
Mandatory Breach Notification
Organizations must promptly notify affected individuals and the Data Protection Board (DPB).
Retention & Deletion Obligations
Personal data must be deleted once lawful retention periods expire.
Higher Bar for Significant Data Fiduciaries (SDFs)
Significant Data Fiduciaries must perform annual DPIAs, independent audits, and report key findings.
Cross-Border Transfer Limits
Certain personal and traffic data may be restricted from leaving India.
Compliance Timeline
Some provisions apply immediately, with the rest phasing in over 12–18 months.
India now enters a fully operational digital privacy era — and businesses should quickly assess their data governance and compliance readiness.
Source: https://lnkd.in/gpG9b7NP
With DPDP now in force, S8fe.ai helps organizations quickly classify, secure, and manage personal data with automated, regulation-aligned controls—making compliance faster, easier, and more reliable.