Government notifies DPDP Rules to empower citizens and protect privacy
The Government of India has notified the Digital Personal Data Protection (DPDP) Rules, 2025, marking the full operationalisation of the DPDP Act, 2023. Together, the Act and Rules create a simple, citizen-focused and innovation-friendly framework for the responsible use of digital personal data.
Enacted by Parliament on 11 August 2023, the DPDP Act establishes a comprehensive framework for protecting digital personal data, setting out the obligations of entities handling such data (Data Fiduciaries) and the rights and duties of individuals (Data Principals). It follows the SARAL design —Simple, Accessible, Rational and Actionable—using plain language and illustrations to support ease of understanding and compliance.
The Act is guided by seven core principles including consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability.