Govt notifies digital personal data protection rules
14 Nov 2025, 04:38 PMThe rules also state that Data Fiduciaries must comply with government-specified restrictions on certain categories of data, including localisation where required.
Team Head&Tale
The Government of India on Friday notified the Digital Personal Data Protection (DPDP) Rules, 2025 with an aim to protect the privacy of citizens amid increasing concerns in the wake of rapidly growing AI.
The much awaited rules, which mark the full operationalisation of the DPDP Act, 2023, provide an 18-month phased compliance timeline for data protection regime to be implemented, the government said in a statement.
The rules also require that Data Fiduciaries, entities handling personal data, must issue notices that should transparently explain the specific purpose for which personal data is being collected and used.
Besides, Consent Managers, which are entities that help individuals manage their permissions, must be Indian companies, it added.
In case of data related to children, Data Fiduciaries must obtain verifiable consent before processing their personal data. Besides, in case of disabled people, consent must come from a lawful guardian verified under applicable laws.
The rules also state that Data Fiduciaries must comply with government-specified restrictions on certain categories of data, including localisation where required.
This is significant as new-age AI companies including OpenAI and Anthropic have planned to set up offices in the country.
"The rules seek to strike a careful balance between protecting citizens’ privacy and promoting innovation and growth," noted the statement.



