India's Regulatory Landscape at a Glance
India's regulatory framework includes national privacy legislation alongside cybersecurity requirements and sector-specific obligations. Depending on the nature of their activities, organisations may also need to consider requirements issued by regulators such as the Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI), and other competent authorities.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- India
- Primary data protection framework
- Digital Personal Data Protection Act, 2023
- Implementing rules
- Digital Personal Data Protection Rules, 2025
Key Regulations in India
Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection (DPDP) Act establishes India's framework for processing digital personal data. It defines obligations for Data Fiduciaries and establishes rights and responsibilities for Data Principals.
Depending on applicability, organisations may need to address:
- Lawful processing and consent requirements.
- Clear notices describing personal data processing.
- Data Principal rights and grievance handling.
- Appropriate technical and organisational security safeguards.
- Personal data breach notification obligations.
- Additional requirements for children's personal data.
- Additional obligations for Significant Data Fiduciaries.
- Retention, erasure, and purpose-related requirements.
Organisations should assess the Act's territorial scope, statutory exceptions, applicable commencement dates, and their specific role before determining their compliance obligations.
Digital Personal Data Protection Rules, 2025
The DPDP Rules, 2025 provide detailed requirements supporting implementation of the Act, including provisions relating to notices, consent, security safeguards, breach notifications, and the exercise of individual rights.
The Rules were notified in November 2025 and follow a phased commencement schedule. Organisations should map each applicable provision to its effective date rather than assuming that all requirements became operative simultaneously.
A practical implementation plan should identify the provisions relevant to the organisation, the applicable dates, internal owners, required documentation, and any remediation activities.
Information Technology Act, 2000
The Information Technology Act, 2000 remains relevant to India's broader digital and cybersecurity framework, subject to subsequent amendments and commencement arrangements.
Organisations should review relevant provisions alongside applicable rules, notifications, directions, and sector-specific requirements. The status of individual provisions should be checked against the current legal position.
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
The SPDI Rules establish requirements concerning sensitive personal data or information within their applicable scope.
Organisations should assess how these Rules interact with the DPDP Act, its phased implementation, and other applicable provisions. They should not assume that the SPDI Rules are simply a temporary framework that has already been replaced in its entirety.
CERT-In Cybersecurity Directions, 2022
The Indian Computer Emergency Response Team (CERT-In) issued cybersecurity directions addressing specified cyber incidents, reporting, time synchronisation, and log retention, among other matters.
Organisations within scope should assess their applicable reporting obligations, including the prescribed reporting timelines for specified incidents, as well as relevant log-retention and record-keeping requirements.
Cybersecurity incident handling should be coordinated with privacy breach assessment and notification procedures where an incident may involve personal data.
Sector-Specific Regulatory Requirements
Businesses operating in regulated industries may face additional obligations beyond general privacy legislation.
Sector considerations:
- Financial services: RBI, SEBI, and IRDAI requirements may apply depending on the regulated entity, activity, and applicable directions.
- Telecommunications: Department of Telecommunications and Telecom Regulatory Authority of India requirements may be relevant to particular providers and services.
- Healthcare: Organisations should assess applicable digital health, medical, confidentiality, and sector-specific requirements alongside general data protection obligations.
- Technology and digital services: Businesses should evaluate requirements relating to cybersecurity, consumer protection, digital services, and other laws relevant to their operations.
Understanding Your Obligations Under India's DPDP Framework
Data Fiduciary Responsibilities
A Data Fiduciary determines the purpose and means of processing personal data. Organisations acting in this role should evaluate their responsibilities under the Act and applicable Rules, including transparency, processing, security, rights handling, and accountability obligations.
Consent and Notice Management
Where consent is the applicable basis for processing, organisations should evaluate how consent is obtained, recorded, managed, and withdrawn. Notices should meet applicable legal requirements and communicate relevant information clearly.
Data Principal Rights
Organisations should establish processes to handle applicable requests relating to rights such as access to information about personal data processing, correction, completion, updating, erasure, grievance redressal, and nomination, subject to the statutory framework.
Personal Data Breach Management
Organisations should maintain processes for identifying, assessing, documenting, and responding to personal data breaches. They should determine which notifications are required, which authorities or individuals must be notified, and the relevant timelines under the applicable provisions.
Children's Personal Data
Businesses processing children's personal data should assess applicable requirements, including relevant consent and safeguards, subject to the statutory provisions and exemptions that may apply.
Significant Data Fiduciaries
Certain Data Fiduciaries may be notified as Significant Data Fiduciaries based on statutory criteria and government notification. Additional obligations may apply, including requirements concerning data protection officers, independent data audits, and assessments.
Organisations should not assume that every Data Fiduciary is required to appoint a Data Protection Officer under the DPDP Act.
India's Regulatory Implementation Timeline
India's DPDP framework is being implemented through a phased commencement schedule.
- August 2023
DPDP Act Enacted
The Digital Personal Data Protection Act, 2023 received presidential assent, establishing the legislative framework for digital personal data protection in India.
- November 2025
DPDP Rules Notified
The Digital Personal Data Protection Rules, 2025 were notified, setting out implementation details and a phased commencement schedule.
- November 2026
First Major Phased Milestone
Certain provisions are scheduled to commence one year after publication of the relevant November 2025 notification. Organisations should verify which specific provisions apply to their activities and prepare accordingly.
- May 2027
Further Phased Commencement
Additional provisions are scheduled to commence eighteen months after publication of the notification. Businesses should review the relevant statutory and rule-level provisions and plan implementation activities ahead of their applicable dates.
Important: These milestones do not mean every obligation starts on the same date. Confirm the commencement schedule for each provision using the official Gazette notifications and applicable legal guidance.
How RegulatoryBridge Supports Compliance in India
RegulatoryBridge helps organisations assess India's regulatory requirements and coordinate their compliance activities with wider international programmes.
DPDP Compliance Assessment
Review your data processing activities, notices, consent practices, policies, governance arrangements, and operational controls to identify potential gaps against applicable requirements.
Privacy Governance and Representation Assessment
Determine which privacy governance roles and representation requirements may apply to your organisation. Where relevant, assess Data Protection Officer requirements for Significant Data Fiduciaries and any other legally required local roles.
Consent and Data Principal Rights
Review consent workflows, privacy notices, request-handling processes, grievance procedures, and related documentation against the requirements applicable to your organisation.
Breach Response and Incident Coordination
Evaluate privacy incident procedures, escalation responsibilities, evidence preservation, and coordination between privacy, security, legal, and communications teams.
Cross-Border Data Protection
Assess international data flows, processing arrangements, vendor relationships, and contractual controls in light of applicable Indian requirements and the laws of other relevant jurisdictions.
Sectoral Compliance Coordination
Help organise compliance requirements across relevant privacy, cybersecurity, financial services, telecommunications, and other regulatory frameworks, subject to the scope of the engagement.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, commencement dates, regulatory directions, or official guidance changes.
Our Approach to India Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to India.
- 02
Map Regulatory Obligations
Identify applicable provisions, commencement dates, relevant authorities, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions
Need DPDPA representation in India?
We act as your local DPO, manage Board interactions, and run breach response - so your global product team doesn't have to.