Digital Personal Data Protection Act, 2023 (DPDP Act)

On November 13, 2025, India’s Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), marking a significant milestone in operationalizing the Digital Personal Data Protection Act, 2023 (“DPDP Act”). For organizations operating in India—including corporates, nonprofits, social enterprises, and impact investors—the new framework represents more than a regulatory update. It signals a fundamental shift in how organizations must approach the collection, processing, storage, and management of personal data. Data protection can no longer be treated merely as a matter of drafting privacy policies or meeting documentation requirements. It must be embedded across organizational functions, including program implementation, human resources, vendor relationships, technology infrastructure, governance, and risk management. Determine whether the DPDP Act applies to your organization. Assess your compliance readiness against key legal obligations. Identify operational and technical gaps that require attention. Understand the documents and evidence needed for audit readiness. Prioritize remediation efforts with a practical implementation roadmap.