New Delhi, November 15, 2025 — The Centre has officially notified and enforced the remaining provisions of the Digital Personal Data Protection (DPDP) Act, 2023, along with the freshly framed DPDP Rules, 2025, marking a major step in India’s data governance framework. The move comes in the wake of recent Supreme Court directives urging the government to expedite full implementation to strengthen citizens’ privacy rights.
According to the notification, the newly activated provisions mandate stricter compliance standards for all data fiduciaries, including government departments, digital platforms, fintech companies, and online service providers handling personal data. The rules outline clearer obligations around data processing, consent mechanisms, breach reporting timelines, user grievance redressal, and penalties for non-compliance.
Officials said the full enforcement of the DPDP Act is designed to bring India closer to global data protection norms, ensuring that citizens have greater control over how their personal information is collected, stored, and shared. The new compliance expectations include obtaining explicit consent, deploying secure data management systems, and maintaining data minimisation practices.
The Supreme Court had recently expressed concern over delays in operationalising the Act, emphasising that data privacy is a fundamental right under the Constitution. In response, the Ministry of Electronics and Information Technology (MeitY) accelerated the final steps and completed the required rule-making process for implementation.
Industry stakeholders are now preparing for an immediate transition to the updated privacy framework. Experts note that the enforcement of the 2025 Rules will bring higher accountability, particularly for “significant data fiduciaries” who manage large-scale personal data.
With the DPDP Act now fully in force, India enters a new era of structured digital privacy regulation, setting the foundation for safer online ecosystems amid rapid technological expansion.
