The Government of India notified the DPDP Rules, 2025, completing the operationalisation of the DPDP Act, 2023.
The Act and Rules create a citizen-focused and innovation-friendly framework for the responsible use of digital personal data.
It establishes obligations for Data Fiduciaries and rights for individuals (Data Principals), following the SARAL design—Simple, Accessible, Rational, and Actionable.
Seven core principles guide the framework: consent & transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability.
The Rules strengthen the rights of individuals to access, correct, update, or erase personal data, and allow nomination of representatives.