Compliance rules enforced
India’s Digital Personal Data Protection framework has formally come into force, setting binding obligations for how companies collect, store, and process personal data. The rollout marks the operational phase of a law that has been under development for several years and now applies across sectors including technology, finance, e-commerce, and telecom.
Under the framework, organizations handling personal data must establish lawful consent mechanisms, limit data collection to specific purposes, and provide users with rights to access and erase their information. Firms are also required to implement reasonable security safeguards to prevent breaches and unauthorized access.
Cross-border data transfer remains permitted but is subject to government notification and future rule-making. Companies operating cloud infrastructure or outsourcing data processing abroad are expected to reassess contractual and technical controls to ensure compliance.
The law introduces penalties for non-compliance, including fines tied to the severity of violations. Enforcement authority rests with a newly established data protection board, which will have investigatory and adjudicatory powers.
Technology firms serving Indian users have begun updating privacy policies, consent flows, and internal governance structures. Enterprises with regional operations are aligning India-specific compliance with existing frameworks such as the EU’s GDPR.
The implementation positions India among a growing group of jurisdictions with comprehensive digital privacy regulation, adding complexity for global platforms operating across multiple regulatory regimes.
