The DPDP Act will be enforced in staggered phases over a period of 18 months.
Data Fiduciaries are also responsible for undertaking annual Data Protection Impact Assessment
Photo Credit: Pixabay
The Centre, on Friday, notified the Digital Personal Data Protection (DPDP) Act, 2025, bringing some of the rules into effect immediately. The notification comes nearly 10 months after the DPDP Rules, 2025, a draft of the bill was circulated in January. Among the rules that come into effect now is the Right to Information (RTI) Act, 2005, amendment. The rules entrust Data Fiduciaries with several key responsibilities, including adopting technical and organisational measures to ensure that a parent can give their consent before a minor's data can be processed.
In a notification published by the Ministry of Electronics and Information Technology (MeitY), the government shared the rules under the Act, as well as the roadmap towards its enforcement. Interestingly, instead of bringing the entire act into force immediately, the Centre has taken a staggered approach, rolling out the rules in several phases over a period of 18 months.
One of the rules that comes into effect immediately aims to protect the privacy of public officials, enforcing the recent amendment to the RTI Act, 2025. The DPDP Act also establishes the Data Protection Board of India and finalises the number of members in the board.
Coming to the key features of the DPDP Act, the government's newly created position of a Data Fiduciary, who is a person who, alone or in conjunction with other persons, determines the purpose and the right way to process personal data. The Data Fiduciary has several responsibilities, including sending independent and plainly-worded notices to the Data Principal. The Data Fiduciary shall also undertake annual Data Protection Impact Assessment and audits to ensure that the provisions of the Act and the rules made under it remain effective.
The Act also mentions registration of Consent Managers by the Data Protection Board (DPB). The Board is also given the power to, if it is satisfied that it is necessary so to do in the interests of Data Principals, suspend or cancel the registration of such Consent Manager.
Apart from this, the DPDP Act, 2025, also highlights rules about Government's data processing standards, security safeguards, data retention limits, verifiable consent for children, exemptions for child-data processing, and a user rights framework.
Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.