Digital Personal Data Protection Act, 2023 Primer

The Digital Personal Data Protection Act, 20231 (“Act”) and Digital Personal Data Protection Rules, 20252 (“Rules”) are a response to the need for a comprehensive data protection framework in India. In 2017, the Supreme Court of India recognized the right to privacy as a part of the fundamental right to life and personal liberty, setting into motion the process of drawing up a data protection framework.3 From there on, several iterations of a draft framework were drawn up by various committees culminating in the final Act and Rules introduced by the Ministry of Electronics and Information Technology (“MEITY”).

In August 2023, the Act, which provided the framework for processing of “personal data”, was passed in the Indian parliament. However, much of the prescriptive guidance for operationalizing the Act was left to be fleshed out in the Rules. A draft version of the Rules was released in January 2025 for consultation. Based on feedback, MEITY notified the final version of the Rules and the implementation timeline of the Act and the Rules on 14th November 2025. The final version of the Rules remains largely the same as the draft version circulated earlier this year.

Read More

Trace Law Partners- DPDPA Primer.pdf

Download PDF • 981KB