Story perspectives

India Unveils Digital Data Protection Rules Amid Controversy

11/15/2025

Summary

Story summary

The Government of India has notified the Digital Personal Data Protection Rules, 2025, establishing a comprehensive data privacy framework.
The rules become effective immediately for certain provisions.
The rules will roll out in phases over 18 months.
The rules require clear consent notices, enhanced security measures, and a Data Protection Board to oversee compliance.
Critics argue Rule 23 allows state access to personal data without user consent.

History

Historical Context

The General Data Protection Regulation (GDPR) was enacted by the European Union on May 25, 2018, establishing comprehensive data privacy standards that influenced global policies. India's Digital Personal Data Protection Rules, introduced in 2023, reflect similar principles, mandating explicit consent for data processing. However, concerns about potential state overreach echo criticisms faced during the GDPR's implementation, highlighting ongoing debates about privacy rights.

1 of 2

Story summary

The Government of India has notified the Digital Personal Data Protection Rules, 2025, establishing a comprehensive data privacy framework.
The rules become effective immediately for certain provisions.
The rules will roll out in phases over 18 months.
The rules require clear consent notices, enhanced security measures, and a Data Protection Board to oversee compliance.
Critics argue Rule 23 allows state access to personal data without user consent.

1 / 2