The Digital Personal Data Protection Act, 2023 is India’s data protection law. Its Rules, and the notification bringing its sections into force, were published on 13 November 2025.

When it binds

Most of what a service owes the people whose data it holds — the notice, consent, and the rights to access, correct and erase — comes into force eighteen months after publication: on 13 May 2027. Rules 3 and 5 to 16 of the DPDP Rules start on the same day.

What a privacy notice must say

Rule 3 of the DPDP Rules asks for a notice that can be understood on its own, in clear and plain language, and that gives at least:

  • an itemised list of the personal data, and the purpose of each item, with the service it makes possible;
  • how to withdraw consent — as easily as it was given;
  • how to exercise your rights under the Act;
  • how to complain to the Data Protection Board.

The Act also asks a service to publish who answers questions about its processing (section 8(9), and rule 9), to identify you by something you already have, such as your username (rule 14(1)(b)), and to answer grievances within a published period of no more than ninety days (rule 14(3)).

Children

Under the Act, anyone who has not completed the age of eighteen is a child, and a child’s data needs verifiable parental consent before it is processed (sections 2(f) and 9(1)).

Why we wrote ours to that shape now

Writing a privacy notice to the Act’s shape before it binds costs nothing extra, and it is what a careful reader will look for. Our privacy policy lists each kind of data with its purpose and basis, names the person who answers data questions, and explains each right and how to complain. Where the IT Rules are stricter — a grievance resolved within 7 days — we publish the stricter limit.

Sources

Every figure in this article is recorded with its source and the date it was checked. More insights.