Your new data rights: what India's data protection rules mean for you
What happened: The government notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025. They put the DPDP Act, 2023 into practice, phased over 18 months:
- Now: the Data Protection Board of India is being set up, with complaints to be filed online.
- From November 2026: consent managers (registered Indian companies) can start helping you give, review and withdraw consent across many apps from one place.
- From May 2027: most duties on companies apply.
Your rights under the law:
- Say yes or no, in clear, simple language, and withdraw consent any time.
- Know what personal data a company holds about you, and why.
- Correct or erase your data in certain situations.
- Nominate someone to use these rights on your behalf.
- Companies must reply within 90 days, and must tell you about a data breach in plain language: what happened, the possible impact, and what they’re doing.
- Children’s data (under 18) needs verifiable parental consent.
Why it matters for you: penalties are serious, up to ₹250 crore for failing to keep data safe, so companies will start sending clearer consent notices and privacy contacts. Read them before you tap “I agree”.
Tip: start now. Delete apps you don’t use, and in your phone’s settings remove permissions (contacts, location, microphone) that an app doesn’t need.