With the Digital Personal Data Protection Act 2023, now supported by the DPDP Rules 2025, organisations should begin aligning their governance, privacy operations and security protocols with the structured compliance timeline set out under the Rules.
The Rules reflect a SARAL approach (Simple, Accessible, Rational and Actionable) as highlighted in the framework, ensuring clarity in obligations and accessibility for all stakeholders.
Immediately on Notification
All provisions relating to oversight, inquiry and enforcement by the Data Protection Board are now effective.
1 Year After Publication
Consent Managers must register with the Data Protection Board and comply with defined eligibility and interoperability standards.
18 Months After Publication
Key compliance obligations become operational. Organisations must ensure:
- Clear, independent privacy notices with itemised data details and an easy consent withdrawal mechanism (as illustrated under Notice Requirements).
- Published channels for individuals to exercise access, correction and grievance rights.
- Robust security safeguards including encryption, monitoring and continuity controls, together with retention of processing logs for at least one year (as reflected in the Security Safeguards and Retention sections).
- Timely breach notifications to affected users and the Data Protection Board following the structured process outlined in the Rules.
- Transparent publication of the DPO or authorised representative’s contact details.
- Advance notice before data erasure and adherence to the statutory minimum retention period.
- Verifiable parental consent for processing child data and confirmation of lawful guardian consent for persons with disabilities.
- Additional obligations for Significant Data Fiduciaries including annual DPIA, independent audit and potential data localisation requirements.
- Government directions that may restrict cross border transfers of personal data.
- Intimation to individuals when their data is processed for State subsidies, benefits, licences or permits.
- Flexibility for research and statistical processing when compliant with prescribed standards.
Sarvaank Associates continues to assist clients in interpreting the Act, mapping obligations to internal processes and building practical, implementable data protection frameworks suited to their sector and scale.
