⁦DPDP Act / DPDP Rules⁩

⁦India⁩ الخصوصية

الحالة

⁦Enacted; phased in. Rules notified 13 Nov 2025 (G.S.R. 846(E)). Board rules in force 13 Nov 2025; consent-manager rules from 13 Nov 2026; most business obligations from 13 May 2027. Sources differ on which rules start on 13 Nov 2026.⁩المصادر: ⁦meity.gov.in⁩, ⁦hlc.com⁩, ⁦dlapiperdataprotection.com⁩

على من ينطبق

⁦Processing of digital personal data in India, and processing outside India linked to offering goods or services to people in India. Personal/domestic use and data made public by the individual are excluded.⁩✓⁦DPDP Act s.3 ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

حدود الحجم

⁦No size threshold: every Data Fiduciary is covered. Government may designate Significant Data Fiduciaries (SDFs) based on data volume, sensitivity and risk; SDFs carry extra duties.⁩✓⁦DPDP Act s.10(1) ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩, ⁦static.pib.gov.in⁩

الجهة الرقابية

⁦Data Protection Board of India (appeals to TDSAT); rules made by the Ministry of Electronics and IT (MeitY)⁩✓⁦DPDP Act ss.18, 27, 29, 40; DPDP Rules rr.17–21 ↗⁩ · المصادر: ⁦static.pib.gov.in⁩, ⁦dlapiperdataprotection.com⁩

الإبلاغ عن الخروقات أو الحوادث

⁦From 13 May 2027 (DPDP Rule 7): inform the Board without delay and file a detailed report within 72 hours of becoming aware (extendable by the Board); tell each affected person without delay in plain language. In force now: report specified cyber incidents to CERT-In within 6 hours (CERT-In Directions, 28 Apr 2022).⁩✓⁦DPDP Act s.8(6); DPDP Rules r.7 (commencement r.1); CERT-In Directions 28 Apr 2022 para (ii) (IT Act s.70B(6)) ↗⁩ · المصادر: ⁦cert-in.org.in⁩, ⁦static.pib.gov.in⁩

مهلة الرد على طلبات البيانات الشخصية

⁦From 13 May 2027: people can ask for access, correction, completion, updating and erasure of their data (DPDP Act ss.11–12). Neither the Act nor the Rules set a fixed reply deadline for these requests; grievances must be resolved within a reasonable period not exceeding 90 days (Rule 14(3), Act s.13).⁩⁦DPDP Act ss.11–13; DPDP Rules r.14(3) ↗⁩ · المصادر: ⁦static.pib.gov.in⁩

مسؤول حماية البيانات

⁦From 13 May 2027: all fiduciaries must publish contact details of a person who can answer data queries (a designated officer or DPO). Significant data fiduciaries must appoint an India-based DPO reporting to the board.⁩✓⁦DPDP Act s.8(9), s.10(2)(a); DPDP Rules r.9 ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

الممثل المحلي

⁦No separate local representative rule. Foreign fiduciaries in scope must still publish a contact person; SDF DPOs must be based in India.⁩✓⁦no provision (contact: Act s.8(9); SDF DPO in India: s.10(2)(a)) ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

نقل البيانات إلى الخارج

⁦Allowed by default unless the government restricts a country or conditions by order. Sector rules (e.g. RBI, SEBI) may require localisation. SDFs may face data-localisation directions and cannot send specified traffic data abroad.⁩✓⁦DPDP Act s.16(1)–(2); DPDP Rules r.15, r.13(4) ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

ملفات تعريف الارتباط والموافقة

⁦From 13 May 2027: consent must be free, specific, informed and unambiguous, after a clear notice, and can be withdrawn as easily as given. Verifiable parental consent is needed for under-18s; no tracking or targeted ads aimed at children.⁩✓⁦DPDP Act ss.5, 6(1), 6(4), 9(1), 9(3), 2(f); DPDP Rules rr.3, 10 ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

أقصى عقوبة

⁦Up to INR 250 crore per breach for failing to keep reasonable security safeguards; up to INR 200 crore for breach-notice or children⁩'⁦s data failures; up to INR 150 crore for breaching SDF duties; up to INR 50 crore for other violations.⁩✓⁦DPDP Act s.33⁩ & ⁦Schedule items 1–4, 7 ↗⁩ · المصادر: ⁦meity.gov.in⁩, ⁦amlegals.com⁩, ⁦static.pib.gov.in⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦From 13 May 2027: give a clear, itemised privacy notice and get valid consent, or rely on a listed legitimate use⁩
• ⁦From 13 May 2027: get verifiable parental consent before processing data of anyone under 18⁩
• ⁦From 13 May 2027: put reasonable security safeguards in place and bind processors by contract⁩
• ⁦From 13 May 2027: report breaches to the Board without delay, file a full report within 72 hours, and notify affected people (now: cyber incidents to CERT-In within 6 hours)⁩
• ⁦From 13 May 2027: handle access, correction and erasure requests, and resolve grievances within 90 days⁩
• ⁦From 13 May 2027: delete data once its purpose ends; large e-commerce, social and gaming platforms delete after 3 years of inactivity⁩
• ⁦From 13 May 2027: publish a contact person for data queries; if designated an SDF, appoint an India-based DPO and run annual DPIAs and audits⁩

التغييرات الأخيرة

⁦Rules notified 13 Nov 2025 with an 18-month phase-in to 13 May 2027. In Jan-Feb 2026 MeitY consulted on shortening this to 12 months; no amendment notified as of Oct 2026. Data Protection Board appointments: not yet confirmed from the Gazette.⁩

المصادر

• المصدر الأساسي: ⁦https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf⁩
• المصدر الثاني: ⁦https://ssrana.in/articles/meity-notifies-final-digital-personal-data-protection-rules-2025/⁩
• الجهة الرقابية: ⁦Data Protection Board of India (appeals to TDSAT); rules made by the Ministry of Electronics and IT (MeitY)⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.