⁦DPDP Act / DPDP Rules⁩

⁦India⁩ پرائیویسی

حیثیت

⁦Enacted; phased in. Rules notified 13 Nov 2025 (G.S.R. 846(E)). Board rules in force 13 Nov 2025; consent-manager rules from 13 Nov 2026; most business obligations from 13 May 2027. Sources differ on which rules start on 13 Nov 2026.⁩ذرائع: ⁦meity.gov.in⁩, ⁦hlc.com⁩, ⁦dlapiperdataprotection.com⁩

یہ کن پر لاگو ہوتا ہے

⁦Processing of digital personal data in India, and processing outside India linked to offering goods or services to people in India. Personal/domestic use and data made public by the individual are excluded.⁩✓⁦DPDP Act s.3 ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

سائز کی حدیں

⁦No size threshold: every Data Fiduciary is covered. Government may designate Significant Data Fiduciaries (SDFs) based on data volume, sensitivity and risk; SDFs carry extra duties.⁩✓⁦DPDP Act s.10(1) ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩, ⁦static.pib.gov.in⁩

ریگولیٹر

⁦Data Protection Board of India (appeals to TDSAT); rules made by the Ministry of Electronics and IT (MeitY)⁩✓⁦DPDP Act ss.18, 27, 29, 40; DPDP Rules rr.17–21 ↗⁩ · ذرائع: ⁦static.pib.gov.in⁩, ⁦dlapiperdataprotection.com⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦From 13 May 2027 (DPDP Rule 7): inform the Board without delay and file a detailed report within 72 hours of becoming aware (extendable by the Board); tell each affected person without delay in plain language. In force now: report specified cyber incidents to CERT-In within 6 hours (CERT-In Directions, 28 Apr 2022).⁩✓⁦DPDP Act s.8(6); DPDP Rules r.7 (commencement r.1); CERT-In Directions 28 Apr 2022 para (ii) (IT Act s.70B(6)) ↗⁩ · ذرائع: ⁦cert-in.org.in⁩, ⁦static.pib.gov.in⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦From 13 May 2027: people can ask for access, correction, completion, updating and erasure of their data (DPDP Act ss.11–12). Neither the Act nor the Rules set a fixed reply deadline for these requests; grievances must be resolved within a reasonable period not exceeding 90 days (Rule 14(3), Act s.13).⁩⁦DPDP Act ss.11–13; DPDP Rules r.14(3) ↗⁩ · ذرائع: ⁦static.pib.gov.in⁩

ڈیٹا پروٹیکشن آفیسر

⁦From 13 May 2027: all fiduciaries must publish contact details of a person who can answer data queries (a designated officer or DPO). Significant data fiduciaries must appoint an India-based DPO reporting to the board.⁩✓⁦DPDP Act s.8(9), s.10(2)(a); DPDP Rules r.9 ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

مقامی نمائندہ

⁦No separate local representative rule. Foreign fiduciaries in scope must still publish a contact person; SDF DPOs must be based in India.⁩✓⁦no provision (contact: Act s.8(9); SDF DPO in India: s.10(2)(a)) ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Allowed by default unless the government restricts a country or conditions by order. Sector rules (e.g. RBI, SEBI) may require localisation. SDFs may face data-localisation directions and cannot send specified traffic data abroad.⁩✓⁦DPDP Act s.16(1)–(2); DPDP Rules r.15, r.13(4) ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

کوکیز اور رضامندی

⁦From 13 May 2027: consent must be free, specific, informed and unambiguous, after a clear notice, and can be withdrawn as easily as given. Verifiable parental consent is needed for under-18s; no tracking or targeted ads aimed at children.⁩✓⁦DPDP Act ss.5, 6(1), 6(4), 9(1), 9(3), 2(f); DPDP Rules rr.3, 10 ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦meity.gov.in⁩, ⁦dlapiperdataprotection.com⁩

زیادہ سے زیادہ سزا

⁦Up to INR 250 crore per breach for failing to keep reasonable security safeguards; up to INR 200 crore for breach-notice or children⁩'⁦s data failures; up to INR 150 crore for breaching SDF duties; up to INR 50 crore for other violations.⁩✓⁦DPDP Act s.33⁩ & ⁦Schedule items 1–4, 7 ↗⁩ · ذرائع: ⁦meity.gov.in⁩, ⁦amlegals.com⁩, ⁦static.pib.gov.in⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦From 13 May 2027: give a clear, itemised privacy notice and get valid consent, or rely on a listed legitimate use⁩
• ⁦From 13 May 2027: get verifiable parental consent before processing data of anyone under 18⁩
• ⁦From 13 May 2027: put reasonable security safeguards in place and bind processors by contract⁩
• ⁦From 13 May 2027: report breaches to the Board without delay, file a full report within 72 hours, and notify affected people (now: cyber incidents to CERT-In within 6 hours)⁩
• ⁦From 13 May 2027: handle access, correction and erasure requests, and resolve grievances within 90 days⁩
• ⁦From 13 May 2027: delete data once its purpose ends; large e-commerce, social and gaming platforms delete after 3 years of inactivity⁩
• ⁦From 13 May 2027: publish a contact person for data queries; if designated an SDF, appoint an India-based DPO and run annual DPIAs and audits⁩

حالیہ تبدیلیاں

⁦Rules notified 13 Nov 2025 with an 18-month phase-in to 13 May 2027. In Jan-Feb 2026 MeitY consulted on shortening this to 12 months; no amendment notified as of Oct 2026. Data Protection Board appointments: not yet confirmed from the Gazette.⁩

ذرائع

• بنیادی ذریعہ: ⁦https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf⁩
• دوسرا ذریعہ: ⁦https://ssrana.in/articles/meity-notifies-final-digital-personal-data-protection-rules-2025/⁩
• ریگولیٹر: ⁦Data Protection Board of India (appeals to TDSAT); rules made by the Ministry of Electronics and IT (MeitY)⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.