Before you read
This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.
India
Sources last checked:
India’s Digital Personal Data Protection Act 2023 takes effect in stages.1 The Rules that complete it were notified on 14 November 2025, with an 18-month period for phased compliance.2
Source note: the Government’s press page could not be reached. The Rules are described from its published summary, not their full text, so the exact date of each phase is left out.
Who it covers
Digital personal data processed in India, and processing outside India connected with offering goods or services to people in India.3
Consent
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action.4
Your rights
You can obtain information about your data,5 have it corrected, completed, updated or erased,6 use a means of redress from the organisation,7 and name someone to act for you if you die or become incapacitated.8
Children
A child is anyone under 18.9 Verifiable consent from a parent is needed before processing a child’s data.10
When data is breached
The organisation must inform the Data Protection Board and each person affected.11
Sending data abroad
The government may restrict transfers to countries it names.12
Penalties
Up to 250 crore rupees for failing to take reasonable security safeguards, and up to 200 crore for failing to give breach notice or for breaking the rules on children.13