DPDP rollout to tighten enterprise accountability

The government’s notification of the Digital Personal Data Protection (DPDP) Rules, 2025 has moved India’s data protection law into an active enforcement phase, sharply raising the bar on enterprise accountability and compliance. The Rules, which operationalise the DPDP Act, 2023, set out a phased rollout over roughly 18 months, during which organisations will need to put in place robust governance, consent and security mechanisms to avoid stiff penalties.

With the Data Protection Board now empowered to investigate violations and impose penalties up to ₹250 crore for serious lapses such as inadequate security safeguards or failure to report breaches, data protection has effectively become a boardroom and C‑suite issue. Enterprises are expected to implement explicit and informed consent frameworks, granular privacy notices, and clear processes for access, correction and erasure of personal data, covering both in‑house systems and third‑party processors. Large data‑heavy organisations designated as Significant Data Fiduciaries will face tighter obligations, including appointing senior‑level data protection officers, conducting regular Data Protection Impact Assessments and undergoing independent audits.

Industry experts say the staggered timetable offers little room for complacency, as the first phase already brings enforcement and penalties into play while subsequent phases progressively switch on additional duties and ecosystem elements such as consent managers. As one cybersecurity and privacy consultant put it, the DPDP rollout “effectively hardwires accountability into the enterprise, and any organisation treating this as mere box‑ticking compliance is underestimating both the regulatory risk and the trust deficit that a breach can create.”

CT Bureau