India Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025
India's general law on processing digital personal data: Data Fiduciary duties, Data Principal rights and enforcement by the Data Protection Board of India, with substantive duties in force eighteen months after the Rules.
- Applies in
- India
- Edition
- Rules G.S.R. 846(E) of 13 Nov 2025; duties phased to May 2027
- Area
- Data protection & privacy
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- Sec. 5 / Rule 3Give a standalone, plain-language notice itemising data and purposeNotice
- Sec. 6Obtain free, specific, informed consent and allow withdrawalConsent
- Sec. 8(5) / Rule 6Apply reasonable security safeguards, including access control and one-year logsSecurity
- Sec. 8(6) / Rule 7Notify the Board and affected Data Principals of a breach; full report in 72hBreach notification
- Sec. 8(7) / Rule 8Erase personal data once the purpose is no longer servedRetention
- Sec. 9 / Rule 10Obtain verifiable parental consent before processing children's dataChildren
- Sec. 10 / Rule 13Significant Data Fiduciary: appoint a DPO, run an annual DPIA and auditAccountability
- Secs. 11-14 / Rule 14Publish how to exercise access, correction and erasure rights; resolve grievances within 90 daysData subject rights
How Amoreg keeps you on it.
Enable the India Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025 and the Monitor suggests MeitY as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read meity.gov.in/data-protection-framework
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: give a standalone, plain-language notice itemising data and purpose
- Rule
- India Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025, Sec. 5 / Rule 3
- Area
- Notice
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- UK GDPR & Data Protection Act 2018The UK data protection regime after Brexit, with the ICO as supervisory authority.United Kingdom · 9 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- Data Protection (Jersey) Law 2018Jersey's GDPR-equivalent law and the Data Protection Authority (Jersey) Law 2018 registration regime.Jersey · 9 controls
- Isle of Man GDPR & LED Implementing Regulations 2018The applied GDPR under the Data Protection Act 2018 (Isle of Man).Isle of Man · 9 controls
- Cayman Islands Data Protection ActEight data protection principles modelled on the UK Data Protection Act 1998, in force since 2019.Cayman Islands · 6 controls
Also in India
- SEBI (Intermediaries) Regulations, 2008SEBI regulations for all registered intermediaries, covering registration, fit-and-proper criteria, general conduct, inspection and enforcement.India · 8 controls
- SEBI (Prohibition of Insider Trading) Regulations, 2015SEBI regulations preventing insider trading and controlling unpublished price sensitive information (UPSI) at listed companies, intermediaries and fiduciaries.India · 8 controls
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015SEBI regulations for the continuing disclosure and corporate governance obligations of listed entities, read with the LODR master circular.India · 8 controls
- SEBI (Investment Advisers) Regulations, 2013SEBI regulations for the registration, qualifications and client-facing conduct of investment advisers, read with the IA master circular.India · 8 controls
- SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)SEBI framework setting cybersecurity and cyber resilience requirements for SEBI-regulated entities, graded by entity category.India · 8 controls
- RBI (Commercial Banks – Know Your Customer) Directions, 2025RBI's binding KYC/AML/CFT direction for commercial banks under the PML Act and Rules, replacing the repealed 2016 KYC Master Direction.India · 8 controls
Questions
Does Amoreg watch for changes to the India Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025?
Yes. Enable it and the Monitor suggests Ministry of Electronics and Information Technology as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the India Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records Rules G.S.R. 846(E) of 13 Nov 2025; duties phased to May 2027. Editions were last verified in August 2026, and the Monitor records new publications as they appear.