The Ministry of Electronics & Information Technology (MeitY) notified the Digital Personal Data Protection (DPDP) Rules, 2025 on November 13, 2025, operationalizing the DPDP Act, 2023 and establishing India’s statutory compliance framework for personal data handling. Key provisions include mandatory clear consent mechanisms, registration of consent managers, reasonable security safeguards (encryption, access control, breach detection), mandatory breach reporting to the Data Protection Board, and strict data retention and deletion requirements. Organizations must comply with enhanced protections for children’s data (requiring parental consent), grant data principals rights to access, correction, erasure and grievance redressal, and if classified as Significant Data Fiduciaries (SDFs), conduct Data Protection Impact Assessments and periodic audits. While certain rules took effect from November 14, 2025, organizations have an 18-month transition period to implement comprehensive privacy and data governance systems before full enforcement.