India's First Privacy-Focused Law DPDP Rules 2025 Goes Live: What It Means For Users

The Ministry of Electronics and Information Technology has introduced the Digital Personal Data Protection Rules 2025 or DODP Rules 2025. It marks the initiation of full operations of the Digital Personal Data Protection Act, 2023, hailed as India's first comprehensive data law. It revolves around protecting digital data and setting out obligations of entities handling this data and rights and duties of the individuals.The DPDP Rules 2025 offer a consent-based system in order to protect the personal data of people using social media platforms like Instagram, Facebook, or ecommerce platforms like Flipkart and Amazon, or any digital payments application. The main focus here is to make sure that the users know how their data is used so that they

can have more control over the same. Under the new ruled, platforms and companies found mishandling the fata will face heavy penalties comprising up to Rs 250 crores for serious failures of data protection. All the apps and companies that collect data as of now have been asked to comply with all the rules in 18 months, after which, they can incur a fine. The law mainly works on two things - Data Principals and Data Fiduciary. Starting with Data Fiduciary, it is a company or individual that determines why the data is being processed and how that processing will be carried out. On the other hand, the Data Principal is the individual to whom the data belongs or the person whose information is being collected and stored.

Biggest Changes For Users Due To DPDP Rules 2025

-There are a few things that the companies or the apps you use will have to comply with. Some of the major pointers are:-Companies will have to inform the users immediately about a personal data breach and how they have to tackle the same, or what the next steps are.Also Read: Online Gaming Bill To Make Real Money Apps Suffer But Will It Kill Them? -Organizations will be supposed to delete users' personal data if there is no activity for the last three years. -If the company is storing or collecting data of anyone below the age of 18 years, then they have to take the consent of their guardian to do so. -Companies will be restricted from sending some data overseas.