The government on Friday (November 14) notified the much-awaited rules under the Digital Personal Data Protection (DPDP) Act, laying out a staggered implementation roadmap of up to 18 months for India’s new data protection regime.

A key provision of the notified rules relates to data localisation, a move being watched closely by global technology companies.

The rules mandate that large data fiduciaries store certain categories of personal data — as specified by the government — within India. At the same time, the rules permit the transfer of personal data outside India, subject to additional requirements that may be prescribed by the Centre.

Implementation timeline

The rules provide a phased rollout:

Immediate effect: Rules governing the setting up and appointment of the Chairperson a

See Full Page