|
Dear Clients and Colleagues,
The Ministry of Electronics and Information Technology ('MeitY') has officially notified the long-awaited administrative rules that are required for putting the Digital Personal Data Protection Act (‘DPDP’) into full effect.
The draft rules were initially released for public consultation in January 2025. After reviewing submissions and holding inter-ministerial consultations, the MeitY finalized and published the rules on November 14, 2025. Importantly, several critical issues that we had highlighted in our thought-leadership in January 2025 have now been addressed - offering organizations a clearer path to compliance and risk management.
📄 Click here to read the official gazette notification.
| | |
The rollout roadmap
The 18-month phased compliance timeline under the DPDP Rules provides organizations with the transition runway they need, while supporting a technology-neutral approach to implementation.
| | Other important aspects relating to the rollout | | How different sectors will be impacted | | | Financial Services & FinTech
1. High likelihood of being classified as a significant data fiduciary due to data volume & financial sensitivity.
2. Certain financial data may have localization requirements.
3. Increased scrutiny by the data DPB w.r.t frequent third-party integrations. | Healthcare, Pharma & Digital Health Platforms
1. Sensitive health data puts entities at high risk of SDF classification.
2. Strict verification and guardians' consent required for minors’ health data.
3. Breaches likely treated as "high severity” incidents by the DPB.
4. Strong expectation for retention & erasure. | | Technology Platforms, Digital Media & Ad-Tech
1. Advertising identifiers, behavioural data and profiling may trigger DPIAs and audits.
2. Withdrawal of consent must propagate across all tracking, analytics, re-marketing and partner ecosystems.
3. Any cross-border movement of behavioural or consumer preference data may fall under conditional transfer restrictions. | E-Commerce, Retail & Consumer Platforms
1. Large-scale processing of identity, payment, delivery and behavioural data increases regulatory visibility.
2. Necessity to reconstruct consent journeys for marketing, tracking and loyalty programmes.
3. Vendor and logistics partner data sharing arrangements must be mapped, contractually tightened and auditable. | | Manufacturing, Auto, IoT & Industry 4.0
1. Rapid growth of connected devices means higher exposure to data-from-machines linked to identifiable users (telematics, vehicle apps, smart appliances).
2. Cross-border data flows in global supply chains could be impacted by localization triggers for specific datasets.
3. Enhanced data governance. | Education, EdTech & Skill-Tech
1. Large volumes of minors’ data require verifiable parental consent, making legacy onboarding flows non-compliant.
2. High-risk if student behaviour, performance or psychological analytics are used without clear purpose limitation.
3. Breach of minors’ data will be treated with heightened seriousness.
| | Telecom, Internet Service Providers & Digital Infrastructure
1. Telcos are likely to be among the earliest SDF designees because they process large-scale identity, location and traffic data.
2. Possible restrictions against exporting traffic data, directly referenced in the Rules.
3. Data breach exposure can be systemic and large-scale. | Startups & MSMEs
1. While some obligations may phase in later, core compliance (consent, notices, security) applies universally.
2. Immature data handling practices can lead to disproportionate penalties
3. Startups using customer data for AI/ML without documented purpose or retention rules may be flagged. | | | |
Next steps
With the DPDP rules now addressing specific clarifications, organizations can now move from a "wait & watch" approach to a structured implementation. Here are some of the priorities that you may like to consider outlining.
| | |
In summary
Compared to the January 2025 draft, the final DPDP Rules offer far sharper clarity and stronger regulatory levers. Timelines are now clearly phased, removing earlier ambiguity; the Government’s powers around SDFs and potential localization are more explicit than expected; breach reporting and DPB procedures are more defined; and the framework for Consent Managers has been tightened into a formal, regulated ecosystem. At the same time, broad state exemptions remain largely intact, despite calls for greater narrowing.
With these refinements, the Rules finally give organizations the certainty they need to plan and prioritize compliance. The shift from a conceptual framework to an enforceable regime is now real and the ensuing 12 to18 months will determine which organizations lead and which are caught unprepared.
Our team is ready to help translate these obligations into a practical, risk-based compliance program tailored to your operational realities. If you would like to discuss the impact on your organization or need support with readiness planning, please reach out to contactus@mgcglobal.co.in
Have a great weekend.
Best regards
Markets Team
MGC Global Risk Advisory
| |
About MGC Global Risk Advisory LLP
MGC Global Risk Advisory (‘MGC Global’ or ‘the firm’) is a specialist risk advisory services firm, widely regarded as one of the leading practices in its domain and consistently recognized by multiple forums and industry bodies for the value and impact it delivers to its stakeholders. A member of Allinial Global, the world’s second-largest association of independent accounting and consulting firms, MGC Global brings global perspective with deep local expertise.
MGC Global's service portfolio encompasses enterprise-wide risk management, controls assessments, process optimization, internal audits, fraud and forensic investigations, as well as a comprehensive suite of IT risk advisory services (including cyber risk management, business continuity, data privacy, ISO readiness & compliance and virtual DPO & CISO-as-a-service). The firm also provides comprehensive ESG advisory services, facilitates financial transformation through streamlined reporting, and offers virtual-controller-as-a-service, as well as accounting advisory support. Its HR risk advisory practice encompasses organizational structuring, policies and manuals, rightsizing, balanced scorecards, and cultural development.
| | |
About Allinial Global
Allinial Global (formerly PKF North America) is currently the world's second-largest member-based association. With collective revenues to the tune of approximately US$ 7 billion, Allinial Global has dedicated itself to the success of independent accounting and consulting firms since its founding in 1969.
It currently has member firms in over 110 countries, who have over 28,000 professional staff and over 6,000 partners operating from nearly 700 offices across the globe.
Allinial Global provides its member firms with a broad array of resources and support that benefit both its member firms and their clients in the key impact areas of learning & development, human resources, international outreach, technical support, knowledge-sharing through its specialized communities of practice, information technology and practice management.
| | | | |
