Understanding India’s Digital Personal Data Protection Rules 2025

EY India Insights breaks down the Digital Personal Data Protection Act (DPDP) 2025 along with the Rules and their implications for individuals, organizations and India’s digital governance ecosystem.

In this episode, Ritika Loganey Gupta, Partner, Tax & Regulatory Services, EY India and Lalit Kalra, Partner, Cybersecurity and National Leader-Data Privacy, EY India, decode the newly notified rules and share a practical roadmap for readiness.

Key takeaways:

• DPDP Act and Rules empower individual data control and enforces accountability on all organizations, including companies based outside India.
• Implementation unfolds in three phases: immediate activation of the Data Protection Board, consent-manager onboarding in one year, and full compliance within 18 months.
• Organizations must maintain one-year tamper-proof logs and align data retention with purpose, keeping in mind additional requirements from RBI, SEBI, IRDAI and the Companies Act.
• Penalties for non-compliance range up to INR 800 crore for violations such as breach reporting failures or inadequate security safeguards.

Subscribe to us on EY India Insights podcast for more real-time updates on EY India Insights Podcast.

Amazon podcasts | YouTube Music | Spotify 

Listen to EY India podcasts for latest insights on business, finance, industry trends, and global challenges from professionals across various sectors.