India has officially activated its first-ever digital privacy legislation with the notification of rules under the Digital Personal Data Protection (DPDP) Act. The new regulations set out a structured framework for companies and other stakeholders to comply, giving them a period of up to 18 months to align with the administrative requirements outlined in the Act. Meanwhile, consent managers, who act on behalf of users, are granted up to 12 months to complete their registration.

The rules mandate that social media platforms, internet intermediaries, and all companies handling user data provide individuals—referred to as “data principals”—with a clear and itemized overview of the personal information being collected. They must also explicitly communicate the purpose for which this data will

See Full Page