India implements Digital Personal Data Protection Act

India is implementing the Digital Personal Data Protection (DPDP) Act and its accompanying 2025 rules, which fundamentally change how organizations collect, store, and manage personal data. The Ministry of Electronics and Information Technology notified the rules in November 2025, establishing a staggered compliance timeline. While Consent Manager registration is required by November 2026, full substantive enforcement and the penalty regime are set to take effect in mid-May 2027.

The regulations apply to all entities collecting personal data, including businesses and nonprofits. For the nonprofit sector, the Act necessitates a shift away from informal data collection methods, such as using WhatsApp or offline forms, toward more structured and secure processes. This is particularly critical for organizations handling sensitive information regarding minors, health, or vulnerable communities.

For businesses, data privacy has transitioned from a legal footnote to a boardroom priority. The Act mandates informed and specific consent, data minimization, and strict breach notification protocols. The Data Protection Board of India has been established with quasi-judicial authority to investigate complaints, and serious violations can result in penalties reaching ₹250 crore.