Data protection law notified, firms get 18 mths to comply

The government has notified the Digital Personal Data Protection (DPDP) Rules, and large parts of the DPDP Act, establishing the operational framework for India’s first comprehensive data privacy law more than two years after Parliament passed the legislation and eight years after the Supreme Court recognised privacy as a fundamental right.

The rules, published in the official gazette on November 13, lay down detailed timelines and obligations for companies handling personal data and create enforceable rights for users, a crucial part of legal framework to operationalise the Supreme Court’s recognition of privacy as a fundamental right in the 2017 Puttaswamy judgment.