DPDP-DIGITAL PERSONAL DATA PROTECTION ACT AMENDMENT
- Dec 24, 2025
- 1 min read
Updated: 6 days ago
Dec 2025 || Corporate Law, Tech & AI, Dispute Resolution || Press & Releases
No major amendment to India's Digital Personal Data Protection (DPDP) Act, 2023, has been passed as of February 2026.
The DPDP Act, 2023, regulates digital personal data processing, requiring consent-based processing, data accuracy, security safeguards, and erasure post-purpose. Rules notified in November 2025 outline phased implementation: Data Protection Board setup by November 2025, Consent Managers by November 2026, and full compliance (notices, security, breaches) by May 2027.
The 2025 bill seeks stronger protections like defining "harm" (e.g., financial loss, profiling, surveillance), mandating explicit consent for data sharing (including cross-border), introducing rights to compensation, data portability, and "right to be forgotten" against government entities, and enhancing Data Protection Board independence via a multi-stakeholder selection committee.
Review data practices now: Ensure clear consent notices, implement ISO 27001-equivalent security, appoint Data Protection Officers if a Significant Data Fiduciary, and prepare breach notifications. Track the amendment bill on sansad.in, as passage could impose stricter sharing rules and penalties up to ₹250 crore.
Ongoing Supreme Court PILs challenge DPDP's RTI Act override, creating disclosure exemptions without public interest balancing. Recent rules emphasize "informed consent" amid digital literacy concerns, urging avoidance of dark patterns in marketing. Consult legal experts for tailored audits, especially with your AI marketing and startup focus.
ADVISOR
You can reach to our team to find out more about what we do and how we can collaborate
Related Posts
Comments