India’s Digital Personal Data Protection (DPDP) Act of 2023 and its supporting DPDP Rules (finalized November 2025) establish the country’s first comprehensive digital privacy regime, covering collection, processing, storage, and transfer of personal data. Many employer obligations — like notice, consent, breach reporting, and individual rights handling — will phase in through mid-May 2027. Covered businesses must plan now for compliance or face significant penalties once enforcement begins.
