> ## Content Index
> Fetch the complete content index at: https://thecyberstories.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# India's new data protection rules: what changes for you, and when
- URL: https://thecyberstories.com/dpdp-rules-what-changes-2/
- Published: 2026-11-03T02:42:02.000Z
- Updated: 2026-11-03T02:42:02.000Z
- Description: India's Digital Personal Data Protection Rules set out how companies must ask for your data, protect it, and tell you when it leaks. They arrive in stages over eighteen months, so not everything applies yet. Here is what they promise, in plain words.
- Author: Raja Sekhar Thota
- Tags: Privacy, #csv-6ae949f009b5eaaa55a98e44, #Import 2026-11-03 16:27

You download an app to split a restaurant bill. It asks for your contacts, your location, and permission to read your messages. You tap accept, because the bill is waiting and everyone is looking at you.

India's data protection law is meant to change what happens at that moment. Here is what the Digital Personal Data Protection Rules, published by the government, say you're entitled to.

## The principles behind it

The law [rests on seven principles, including consent and transparency, purpose limitation and data minimisation](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com), alongside accuracy, limits on storage, security safeguards, and accountability. In everyday terms: tell people what you're collecting and why, take only what you need, and don't keep it forever.

## What changes for you

**Clearer consent.** Companies must give [a separate consent notice that is clear and easy to understand](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com), explaining the specific purpose for which your data is used. Our reading: a vague line buried in a long policy shouldn't pass.

**A say over your data.** You can ask companies about the data they hold and request changes, and they [must respond within ninety days](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com).

**Being told about leaks.** If your data is breached, the company [must inform you without delay](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com), in plain language, explaining [what happened, the likely impact, and what's being done](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com).

**Protection for children.** Using a child's data needs [verifiable consent from a parent or guardian](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com), with limited exceptions for things like healthcare and education.

**Somewhere to complain.** You'll be able to [file complaints online and track them through a portal and app](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com).

The penalties are meant to make companies listen. Failures around breaches, and violations involving children, [can each attract penalties of up to ₹200 crore](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com).

## The catch: it's arriving in stages

The Rules give organisations [an eighteen-month period for phased compliance](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com). So some protections described here may not bind every company yet. When you're relying on a specific right, check whether that part is already in force.

## What you can do now

1. **Read the purpose, not just the button.** If an app asks for data its feature doesn't need, decline or find another app.
2. **Keep breach notices.** Under the new rules, they should tell you what happened and what to do. If one doesn't, that's worth noting.
3. **Ask companies what they hold about you.** The more people ask, the faster good habits spread.
4. **Watch for scams pretending to be compliance.** New rules bring fake calls about verifying your data. Real companies won't ask for OTPs or passwords to do it.

This is a summary of the government's description, not legal advice. Businesses that handle personal data should take proper legal advice on what applies to them, and when.

## Sources

- [DPDP Rules, 2025: backgrounder (PIB)](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655®=48&lang=2&ref=thecyberstories.com)