Key Points

• The DPDP Act and DPDP Rules are the dominant framework, with enforcement now shifting from legislation to operational compliance.
• The Data Protection Board of India is the key enforcement body and can impose substantial monetary penalties.
• Organizations are expected to build data inventories, map processing flows, manage vendors, and document security controls before deadlines hit.
• Breach reporting within 72 hours is a recurring requirement, alongside grievance handling and recordkeeping.
• Child data handling, verifiable consent, and limits on targeted advertising appear as distinct privacy constraints.
• Cross-border processing and exemptions for certain uses, including government or research-related activity, remain important sources of ambiguity.
• A central point of tension is rollout speed: official timelines are being compressed, while observers report uneven readiness across sectors.