Overview
- The rules take effect in phases, with the Data Protection Board activated immediately, consent‑manager registration after 12 months, and core obligations on notice, consent, safeguards and breach reporting after 18 months.
- IT Minister Ashwini Vaishnaw said the government is consulting industry and may amend the rules to shorten the compliance window for large firms once the Data Protection Board is constituted.
- The framework empowers the Centre to set conditions or restrictions on cross‑border transfers of personal and related traffic data, with details such as restricted jurisdictions to be notified later.
- Companies must issue clear, itemised consent notices, implement verifiable parental consent for children, adopt strong security controls, and promptly inform the regulator and affected users in the event of a breach.
- Consent managers are formalised as regulated entities that must register with the Board and maintain records, while experts flag higher compliance costs and critics question broad state exemptions and RTI‑related changes.