Government notifies DPDP rules, sets 18-month roadmap for data protection regime

The government on Friday (November 14) notified the much-awaited rules under the Digital Personal Data Protection (DPDP) Act, laying out a staggered implementation roadmap of up to 18 months for India’s new data protection regime.

A key provision of the notified rules relates to data localisation, a move being watched closely by global technology companies.

The rules mandate that large data fiduciaries store certain categories of personal data — as specified by the government — within India. At the same time, the rules permit the transfer of…