New Delhi: The Ministry of Electronics and Information Technology has notified the rules of the controversial Digital Personal Data Protection (DPDP) Act, 2025, with immediate effect, reports said today, November 14. At first, the DPDP Act’s administrative rules will kick into action and, over the next 18 months, there will be step-wise notification of its other rules.

The government has also operationalised with immediate effect Section 44(3) of the DPDP Act, which has a direct bearing on Section 8(1)(j) of the Right to Information (RTI) Act. Provisions related to penalties are also being brought into immediate effect.

On pen and paper, the DPDP Act is India’s first law to preserve the privacy of individuals and lays the onus on platforms to secure informed consent from users. This is bound to change the way individuals interact with platforms, and will also make platforms liable to preserve – or delete on request – private information of all citizens.

The staggered implementation of the rules, over the next 18 months, will give companies time to raise their standards to the level of the law. At the moment, the government has enforced terms related to setting up a data protection board (and the salaries and conditions of employment of its members), and its powers to enforce penalties, etc.

The Ministry of Electronics and Information Technology (MEITY) has also immediately operationalised Section 44(3) of the DPDP Act, which may serve as a blow to citizens’ right to information, for it overrides the RTI Act’s Section 8(1)(j). That section allowed the disclosure of information in the public interest, or when it served a larger public cause. However, the provision in the DPDP Act makes it incumbent on information commissioners and other public authorities to ensure that disclosures under the RTI Act are in sync with the new privacy law.

Anjali Bhardwaj, prominent RTI activist, said on X on the evening of November 14:

Under the Act, clear notices must be issued to all users of digital platforms, any breach in the data security would have to be notified to users, and there will be limits on how much (and what kind of) data digital platforms are allowed to retain. Besides, data fiduciaries – those who are responsible to protect user privacy – will have to follow strict compliance standards.

The rules spell out how companies must collect, secure, retain and erase personal data under the DPDP Act. However, many of these rules will only come into effect a year from today, or even later.

Consultations over the DPDP Act and its rules were on since January 2025, though the law had been in the works for close to a decade. Especially for children, digital platforms will have to exercise both caution and compliance under the new legal regime, before allowing any personal information to enter the public domain.

Also read: Digital Personal Data Protection Law Raises Questions About Consistency With Right to Privacy Ruling

Personal information under the law is defined as information that can lead to the identification of an individual, and not just direct information about any person, such as their name or address.

What of press freedom?

This law had been, in a sense, hanging fire since 2023. The long delay is over, though implementation will not be immediate. One reason the implementation has been delayed is the objections raised against some of its provisions. The DPDP Act and its rules have drawn serious criticism for drawing a hard line against privacy violations, even when public interest is involved.

For example, an exemption clause in most privacy laws worldwide protects journalists, and such a provision was included in an earlier draft of the Indian DPDP Act. But it was not included in later versions of the law.

This, according to experts on privacy, will make it difficult for investigative journalists to do their work. They will not, for instance, be able to identify wrongdoers or even mention the designations or positions they hold, whether in government or private concerns, as it might amount to a violation of their right to privacy under the new law.

Journalists would need express permission before writing about people, including the subjects of their investigation, which is being seen as a major roadblock to their professional duties. The hefty fines – of up to Rs 500 crore per violation – are also being criticised for enforcing a chilling effect on free speech.

Also read: Key Highlights of Justice Chandrachud's Judgment in the Right to Privacy Case

Privacy activists have been raising the concern that the law does not define data fiduciary accurately, but instead follows a sweeping definition of the term, to include even journalists. This would make a wide range of people responsible for protecting the privacy of others, including those lacking the capacity to enforce privacy rules.

This story was updated at 8:50pm on November 14 to add detail related to the DPDP Act and its impact on the RTI Act.

The Wire is now on WhatsApp. Follow our channel for sharp analysis and opinions on the latest developments.