India’s Centre has issued a comprehensive directive to ministries and state bodies to implement the Digital Personal Data Protection Act, 2023, with a focus on swift, structured compliance amid upcoming legal and technological shifts.
The Centre has started a government-wide push to prepare for compliance with India’s Digital Personal Data Protection Act, 2023, instructing ministries, state governments and Union Territory administrations to draw up time-bound implementation plans. In an 20 August letter, Cabinet Secretary T V Somanathan asked senior officials to give the exercise high priority and appoint designated officers to supervise progress.
The move comes as the DPDP law becomes the country’s main framework for digital personal data processing. According to policy summaries of the Act, it sets out duties for data fiduciaries, rights for individuals and oversight by the Data Protection Board of India, while MeitY has also notified the Digital Personal Data Protection Rules, 2025 to support implementation. The law is widely seen as India’s first standalone privacy regime for digital data.
Government bodies are expected to conduct a detailed review of their data-handling systems. That includes mapping personal-data processing, building inventories, examining privacy notices, consent arrangements where they apply and grievance redress systems. Departments have also been told to tighten technical and organisational safeguards and to scrutinise contracts with outside vendors and other data processors.
The Cabinet Secretary has also pressed ministries and states to adopt privacy-by-design principles when building or updating digital public services, rather than treating privacy as a later compliance check. Legacy systems are to be upgraded in phases, based on risk. Secretaries and chief secretaries will be responsible for periodic reviews, while MeitY is preparing guidance material, awareness drives, capacity-building efforts and consultations to support the transition. For a government that processes vast amounts of personal information through welfare, taxation, healthcare and identity systems, the exercise will serve as an early test of how the law works in practice.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
