India notifies the DPDP Rules — phased in over 12–18 months
Summary
The government notified the rules under the Digital Personal Data Protection Act. Some provisions apply immediately and the main obligations phase in over 12–18 months. Penalties go up to ₹250 crore per breach.
Key points
- Data fiduciaries must apply security measures such as encryption and notify breaches
- No retention beyond one year without a specific reason
- Notice 48 hours before erasure
For Korean companiesIf you handle consumer survey, app or online-store customer data, design the consent, retention and erasure flow from the start.