Legal Framework
The website’s India-facing privacy framework is being aligned to the laws and official notifications applicable to the service.
DPDP Act, 2023
The Act establishes the framework for lawful processing of digital personal data and provides for Data Principal rights, obligations of Data Fiduciaries, security, breach response, grievance redressal, and the Data Protection Board.
DPDP Rules, 2025
The Central Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The Rules contain phased commencement dates rather than making every rule operative on the notification date.
Commencement status on 5 October 2026
Under the 13 November 2025 commencement notification, section 6(9), section 27(1)(d), and Rule 4 are scheduled to commence one year after publication, on 13 November 2026. The larger group covering sections 3–5, most of section 6, sections 7–17, 27 other than clause (d), 28–34, 36–37, and 44(2), together with Rules 3–16 and 22–23, is scheduled for eighteen months after publication, on 13 May 2027. The operator should track subsequent notifications and amendments.
Other requirements
The service must also comply with applicable copyright, consumer, cyber-security, intermediary/platform, tax, and other laws that may apply to the operator, users, vendors, or content. This page is not a legal opinion.