India, Dec. 11 -- India's data-protection landscape is undergoing a necessary reset. The Digital Personal Data Protection (DPDP) Act, 2023, and DPDP Rules, 2025, now partially in force, represent a significant shift in how personal information is processed, protected, and governed. For those familiar with the mechanics of data, and ease with which ambiguity has historically been exploited, this transition is overdue. The framework is the country's first comprehensive digital privacy regime, which is citizen-centric, consent-driven, and innovation-aligned. It is built on seven principles: consent and transparency, purpose limitation, minimisation, accuracy, storage limits, security, and accountability.

The Government has opted for a phase...