India: Ministry of Electronics and Information Technology issued Digital Personal Data Protection Rules including cybersecurity regulation

On 13 November 2025, the Ministry of Electronics and Information Technology issued the Digital Personal Data Protection Rules implementing the Digital Personal Data Protection Act of 2023. The rules impose obligations on Data Fiduciaries and Data Processors across sectors handling personal data. The rules mandate reasonable security safeguards, including encryption, access controls, logging, and data backups, along with contractual requirements for processors to ensure equivalent protections. In the event of a personal data breach, Data Fiduciaries must notify affected individuals promptly and report to the Data Protection Board with detailed information within 72 hours.