印度数据保护制度下的合规路线图

INTRODUCTION

引言

The Ministry of Electronics and Information Technology (MeitY), through its notification dated 14 November 2025, issued the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). These Rules operationalize India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), establishing a citizen-centric framework for the responsible use of personal data.

印度电子和信息技术部于2025年11月14日通过公告发布了《2025年数字个人数据保护规则》（"DPDP规则"）。这些规则使印度的《2023年数字个人数据保护法》（"DPDP法案"）得以实施，建立了一个以公民为中心的个人数据负责任使用框架。

The DPDP Act, read with the Rules, constitutes the country’s primary legal framework for the protection of digital personal data. It prescribes clear obligations for the lawful processing of personal data and safeguards against misuse and unauthorized access.

DPDP法案及其配套规则构成了该国保护数字个人数据的主要法律框架。它规定了合法处理个人数据的明确义务，并提供了防止滥用和未经授权访问的保障措施。

The DPDP Act and the Rules apply to entities processing digital personal data in connection with goods or services, including personal data that is initially collected in non-digital form and subsequently digitized.

DPDP法案及其规则适用于处理与商品或服务相关的数字个人数据的实体，包括最初以非数字形式收集而后数字化的个人数据。

THE ACT 

法案

The Act introduces three key entities: the Data Principal, the Data Fiduciary, and the Data Processor.

该法案引入了三个关键主体：数据主体、数据受托人和数据处理者。

·A Data Principal is the individual to whom the personal data relates and is granted rights over such data, including the right to access, correct, and erase it. 

数据主体是指个人数据所关联的个人，并被授予对此类数据的权利，包括访问、更正和删除该等数据的权利。

·A Data Fiduciary refers to any organization, company, or government body that determines the purpose and means of processing personal data and is primarily responsible for ensuring that such data is processed lawfully

and securely. 

数据受托人指任何决定个人数据处理目的和方式的组织、公司或政府机构，主要负责确保此类数据得到合法且安全的处理。

·A Data Processor, on the other hand, is a third party that processes personal data on behalf of the Data Fiduciary.

数据处理者则是代表数据受托人处理个人数据的第三方。

The DPDP Act establishes the statutory framework, while the DPDP Rules set out the operational details- with this enforcement - the regime transitions from a policy framework into a fully enforceable compliance structure. It further delineate the roles, responsibilities, and specific obligations applicable to Data Fiduciaries, Data Processors, and Consent Managers.

DPDP法案确立了法定框架，而DPDP规则则规定了操作细节——随着该法案的执行，该制度从政策框架转变为完全可执行的合规结构。它进一步阐述了适用于数据受托人、数据处理者和同意管理人的角色、职责和具体义务。

SALIENT FEATURES OF THE RULES:

规则的主要特点：

A.Notice and Consent: 

A. 通知与同意：

A Data Fiduciary is required to provide a clear and standalone notice prior to the collection of personal data, specifying the nature of data collected and the precise purpose of its use. The notice must also include simple mechanisms for withdrawal of consent, exercise of rights, and grievance redressal before the Data Protection Board, with the Rules emphasizing that withdrawal of consent should be as easy as giving it. In the case of children’s data, verifiable consent must be obtained from a parent or legal guardian prior to processing.

数据受托人需要在收集个人数据之前提供清晰且独立的通知，明确所收集数据的性质及其使用的确切目的。通知还必须包含用于撤回同意、行使权利以及向数据保护委员会申诉的简单机制，规则强调撤回同意应如同给予同意一样容易。对于儿童数据，在处理前必须获得父母或法定监护人的可验证同意。

The Rules permit cross-border data transfers subject to prescribed conditions by the government and require organizations to implement reasonable security safeguards, including encryption, access controls, and periodic audits. 

规则允许在满足政府规定条件的前提下进行跨境数据传输，并要求组织实施合理的安全保障措施，包括加密、访问控制和定期审计。

B.Obligation of Consent Managers: 

B. 同意管理人的义务：

The DPDP Rules also introduces Consent Managers who are entities that enable data principals to give, manage, review, and withdraw their consent for the processing of their personal data. The Rules cast an obligation on the Consent Manager to operate a secure and accessible digital platform that allows individuals to view, manage, and withdraw consent. They must publish required company information, avoid conflicts of interest, and cannot outsource their obligations. They must retain records for seven years and maintain a strong audit mechanism, reporting outcomes to the Data Protection Board when required. Only a company incorporated in India and having a net worth of Rs. 2 crore and above can become Consent Managers. 

DPDP规则还引入了同意管理人，这些实体使数据主体能够给予、管理、审查和撤回对其个人数据处理的同意。规则规定同意管理人有义务运营一个安全且可访问的数字平台，允许个人查看、管理和撤回同意。他们必须公布所需的公司信息，避免利益冲突，并且不能外包其义务。他们必须将记录保存七年，并维护一个强大的审计机制，在需要时向数据保护委员会报告结果。只有在印度注册成立且净资产达到2000万卢比及以上的公司才能成为同意管理人。

C.Security Safeguard Measure 

C. 安全保障措施

Under this measure both Data Fiduciaries and Data Processors are obligated to implement adequate security safeguards, formalized through contractual arrangements that address data protection measures such as encryption, masking, access controls, and incident detection. Adequate back-up and continuity plain must be maintained, with Logs, traffic data, and related information should be retained for at least one year. 

根据此项措施，数据受托人和数据处理者都有义务实施充分的安全保障措施，通过合同安排正式确定，这些安排涉及数据保护措施，如加密、掩码、访问控制和事件检测。必须维护充分的备份和连续性计划，日志、流量数据及相关信息应至少保留一年。

Further is obligatory on the Data Fiduciary to report any data breach to the Data Protection Board. The detailed report must be submitted within 72 hours, outlining the facts, causes, impact, mitigation steps, and notifications made to affected individuals. The Fiduciary must also alert impacted individuals as early as possible. Similarly if the breach occurs at the Data Processor’s end, the Processor must immediately inform the Data Fiduciary. 

此外，数据受托人有义务向数据保护委员会报告任何数据泄露事件。必须在72小时内提交详细报告，概述事实、原因、影响、缓解措施以及向受影响个人发出的通知。受托人还必须尽早提醒受影响的个人。同样，如果泄露发生在数据处理者端，处理者必须立即通知数据受托人。

D.Right of Data Principal 

D. 数据主体的权利

Under the Rules, individuals have a right to access, correct, update, or erase their personal data. They can also authorize another person to exercise these rights on their behalf. Data Fiduciaries must respond to these requests within 90 days, ensuring timely redressal for citizens

根据规则，个人有权访问、更正、更新或删除其个人数据。他们还可以授权他人代表自己行使这些权利。数据受托人必须在90天内对这些请求做出回应，确保公民得到及时的补救。

E.Data Retention and Erasure 

E. 数据保留与删除

Obligation has been imposed on Data Fiduciaries Data Processors to delete the personal data after the purpose is fulfilled, unless the law requires it to be kept longer. Data Processors of certain large platforms (e-commerce, social media intermediaries, or gaming platforms with two crore+ users) must retain data for three years and notify individuals 48 hours before deletion. All processing logs must be kept for at least one year.

数据受托人和数据处理者有义务在目的达成后删除个人数据，除非法律要求保留更长时间。某些大型平台（用户超过两千万的电子商务平台、社交媒体中介或游戏平台）的数据处理者必须将数据保留三年，并在删除前48小时通知个人。所有处理日志必须至少保存一年。

F.Significant Data Fidicuraies

F. 重要数据受托人

Lastly, certain entities may be designated as Significant Data Fiduciaries based on factors such as volume and sensitivity of data processed. These entities are subject to enhanced compliance obligations, including conducting periodic Data Protection Impact Assessments, undergoing independent audits, appointing a Data Protection Officer, and adhering to additional regulatory requirements, including those relating to cross-border data transfers.

最后，某些实体可能根据处理数据的数量和敏感性等因素被指定为重要数据受托人。这些实体需承担更强的合规义务，包括进行定期的数据保护影响评估、接受独立审计、任命数据保护官，并遵守额外的监管要求，包括与跨境数据传输相关的要求。

IMPLEMENTATION 

实施

The implementation of the DPDP Rules, as notified by the Government, follows a phased approach to ensure a smooth transition into compliance. In the initial phase as on 13^th November, 2025, institutional mechanisms such as the Data Protection Board are established, and the legal framework under the DPDP Act and Rules is formalized.

政府公告的DPDP规则实施将分阶段进行，以确保平稳过渡到合规状态。在初始阶段，即2025年11月13日，将建立数据保护委员会等机构机制，并正式确立DPDP法案和规则下的法律框架。

In the second phase, effective within 12 months, a regulatory regime for Consent Managers is to come into force, requiring registration with the Data Protection Board and compliance with prescribed technical and operational standards, with a transition window provided for alignment.

在第二阶段，即12个月内生效，将建立针对同意管理人的监管制度，要求其向数据保护委员会注册并遵守规定的技术和操作标准，并提供过渡期以便调整。

In the third phase, effective within 18 months, the DPDP framework becomes fully enforceable, making all obligations mandatory for Data Fiduciaries, Data Processors, and Significant Data Fiduciaries, with non-compliance attracting regulatory penalties.

在第三阶段，即18个月内生效，DPDP框架将完全可执行，所有义务对数据受托人、数据处理者和重要数据受托人成为强制性要求，不合规将受到监管处罚。

PENALTIES 

处罚

Under the DPDP Act, penalties are not uniform and are scrutinized on case to case basis. The Act specifies maximum penalty amounts applicable for different types of non-compliance.

根据DPDP法案，处罚并非统一标准，而是根据具体情况进行审查。该法案规定了适用于不同类型不合规行为的最高处罚金额。

This approach ensures fair penalties based on the seriousness of the breach.

这种方法确保根据违规的严重程度进行公平处罚。

CONCLUSION 

结论

The Digital Personal Data Protection Act, 2023, along with the DPDP Rules, 2025, establishes a structured framework for data fiduciaries in India, requiring organisations to align their data processing practices with legal requirements. The roadmap outlines a phased approach for both organisations beginning and those already progressing on their compliance journey, categorised into immediate, short-term, and long-term actions to achieve and sustain compliance.

《2023年数字个人数据保护法》及《2025年DPDP规则》为印度的数据受托人建立了一个结构化的框架，要求组织将其数据处理实践与法律要求保持一致。该路线图概述了分阶段实施的方法，适用于刚开始合规之旅和已经在进行合规工作的组织，分为即时、短期和长期行动，以实现并维持合规。