INSITE - India- November 2025

DIGITAL PERSONAL DATA PROTECTION RULES, 2025 NOTIFIED BY MEITY

Summary: The Ministry of Electronics and Information Technology (MeitY) has officially notified the Digital Personal Data Protection Rules, 2025. This marks a significant milestone in India’s data protection framework and operationalises the country’s first comprehensive personal data protection law.

In Detail: With the notification of the Digital Personal Data Protection Rules, 2025, the Government of India has formally operationalised the Digital Personal Data Protection Act, 2023, which was enacted in August 2023 but required subordinate legislation to take effect. The Rules provide the long-awaited procedural, institutional, and compliance framework necessary for organisations to implement the Act in practice.

The Rules prescribe detailed obligations for entities classified as Data Fiduciaries, outlining how personal data must be lawfully collected, processed, stored, and protected. They also clarify the rights of Data Principals (individuals), the standards for valid consent, and the mechanisms through which individuals may exercise control over their personal data.

Key operational aspects introduced under the Rules include:

• Data Fiduciary obligationsData Fiduciaries are required to process personal data only for lawful purposes, ensure accuracy and completeness of data, implement reasonable security safeguards, and take measures to prevent unauthorised access, breaches, or misuse of personal data.

  
  

• Consent management frameworkThe Rules elaborate on how consent must be obtained, recorded, managed, and withdrawn. Consent must be free, specific, informed, unconditional, and unambiguous, with clear notice requirements. Mechanisms must also be put in place to allow Data Principals to easily withdraw consent.

  
  

• Data security and breach notificationOrganisations must adopt appropriate technical and organisational measures to safeguard personal data. In the event of a personal data breach, Data Fiduciaries are required to notify the Data Protection Board of India and affected Data Principals in the manner prescribed.

  
  

• Consent ManagersThe Rules establish a formal framework for the registration, governance, and functioning of Consent Managers, who will act as intermediaries enabling Data Principals to manage their consent across multiple Data Fiduciaries through a single, transparent platform.

  
  

• Data Protection Board of IndiaThe Rules operationalise the Data Protection Board of India, setting out its composition, powers, procedures, and adjudicatory functions. The Board will be responsible for enforcing compliance, conducting inquiries, issuing directions, and imposing monetary penalties for violations of the Act.

The Government has clarified that implementation of the DPDP regime will be phased, providing organisations with time to assess gaps, update internal policies, revise contractual arrangements, train personnel, and deploy technical safeguards aligned with the new legal requirements.

Once fully implemented, the DPDP framework will have far-reaching implications for businesses, digital platforms, employers, service providers, and any organisation processing personal data of individuals in India, marking a fundamental shift in India’s approach to data governance and privacy compliance.

Key Links: Press Note Details: Press Information Bureau

Digital Personal Data Protection Rules 2025 | Ministry of Electronics and Information Technology

SEBI REVISES DISTRIBUTOR INCENTIVES TO PROMOTE B-30 CITY & WOMEN INVESTORS

Summary: The Securities and Exchange Board of India (SEBI) has revised the incentive framework for mutual fund distributors to strengthen financial inclusion by encouraging the onboarding of new individual investors, particularly from B-30 cities and women investors. The revised framework seeks to address concerns of misuse under the earlier regime while ensuring incentives remain targeted and outcome-driven.

In Detail: SEBI has withdrawn Regulation 52(6A)(b), which previously permitted additional incentives for inflows from beyond the top 30 cities (B-30), citing concerns around misclassification and misuse. In its place, SEBI has introduced a new investor-focused incentive model linked to genuine market expansion.

Under the revised framework, mutual fund distributors will be eligible for an additional commission for onboarding first-time individual investors with a new PAN. The incentive is structured as follows:

• 1% of the first lump-sum investment, or

• 1% of the total SIP contributions made during the first year,subject to a maximum cap of ₹2,000 per investor, provided the investment is maintained for at least one year.

The incentive will be funded from the 2 basis points (bps) earmarked annually for investor education and inclusion, and will be subject to clawback provisions in cases of early exit or non-compliance.

Certain schemes have been excluded from the scope of this incentive, including:

• Exchange-Traded Funds (ETFs);

• Fund-of-Funds investing more than 80% of their AUM in domestic funds; and

• Schemes with a tenure of less than one year.

The revised framework will come into effect from 1 February 2026.

By shifting the focus from geographic inflows to first-time investor participation, SEBI aims to promote genuine financial inclusion, prevent regulatory arbitrage, and support the orderly and sustainable growth of the mutual fund industry particularly among under-represented investor segments.

Key Links: SEBI | Additional incentives to distributors for onboarding new individual investors from B-30 cities and women investors