NEW DELHI – The Business Software Alliance (BSA) welcomed the release of India’s Digital Personal Data Protection Rules, 2025, describing them as an important step toward strengthening trust in India’s digital ecosystem while supporting innovation and economic growth.

“The release of the Digital Personal Data Protection Rules, 2025 (DPDP Rules) is an important milestone and will further strengthen India’s growing digital ecosystem and facilitate responsible innovation” said Venkatesh Krishnamoorthy, BSA Country Manager – India. “BSA commends the Ministry of Electronics and Information Technology (MeitY) for engaging closely with all stakeholders when developing the DPDP Rules. We look forward to our continued engagement with MeitY to address practical challenges to implementing the DPDP Rules, particularly as they relate to cross-border data transfers, personal data breach notifications, designation of Significant Data Fiduciaries (SDFs), and operationalizing the Data Protection Board.”

BSA welcomes the 18-month implementation timeline provided in the DPDP Rules which supports the ability of businesses of all sizes and sectors to implement necessary changes for compliance with the Act and the Rules. While the DPDP Rules appear to expressly permit data transfers outside India, the ability to impose requirements on such transfers at a later point still could expand data transfer restrictions.

BSA recommends that the Government continue to provide certainty and predictability to businesses with respect to international data transfers. We encourage continued dialogue with stakeholders to address other important practical challenges to implementing the Act and the Rules, including enabling lawful bases for processing personal information beyond consent to align with global best practices and avoid impeding innovation in emerging technologies such as artificial intelligence and routine data transfers that are vital for India’s digital economy.