More than two years after the DPDP Act was passed in Parliament in August, 2023, the Ministry of Electronics and Information Technology (MeitY) last week notified the administrative rules to put it into effect. While several provisions of the Act went live from November 13, many others will come into force in a graded manner over the next 12 to 18 months. Crucially, this includes Security safeguards to be put in by data fiduciaries, responsibilities during personal data breaches and publishing of details of data protection officers.