India's data rules give a game publisher eighteen months from publication to meet the children's-data duties

The Digital Personal Data Protection Rules 2025 require a company processing personal data to serve a consent notice giving an itemised description of that data, the specified purpose, and a specific description of the goods or services the processing enables, together with the means to withdraw consent as easily as it was given ^[12]. Before processing any personal data belonging to a player under the age of eighteen, the company must obtain verifiable consent from that player's parent ^[4]. It must also publish a grievance window of no more than ninety days and implement measures to answer within it ^[13].

Those duties are not yet in force: Rules 3 and 5 to 16, which carry the notice, security, breach, children's-data and transfer provisions, come into force eighteen months after the notification was published ^[3]. The rules on appointing the chairperson and members of the Data Protection Board came into force on the date of publication ^[3]. The rule on registering consent managers comes into force one year after publication ^[3]. The notification is dated the 13th of November 2025 ^[2]. The Press Information Bureau announced it on 14 November 2025 and described an eighteen-month phased compliance timeline ^[18]. Eighteen months from the notification's own date falls in the middle of May 2027, which is the Desk's arithmetic on the commencement rule rather than a date the Rules state ^[3].

Rule 10 does not stop at asking a parent: it requires the company to observe due diligence that the person identifying herself as the parent is an adult, by reference to reliable identity and age details the company already holds, or to details the individual provides voluntarily, or to a virtual token mapped to those details and issued by an authorised entity ^[4]. An authorised entity is one entrusted by law or by a government with issuing identity and age details, and the rule includes details made available and verified by a Digital Locker service provider ^[5].

The Act bars a Data Fiduciary from tracking or behaviourally monitoring children, or directing targeted advertising at them ^[15]. A child, for this purpose, is anyone who has not completed the age of eighteen years ^[14]. The Fourth Schedule lifts those two duties for clinical establishments, healthcare professionals, educational institutions, creches and school transport providers, and for purposes including the issue of a subsidy or licence, the creation of an account limited to email, and locating a child in the interest of her safety, and it names no class or purpose covering games, entertainment or online platforms generally ^[11]. Breach of the children's-data obligations carries a maximum penalty of 200 crore rupees, and failure to take reasonable security safeguards a maximum of 250 crore rupees ^[17].

Rule 15 permits transfer: personal data processed under the Act may be transferred outside India, subject only to the requirements the Central Government may specify by general or special order about making that data available to a foreign State or to a person, entity or agency under its control ^[8]. The Act's own transfer provision is a power to name restricted destinations rather than a requirement to keep data in India ^[16]. Nothing in the Rules requires a publisher to store or process player data in India ^[8].

One route by which data could be held in India runs through designation: a Significant Data Fiduciary must ensure that personal data specified by the Central Government, on the recommendation of a committee it constitutes, is processed under the restriction that the data and the traffic data about its flow are not transferred outside India, and both the data to be restricted and the committee are left to the Central Government ^[9]. A Significant Data Fiduciary must also undertake a data protection impact assessment and an audit once in every period of twelve months from the date it is notified as such, and furnish a report of significant observations to the Board ^[10].

On becoming aware of a personal data breach, a company must tell each affected user without delay, through her user account or a channel she has registered, describing the nature, extent and timing of the breach, the consequences likely to arise for her, and the safety measures she may take ^[7]. It must tell the Data Protection Board without delay, and give the Board updated and detailed information within seventy-two hours of becoming aware, unless the Board allows a longer period on a written request ^[6].

Garena launched a localised Free Fire in India on 28 October with user data hosted on servers in India, alongside India-specific content, parental controls, playtime limits and spending caps, and its head of operations in India said the company had worked with relevant Indian government authorities and incorporated their feedback ^[19]. The children's-data rule does not come into force until eighteen months after the notification was published ^[3].

The nearest commencement date belongs to consent managers rather than to studios: a person meeting the conditions in the First Schedule may apply to the Board for registration as a Consent Manager, and that rule comes into force one year after publication ^[3].