Government Notifies the Digital Personal Data Protection Rules, 2025
MeitY notified the final DPDP Rules, 2025 on 13-14 November 2025, operationalising the DPDP Act, 2023 with a staggered, phase-wise rollout.
The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 on 13–14 November 2025, giving operational shape to the Digital Personal Data Protection Act, 2023.
The final rules followed an extensive public consultation that drew 6,915 stakeholder inputs from start-ups, industry bodies, civil-society groups, citizens and government departments.
Key features include itemised consent notices, registration of Consent Managers, reasonable security safeguards, a 72-hour data-breach reporting window, verifiable parental consent for children, additional duties for Significant Data Fiduciaries, and a fully digital Data Protection Board of India.
The rules commence in phases — Board provisions immediately, Consent Manager provisions after 12 months, and full compliance after 18 months (by 13 May 2027).