DPDP Rules 2025 — Explained

The rules are officially the Digital Personal Data Protection Rules, 2025, notified on 13–14 November 2025. They commence in phases:

• Immediately (13 Nov 2025): Rules 1, 2 and the rules governing the Data Protection Board (Rules 16–21) — so the Board can be set up first.
• After 12 months (13 Nov 2026): Rule 4 (Consent Managers).
• After 18 months (13 May 2027): The core compliance rules — notice, security, breach reporting, retention, children’s data, SDF duties, data-principal rights and cross-border transfer.

• Data Principal: the individual the personal data is about (for a child, the parent/lawful guardian).
• Data Fiduciary: any person who, alone or with others, decides the purpose and means of processing personal data.
• Data Processor: a person who processes personal data on behalf of a Data Fiduciary.
• Significant Data Fiduciary (SDF): a fiduciary (or class) notified by the Government based on volume/sensitivity of data and risk.
• Consent Manager: a Board-registered entity that lets a Data Principal give, manage, review and withdraw consent through an interoperable platform.
• Board: the Data Protection Board of India (DPBI).

Every request for consent must be accompanied by a clear, plain-language notice, presented independently of other information. It must:

• Itemise the personal data being collected and the specific purpose of processing;
• Describe the goods/services or use enabled by that processing;
• Explain how to withdraw consent (as easily as it was given), how to exercise rights, and how to complain to the Board;
• Be available in English or any language in the Eighth Schedule of the Constitution.

A Consent Manager must be a company registered with the Data Protection Board and meet the conditions in Schedule I, including:

• A minimum net worth of ₹2 crore;
• A secure, neutral, interoperable platform that lets users give/review/withdraw consent;
• Maintaining consent records / audit trails for at least 7 years;
• Avoiding conflicts of interest and acting in a fiduciary capacity toward the Data Principal.

This rule takes effect 12 months after notification (13 Nov 2026).

When the State or its instrumentalities process personal data to provide a subsidy, benefit, service, certificate, licence or permit, they must follow the standards in Schedule II — lawful processing, purpose limitation, accuracy, security safeguards, defined retention and accountability.

Every Data Fiduciary (and its processors) must implement reasonable security safeguards, which include:

• Encryption, obfuscation or masking of personal data, and virtual tokens where appropriate;
• Access control to computer resources;
• Logs and monitoring to detect and investigate unauthorised access (retained for a defined period);
• Backups for continuity, and contractual security obligations on Data Processors.

On becoming aware of a personal data breach, a Data Fiduciary must:

• Without delay, inform each affected Data Principal — describing the breach, likely consequences, mitigation measures, and safety steps the user can take;
• Give the Board an initial intimation without delay, followed by a detailed report within 72 hours (extendable on request) covering facts, impact, mitigation and remedial actions.

Personal data must be erased once the purpose is no longer served and there is no legal requirement to keep it. For certain large platforms listed in Schedule III — notably e-commerce and social media intermediaries with ≥ 2 crore users, and online gaming intermediaries with ≥ 50 lakh users — data is deemed no longer needed 3 years after the Data Principal’s last interaction (or from rule commencement, whichever is later). The fiduciary must also notify the user 48 hours before erasure so they can re-engage.

Every Data Fiduciary must prominently publish the contact details of a Data Protection Officer (for SDFs) or another person able to answer questions about processing — on its website/app and in every privacy notice.

Before processing the personal data of a child (under 18), a Data Fiduciary must obtain verifiable consent of a parent/lawful guardian. The parent’s identity and adulthood must be checked using reliable identity details already held, a virtual token, or a Digital Locker / authorised identity service. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited.

For a person with a disability who has a lawful guardian, the fiduciary must obtain the guardian’s verifiable consent, confirming the guardianship is valid under law (e.g., appointed by a court or designated authority) before processing.

Some classes of fiduciaries and purposes — listed in Schedule IV, such as certain healthcare, educational, childcare and child-safety activities — are exempt from parts of the children’s-data restrictions (for instance, the ban on tracking) to the extent necessary for that purpose.

An SDF must additionally:

• Conduct an annual Data Protection Impact Assessment (DPIA) and an annual independent audit, and report findings to the Board;
• Appoint a Data Protection Officer (DPO) based in India, reporting to the board/management;
• Exercise due diligence on algorithmic software to ensure it does not pose risks to data-principal rights;
• Comply with any Government restrictions on transferring certain personal/traffic data abroad.

You have the right to:

• Access a summary of your data and the processing;
• Correction, completion, updating and erasure of your data;
• Grievance redressal from the fiduciary/consent manager; and
• Nominate someone to exercise your rights in case of death or incapacity.

Fiduciaries must publish the means to exercise these rights and the time period for responding to requests and grievances.

Personal data may be transferred outside India, but a Data Fiduciary must meet any requirements the Central Government specifies when making data available to a foreign State or its agencies, and must respect any country-specific restrictions the Government notifies. SDFs may face additional localisation requirements (see Rule 13).

Processing for research, archiving or statistical purposes is exempt from most obligations of the Act, provided it follows the standards prescribed (consistent with the Schedule II safeguards) and the data is not used to take decisions specific to a Data Principal.

The Chairperson and Members of the Data Protection Board of India are appointed by the Central Government on the recommendation of a search-cum-selection committee. The Board is to consist of four members (including the Chairperson) with expertise in data governance, law, technology and administration.

The salary, allowances and conditions of service of the Chairperson and Members are specified in Schedule V, securing the Board’s independence and defining tenure-related terms.

This rule sets the procedure for Board meetings and how its orders, directions and instruments are authenticated — designed for a digital-first body issuing digitally signed decisions.

The Board functions as a digital office: citizens can file complaints online and track cases through a dedicated portal and mobile app, and the Board may conduct proceedings using techno-legal measures without requiring physical presence.

The appointment and service conditions of the Board’s officers and employees are governed by this rule and Schedule VI.

A person aggrieved by a Board order may appeal to the Appellate Tribunal (TDSAT). Appeals are filed and heard digitally, and the applicable fee structure mirrors the TRAI/TDSAT framework.

The Central Government (or an authorised person) may require a Data Fiduciary or intermediary to furnish information for purposes specified in Schedule VII (e.g., sovereignty, security or to discharge functions under the Act), subject to the listed safeguards.