DPDP Rules 2025 — Explained

The rules are officially the Digital Personal Data Protection Rules, 2025, notified on 13–14 November 2025 (vide Gazette Notification G.S.R. 846(E)). Under Rule 1, they commence in three structured phases:

• Immediately on Publication (13 Nov 2025 — Phase I): Rules 1, 2 and Rules 17–21 — enacting foundational definitions and the constitution, appointment, terms of service and digital office procedures of the Data Protection Board of India (DPBI).
• After 12 Months (13 Nov 2026 — Phase II): Rule 4 & Schedule I — governing the technical interoperability, registration, and statutory obligations of Consent Managers.
• After 18 Months (13 May 2027 — Phase III): Rules 3, 5 to 16, 22 and 23 — the full substantive corporate compliance rules covering notice specifications, reasonable security safeguards, 72-hour breach reporting, retention and 3-year erasure, children’s verifiable consent, SDF duties, data-principal rights, cross-border data transfers and appellate tribunal proceedings.

• Data Principal: the individual the personal data is about (for a child, the parent/lawful guardian).
• Data Fiduciary: any person who, alone or with others, decides the purpose and means of processing personal data.
• Data Processor: a person who processes personal data on behalf of a Data Fiduciary.
• Significant Data Fiduciary (SDF): a fiduciary (or class) notified by the Government based on volume/sensitivity of data and risk.
• Consent Manager: a Board-registered entity that lets a Data Principal give, manage, review and withdraw consent through an interoperable platform.
• Board: the Data Protection Board of India (DPBI).

Every request for consent must be accompanied by a clear, plain-language notice, presented independently of other information. It must:

• Itemise the personal data being collected and the specific purpose of processing;
• Describe the goods/services or use enabled by that processing;
• Explain how to withdraw consent (as easily as it was given), how to exercise rights, and how to complain to the Board;
• Be available in English or any language in the Eighth Schedule of the Constitution.

A Consent Manager must be a company registered in India, registered with the Data Protection Board of India (DPBI), and compliant with the technical and financial conditions in Schedule I:

• A minimum net worth of ₹2 crore;
• A secure, neutral, interoperable platform enabling Data Principals to give, manage, review and withdraw consent across multiple Data Fiduciaries;
• Maintaining consent records and audit trails for at least 7 years;
• Operating in a strict fiduciary capacity exclusively on behalf of the Data Principal — maintaining complete autonomy without conflict of interest or control by any Data Fiduciary.

Implementation Milestone: This rule takes effect on 13 November 2026 (Phase II), when the DPBI registration window opens for applicant Consent Managers.

When the State or its instrumentalities process personal data to provide a subsidy, benefit, service, certificate, licence or permit, they must follow the standards in Schedule II — lawful processing, purpose limitation, accuracy, security safeguards, defined retention and accountability.

Every Data Fiduciary (and its processors) must implement reasonable security safeguards, which include:

• Encryption, obfuscation or masking of personal data, and virtual tokens where appropriate;
• Access control to computer resources;
• Logs and monitoring to detect and investigate unauthorised access (retained for a defined period);
• Backups for continuity, and contractual security obligations on Data Processors.

On becoming aware of a personal data breach, a Data Fiduciary must execute a mandatory two-tier notification:

• Without delay: Inform each affected Data Principal in clear, plain language — describing the nature of the breach, personal data fields impacted, likely consequences, mitigation steps taken, and actionable safety measures the individual can take;
• Without delay to the Board: Provide the Data Protection Board an initial intimation without delay, followed by a comprehensive forensic report within 72 hours (extendable on reasonable request) covering root causes, extent of exposure, remediation, and containment measures.

Personal data must be erased once the purpose is no longer served and there is no legal requirement to keep it. For certain large platforms listed in Schedule III — notably e-commerce and social media intermediaries with ≥ 2 crore users, and online gaming intermediaries with ≥ 50 lakh users — data is deemed no longer needed 3 years after the Data Principal’s last interaction (or from rule commencement, whichever is later). The fiduciary must also notify the user 48 hours before erasure so they can re-engage.

Every Data Fiduciary must prominently publish the contact details of a Data Protection Officer (for SDFs) or another person able to answer questions about processing — on its website/app and in every privacy notice.

Before processing the personal data of a child (under 18), a Data Fiduciary must obtain verifiable consent of a parent or lawful guardian. The parent’s identity and age must be verified using reliable identity details already held, an authorized virtual token, or an authenticated Digital Locker (DigiLocker) / government-approved identity verification mechanism without collecting excessive identity documents. Tracking, behavioural monitoring, profiling, and targeted advertising directed at children are strictly prohibited.

Statutory Clarification (Oct 2026): The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (Gazette Notification S.O. 5458(E), issued 5 Oct 2026, gazetted 6 Oct 2026) clarified Section 9(1) of the Act so that parental consent for children and guardian consent for persons with disabilities are treated as distinct, independent statutory mandates.

For a person with a disability who has a lawful guardian, the Data Fiduciary must obtain the guardian’s verifiable consent, verifying that the legal guardianship is valid under applicable law (e.g. Rights of Persons with Disabilities Act, National Trust Act, or court appointment) prior to processing.

Statutory Clarification (Oct 2026): Under the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E)), Section 9(1) was amended to state “child or of a person with disability who has a lawful guardian”, resolving drafting ambiguity and affirming that lawful guardians have the exclusive legal standing to provide verifiable consent for their wards.

Some classes of fiduciaries and purposes — listed in Schedule IV, such as certain healthcare, educational, childcare and child-safety activities — are exempt from parts of the children’s-data restrictions (for instance, the ban on tracking) to the extent necessary for that purpose.

An entity designated as a Significant Data Fiduciary (SDF) must comply with heightened governance standards:

• Conduct an annual Data Protection Impact Assessment (DPIA) and an annual independent data audit, reporting findings to the Board;
• Appoint a Data Protection Officer (DPO) based in India, reporting directly to the Board of Directors or senior leadership;
• Exercise due diligence on algorithmic software and AI systems to prevent risks to data-principal rights;
• Comply with any Government orders on data localization or restrictions on cross-border data flows.

Statutory Clarification (Oct 2026): The DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) formally substituted the word “audit” with “data audit” in Section 10(2)(c)(ii) of the Act. This aligns the terminology with Section 10(2)(b)’s requirement for an independent data auditor, confirming that the periodic review is strictly a privacy and data protection audit rather than a general financial audit.

You have the right to:

• Access a summary of your data and the processing;
• Correction, completion, updating and erasure of your data;
• Grievance redressal from the fiduciary/consent manager; and
• Nominate someone to exercise your rights in case of death or incapacity.

Fiduciaries must publish the means to exercise these rights and the time period for responding to requests and grievances.

Personal data may be transferred outside India, but a Data Fiduciary must meet any requirements the Central Government specifies when making data available to a foreign State or its agencies, and must respect any country-specific restrictions the Government notifies. SDFs may face additional localisation requirements (see Rule 13).

Processing for research, archiving or statistical purposes is exempt from most obligations of the Act, provided it follows the standards prescribed in Schedule II (purpose limitation, security, anonymization/pseudonymization) and the personal data is never used to take decisions specific to any individual Data Principal.

Note: Rule 16 takes effect under Phase III on 13 May 2027.

The Chairperson and Members of the Data Protection Board of India (DPBI) are appointed by the Central Government on the recommendation of a search-cum-selection committee. The Board consists of four members (including the Chairperson) with proven expertise in data governance, privacy law, computer technology, digital economy, or public administration.

Status & Timeline: Enacted in Phase I (13 Nov 2025). The Board operates as a statutory, techno-legal adjudicatory body responsible for inquiries, Consent Manager registrations (from Nov 2026), and imposing monetary penalties up to ₹250 crore.

The salary, allowances and conditions of service of the Chairperson and Members are specified in Schedule V, securing the Board’s independence and defining tenure-related terms.

This rule sets the procedure for Board meetings and how its orders, directions and instruments are authenticated — designed for a digital-first body issuing digitally signed decisions.

The Board functions as a digital office: citizens can file complaints online and track cases through a dedicated portal and mobile app, and the Board may conduct proceedings using techno-legal measures without requiring physical presence.

The appointment and service conditions of the Board’s officers and employees are governed by this rule and Schedule VI.

A person aggrieved by a Board order may appeal to the Appellate Tribunal (TDSAT). Appeals are filed and heard digitally, and the applicable fee structure mirrors the TRAI/TDSAT framework.

The Central Government (or an authorised person) may require a Data Fiduciary or intermediary to furnish information for purposes specified in Schedule VII (e.g., sovereignty, security or to discharge functions under the Act), subject to the listed safeguards.