The DPDP Rules, 2025 in plain language
The Act sets the duties; the Rules set the mechanics: what a notice must contain, what counts as reasonable security, how fast a breach is reported, and when each part takes effect. A digest for business owners, not the Gazette text.
The Rules at a glance
The Rules were notified on 13 November 2025 and arrive in three stages. The provisions setting up the Data Protection Board applied at once. The registration framework for Consent Managers follows after a year. Almost every duty a business feels, from notices to breach reporting, applies after 18 months.
That gives a working deadline: 13 May 2027. The assessment builds every roadmap against it.
When each part applies
| From | What applies |
|---|---|
| 13 November 2025 | The Data Protection Board: its constitution, members, procedure and working as a digital office. |
| 13 November 2026 | Registration and duties of Consent Managers. |
| 13 May 2027 | Notices, security safeguards, breach reporting, erasure, children’s data, rights and grievances, Significant Data Fiduciary duties and transfers. |
Notices
A notice must be understandable on its own, without reference to other documents, and in clear and plain language. It must give an itemised description of the personal data and the specific purposes for which it is used, and the goods, services or uses those purposes enable.
It must also give a link or other means to withdraw consent as easily as it was given, to exercise rights under the Act, and to complain to the Board. A privacy policy written for lawyers does not meet this; a short, layered notice at the point of collection is more likely to.
Security safeguards
The Rules set a floor for “reasonable security safeguards”. As a minimum, a Data Fiduciary should have:
- encryption, obfuscation, masking or virtual tokens where appropriate;
- control over who can access the systems that hold personal data;
- logs and monitoring that make it possible to detect and investigate unauthorised access, with logs kept for at least one year;
- backups and measures to keep processing going after a compromise;
- these same safeguards written into contracts with Data Processors.
The largest penalty ceiling in the Act, up to ₹250 crore, applies to failing to take these safeguards. The assessment marks gaps here as critical for that reason.
Breach reporting
When a personal data breach happens, two reports are due:
- To each affected person, without delay: what happened, the likely consequences, what you are doing about it, what they can do to protect themselves, and who to contact.
- To the Board, without delay, with a detailed report within 72 hours of becoming aware, or a longer period if the Board allows it: the facts, the cause, the people affected, the measures taken and the findings about who caused it.
The Board may allow a longer period than 72 hours on a written request. There is no threshold below which a breach need not be reported. A plan with named people, rehearsed beforehand, makes the 72 hours far easier to meet.
Erasure and retention
The Act requires erasure once the purpose is served (s. 8(7)). The Rules add fixed periods for three large classes of platform: e-commerce entities, online gaming intermediaries and social media intermediaries above set user numbers. They must erase data of users who have not engaged for a set period, after giving notice beforehand.
For every business, the Rules also require the personal data, related traffic data and logs of each processing activity to be kept for at least one year: to detect and investigate unauthorised access (r. 6(1)(e)), and for the purposes in the Seventh Schedule, such as a lawful demand for information from the Central Government (r. 8(3)). They are then erased unless another law requires them to be kept. A retention schedule should cover both.
Children and people with disabilities
Before processing a child’s data, a fiduciary must take due care to check that the person giving consent is the child’s parent and is an identifiable adult. The Rules give ways to do this: details already held reliably, or identity details or a virtual token issued by an authorised entity, including through a Digital Locker service.
For a person with a disability who has a lawful guardian, the fiduciary must check that the guardian has been appointed by a court or under the applicable law.
The Rules exempt some fiduciaries from parts of these duties for specific purposes, including clinical establishments and healthcare professionals providing health services, educational institutions for educational activities and children’s safety, and child-care and transport providers for safety. The exemptions are limited to those purposes. Read the education and healthcare guides for how they apply.
Rights and grievances
Each fiduciary must publish, on its website or app, how a person can make a request to access, correct or erase their data, and what identifier they will need. Grievances must be answered within a period the fiduciary publishes, which may not exceed 90 days.
Each fiduciary must also publish the business contact of a person who can answer questions about processing, or of its Data Protection Officer if it has one.
Consent Managers
A Consent Manager is a registered company that lets people give, manage, review and withdraw consent across many fiduciaries from one place. The Rules set conditions for registration, including net worth and independence from the fiduciaries it serves. Using one is optional for a business.
Significant Data Fiduciaries
Fiduciaries notified as significant must carry out a Data Protection Impact Assessment and an audit every twelve months and report the findings to the Board. They must also check that algorithmic software they use does not put people’s rights at risk, and may face restrictions on transferring some data outside India.
Transfers outside India
Personal data may go abroad unless the government restricts a destination (s. 16). The Rules allow conditions to be set on making data available to a foreign state or its agencies. Stricter sector rules, such as keeping payment data in India, continue to apply.
The Board and appeals
The Rules set the Board up to work as a digital office, with complaints, hearings and orders handled online. Its powers to inquire and impose penalties apply from 13 May 2027. Check whether the Board’s Chairperson and Members are in place before relying on any part of its process. Under legal review: The appointment status of the Board should be confirmed from an official source at the time of reading. Its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal. A business facing an inquiry can offer a voluntary undertaking to fix a gap within a set time; if the Board accepts it, proceedings on that matter are barred unless the undertaking is broken.
The official text
The Rules were published in the Gazette of India. Use the government sources directly; these links leave this site.
- The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) of 13 November 2025, from the Ministry of Electronics and Information Technology (PDF)
- The e-Gazette of India, which holds the original notifications and any later amendment or corrigendum
Where this digest and the Gazette text differ, the Gazette text is right. For the Act itself, see the DPDP Act in plain language.