What the Rules are and when they were notified
The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 as G.S.R. 846(E) under section 40(1) of the Act. The Gazette of India notification is dated 13 November 2025, and the Press Information Bureau, in its note of 17 November 2025, gives 14 November 2025 as the date on which the Rules were notified. A draft had been published for comments on 3 January 2025.
The Act sets the principles, and the Rules fill in how they are carried out: what a notice must contain, how a Consent Manager is registered, how fast a breach must be reported, how a parent’s consent is checked, and how the Board and the Appellate Tribunal work. The DPDP Act 2023 page covers the law itself.
The phased timeline
Rule 1 does not bring everything into force at once. The Rules are in three groups, and the second and third are counted from the date of publication in the Gazette.
| Rules | In force | What they cover |
|---|---|---|
| Rules 1, 2 and 17 to 21 | On the date of publication in the Official Gazette | Title and definitions, and the provisions on the Data Protection Board: appointment of the Chairperson and Members, their terms, the procedure of meetings, the Board as a digital office and its staff. |
| Rule 4 | One year after the date of publication | Registration and obligations of Consent Managers. |
| Rules 3, 5 to 16, 22 and 23 | Eighteen months after the date of publication | Notice, State processing, security safeguards, breach intimation, erasure, contact information, children, Significant Data Fiduciaries, rights, transfers abroad, research, appeals and calls for information. |
Counted from 13 November 2025, rule 4 reaches its first anniversary on 13 November 2026 and the eighteen-month group on 13 May 2027. The Press Information Bureau describes this as an eighteen-month period of phased compliance. Whether the Act itself, or any of its sections, is in force on a given date is a separate question from the Rules and depends on the notifications that bring its sections into force.
Notice and consent
Rule 3 sets out the notice that a Data Fiduciary gives to a Data Principal. It must be presented and be understandable independently of any other information, give in clear and plain language a fair account of what is needed for specific and informed consent, and include at least an itemised description of the personal data and the specified purposes, with a description of the goods or services or uses to be enabled. It must also give the link to the website or app and the means by which the Data Principal may withdraw consent, with an ease comparable to that with which consent was given, exercise her rights, and complain to the Board.
Rule 4 deals with Consent Managers, who give a Data Principal a single point to give, manage, review and withdraw consent. An applicant must be a company incorporated in India with a net worth of not less than two crore rupees, with sound finances and management, and a platform independently certified as consistent with the Board’s standards. A Consent Manager acts in a fiduciary capacity towards the Data Principal, may not sub-contract its obligations, must make data available in a way that its contents are not readable by it, and must keep a record of consents, notices and sharing for at least seven years.
Security safeguards, breaches and erasure
Rule 6 sets the minimum of reasonable security safeguards: encryption, obfuscation, masking or virtual tokens, access control, logs and monitoring to detect and investigate unauthorised access, backups for continued processing, retention of logs and personal data for one year for that purpose, appropriate terms in the contract with a Data Processor, and technical and organisational measures to make these effective.
Rule 7 governs a breach. On becoming aware of one, the Data Fiduciary must tell each affected Data Principal, without delay, what happened, what the consequences for her are likely to be, what has been done to limit them, what she can do to protect herself and whom to contact. It must tell the Board without delay of the nature, extent, timing and location of the breach and its likely impact, and within seventy-two hours, or a longer period the Board allows on a written request, give updated information, the broad facts, the mitigation, any findings about who caused the breach, the remedial steps and a report of the notices given. The Act provides the penalties for failures at this stage, up to Rs 200 crore for failing to give notice of a breach.
Rule 8 sets a deadline for erasure for three classes of Data Fiduciary, set out in the Third Schedule. They must erase personal data three years after the Data Principal last approached them, with at least forty-eight hours’ warning to her, unless the data is needed to comply with another law. Rule 8(3) separately requires personal data, associated traffic data and logs to be retained for a minimum of one year for the purposes in the Seventh Schedule.
| Class in the Third Schedule | Time period |
|---|---|
| E-commerce entity with not less than two crore registered users in India | Three years from the date the Data Principal last approached the Data Fiduciary, or from the commencement of the Rules, whichever is latest |
| Online gaming intermediary with not less than fifty lakh registered users in India | The same period |
| Social media intermediary with not less than two crore registered users in India | The same period |
Children, rights, Significant Data Fiduciaries and transfers
Rule 9 requires every Data Fiduciary to publish the contact information of the Data Protection Officer, where there is one, or another person who can answer a Data Principal’s questions. Rule 14 requires the means for exercising rights and a grievance redressal system to be published, with a response within a reasonable period not exceeding ninety days, and lets a Data Principal nominate one or more individuals to exercise her rights.
Rule 10 requires verifiable consent of the parent before the personal data of a child, who is anyone under eighteen, is processed. The Data Fiduciary must check that the person identifying herself as the parent is an adult who is identifiable, by reference to reliable details already held or details voluntarily provided, including through a virtual token issued by an authorised entity or made available through a Digital Locker service provider. Rule 11 sets the same kind of check for the lawful guardian of a person with disability. Rule 12 and the Fourth Schedule exempt certain classes, such as clinical establishments and educational institutions, and certain purposes, from the parental consent and tracking restrictions, to a stated and limited extent.
Rule 13 adds duties for a Significant Data Fiduciary: a Data Protection Impact Assessment and an audit once in every twelve months, a report to the Board, due diligence that the algorithmic software it uses is not likely to pose a risk to the rights of Data Principals, and a restriction on transferring specified personal data and its traffic data outside India. Rule 15 provides that transfers abroad are subject to such requirements as the Central Government specifies by order, and rule 16 exempts research, archiving and statistical processing that follows the standards of the Second Schedule.
The Data Protection Board and appeals
Rule 17 provides for two search-cum-selection committees: one chaired by the Cabinet Secretary to recommend the Chairperson, and one chaired by the Secretary of the Ministry of Electronics and Information Technology to recommend the other Members. The Central Government appoints from the names recommended. The Fifth Schedule sets a consolidated salary of Rs 4.5 lakh a month for the Chairperson and Rs 4 lakh a month for each other Member, without house and car.
Under rule 19 one-third of the members form a quorum, questions are decided by a majority with a casting vote for the chair, and an inquiry is to be completed within six months of receipt of the intimation, complaint, reference or direction, extendable for reasons recorded in writing by up to three months at a time. Rule 20 makes the Board a digital office, able to conduct proceedings without physical presence. An order of the Board can be appealed to the Appellate Tribunal in digital form under rule 22. Rule 23 lets the Central Government call for information from a Data Fiduciary or an intermediary for the purposes in the Seventh Schedule, and in specified cases require that the call is not disclosed to the Data Principal.
Frequently asked questions
When do the DPDP Rules 2025 come into force?
In three steps. Rules 1, 2 and 17 to 21, which include the provisions on the Data Protection Board, applied from publication in the Gazette. Rule 4 on Consent Managers comes into force one year after publication. Rules 3, 5 to 16, 22 and 23, which hold the main duties of organisations, come into force eighteen months after publication. The notification is dated 13 November 2025.
How quickly must a personal data breach be reported to the Board?
Under rule 7(2), a Data Fiduciary must tell the Board without delay of a description of the breach, and within seventy-two hours of becoming aware, or such longer period as the Board allows on a written request, give updated and detailed information, the facts behind it, the measures taken, any findings about the person who caused it and the remedial steps. Each affected Data Principal must also be told without delay.
Who is a Significant Data Fiduciary under the Rules?
The Act lets the Central Government notify a Data Fiduciary or a class of them. Rule 13 then requires a Data Protection Impact Assessment and an audit once in every twelve months, a report of significant observations to the Board, due diligence on algorithmic software, and restrictions on transferring specified personal data outside India.
How long may a Data Fiduciary keep logs and personal data?
Rule 6 requires logs and personal data to be retained for one year to detect and investigate unauthorised access, and rule 8(3) requires personal data, associated traffic data and logs of processing to be kept for a minimum of one year for the purposes in the Seventh Schedule, after which they are erased unless another law requires longer.
Where is an appeal against an order of the Board filed?
Under rule 22, before the Appellate Tribunal, in digital form. The fee is like that for an appeal under the Telecom Regulatory Authority of India Act, 1997, unless reduced or waived, and it is paid digitally through the Unified Payments Interface or another system authorised by the Reserve Bank of India.