DPDP Rules, 2025

Short answer

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. The Act says what the law is. The Rules say how you follow it. They start in three phases (Rule 1).

When each rule starts

Law, from 13 November 2025: Rules 1, 2 and 17 to 21. These set up the Data Protection Board (Rule 1(2)).
Law, from 13 November 2026: Rule 4, the Consent Manager regime. It starts one year after publication (Rule 1(3)).
Law, from 13 May 2027: Rules 3, 5 to 16, 22 and 23. Most of your duties sit here (Rule 1(4)).

See the full timeline: DPDP deadlines: 2026 vs 2027.

What it means for you

If you are a Data Fiduciary, most duties start on 13 May 2027. You can prepare now. Nothing below binds you before its start date.

How it works, rule by rule

Rule 3 — the notice

Law, from 13 May 2027: when you ask for consent, your notice must stand on its own and use clear, plain language. It must list the personal data item by item. It must state the purpose and what the processing enables. It must give a link to withdraw consent as easily as it was given, to use rights, and to complain to the Board. More: Notice and consent.

Rule 4 — Consent Managers

Law, from 13 November 2026: a Consent Manager applies to the Board to register (Rule 4(1)). It must meet the conditions in Part A of the First Schedule, such as being an Indian company with a net worth of at least two crore rupees. More: Consent Managers.

Rule 6 — security safeguards

Law, from 13 May 2027: you must take reasonable security safeguards. At the minimum these include encryption or masking, access control, logs and monitoring, and backups. You must keep those logs for one year, unless another law says otherwise. Your contracts with Data Processors must cover security too (Rule 6(1)).

Rule 7 — data breaches

Law, from 13 May 2027: tell each affected person without delay. Tell the Board without delay too. Then send the Board a detailed report within 72 hours, or a longer time the Board allows (Rule 7(2)). More: Breach response.

Rule 10 — children's data

Law, from 13 May 2027: get verifiable consent from a parent before you process a child's data. Check that the parent is an identifiable adult. Rule 12 and the Fourth Schedule set out limited exemptions. More: Children's data.

Rule 13 — Significant Data Fiduciaries

Law, from 13 May 2027: a Significant Data Fiduciary must run a Data Protection Impact Assessment and an audit every twelve months. It must send the key findings to the Board. It must check that its algorithms are not likely to put people's rights at risk (Rule 13(1) to 13(3)). More: Significant Data Fiduciary.

Rule 14 — people's rights

Law, from 13 May 2027: publish how people can make rights requests, and what details you need to identify them. Publish a response period for grievances, not exceeding ninety days (Rule 14(3)). More: Rights of Data Principals.

Rule 15 — sending data abroad

Law, from 13 May 2027: you may transfer personal data outside India. But you must meet any requirements the government sets by order on making data available to a foreign State or its agencies (Rule 15). Separately, the government can restrict transfers to named countries (Section 16(1) of the Act). We have not seen any such notification. More:Cross-border transfers.

Rules 17 to 21 — the Board

Law, from 13 November 2025: these rules cover how the Chairperson and Members are chosen through a Search-cum-Selection Committee, their pay, meetings, and the Board working as a digital office. More: Is the Board operational?.