DPDP Rules, 2025
The Digital Personal Data Protection Rules, 2025, which supply the operational detail for the Act.
The DPDP Rules, 2025 are the detailed instructions made under the Act. They say exactly what a notice must contain, how breaches are reported, how long data can be kept and how the Board works.
Meaning of DPDP Rules, 2025
The Rules cover notice content, Consent Managers, security safeguards, breach reporting, retention and erasure, children's data, Significant Data Fiduciary duties, rights requests, cross-border transfer, research exemptions and the working of the Board. They are notified in the Gazette and take effect in phases.
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 under the rule-making power in Section 40 of the Act. They contain 23 rules and several Schedules. Where the Act says something "as may be prescribed", the Rules prescribe it. Without them, provisions such as the content of a notice, the registration of Consent Managers, or the form of a breach report would be incomplete, so a compliance programme built on the Act alone will have gaps.
The Rules fall into rough groups. Rule 3 covers notice, Rule 4 Consent Manager registration, Rule 5 processing by the State, Rule 6 reasonable security safeguards, Rule 7 breach intimation, Rule 8 retention and erasure, Rule 9 publication of contact details, Rules 10 and 11 verifiable consent for children and persons with disability, Rule 12 exemptions for children's data, Rule 13 Significant Data Fiduciary duties, Rule 14 rights of Data Principals, Rule 15 transfers outside India and Rule 16 research and statistical processing. Rules 17 to 21 build the Board, Rule 22 covers appeals and Rule 23 covers calling for information.
The Rules are phased through Rule 1. Rules 1, 2 and 17 to 21 took effect on publication, 13 November 2025, because they set up the Board and define terms. Rule 4 on Consent Managers takes effect one year later, in November 2026. Rules 3, 5 to 16, 22 and 23, which carry the substantive duties and the appeal process, take effect eighteen months after publication, on 13 May 2027. Reading Rule 1 first prevents wasted effort on the wrong dates.
The Rules also carry the Schedules that hold much of the detail. The First Schedule has conditions for Consent Managers, the Second sets standards for State and research processing, the Third lists the classes of fiduciary to which the three-year retention limit applies, the Fourth lists the exemptions for children's data and the Fifth deals with Board terms of service. Since subordinate legislation cannot go beyond the parent Act, the Rules are always read within the limits of the Act's sections.
Examples of DPDP Rules, 2025
A company checks Rule 7 to find out what a breach notice to affected users must contain.
A marketplace with a large user base checks the Third Schedule and learns that its class of fiduciary must erase data after three years of the user's last interaction, with a 48-hour prior warning. It builds an automated dormant-account job that sends the warning and then purges.
A lending app maps its stack to Rule 6 and finds that API logs are overwritten after thirty days. Because the Rules expect logs to be kept for at least a year, it changes its log retention and moves them to protected storage.
A school group reads Rules 10 to 12 and sees that children's data needs verifiable parental consent, with limited exemptions for educational institutions in the Fourth Schedule. It separates admission records, which fit the exemption, from marketing contact lists, which do not.
Why DPDP Rules, 2025 matters
Many of the figures that regulators and auditors will ask about come only from the Rules: the 72-hour detailed breach report to the Board, the one-year minimum retention of logs, the 48-hour warning before erasing data under Rule 8, the ninety-day ceiling for grievance responses, and the annual impact assessment and audit for Significant Data Fiduciaries. An organisation that knows the Act but not the Rules will mis-set its internal deadlines.
Because the Rules are subordinate legislation, they can be amended by notification and are laid before Parliament under Section 41. That makes them the part of the framework most likely to change, so a compliance team needs a way to track amendments and apply them to policies, templates and training. The cost of a policy based on an out-of-date rule is a failed inquiry defence.
How it works in practice
- 1Create a rule-by-rule register that lists each rule, the Act section it implements, the internal owner, the date it takes effect and the evidence you will keep. Rule 1 dates should be the first column.
- 2Rewrite customer-facing notices against Rule 3: itemised description of the personal data, specific purposes, the means to withdraw consent and exercise rights, and how to complain to the Board, all in plain language.
- 3Align technical controls with Rule 6: encryption, obfuscation or masking, access control, logging and monitoring, backups, and contract clauses that require processors to maintain the same safeguards.
- 4Draft a breach playbook that follows Rule 7: tell affected Data Principals without delay, tell the Board without delay, and file the detailed report within 72 hours, with roles named for each step.
- 5Review retention schedules against Rule 8 and the Third Schedule, and confirm that logs and traffic data are kept for at least a year even when other data is erased.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming every rule applies from 13 November 2025. Only the Board-related and definition rules did; the main duties follow on 13 May 2027.
Copying the Rules into a policy without naming the Act section behind each. When a rule is amended or challenged, the link to the Act is what keeps the policy defensible.
Forgetting the Schedules. The Third and Fourth Schedules change the retention and children's-data answer for specific classes of fiduciary.
Using a summary from a blog as the source text. Always check the Gazette copy of the Rules, since the notified text is authoritative.
Compliance tips
Subscribe to official notifications from MeitY and the Board and log each amendment with the date you updated your documents.
Give each rule one named owner in the company so that a rule never sits with "legal" in general.
Test your breach and rights-request processes with a tabletop exercise; the Rules set deadlines, and drills show whether the team can meet them.
Keep dated copies of the policies you adopted, because evidence of what you did at a given time may matter in an inquiry.
Common questions about DPDP Rules, 2025
What is the difference between the DPDP Act and the DPDP Rules?
The Act is the statute passed by Parliament and sets principles, rights and penalties. The Rules are subordinate legislation made by the Central Government under Section 40 that fill in the detail, such as breach report timelines, notice content and Board procedure. Both must be followed together.
When do the DPDP Rules come into force?
In three batches under Rule 1: 13 November 2025 for Rules 1, 2 and 17 to 21, 13 November 2026 for Rule 4, and 13 May 2027 for Rules 3, 5 to 16, 22 and 23. Most organisations should plan for 13 May 2027.
How many rules are there in the DPDP Rules, 2025?
There are 23 rules, supported by Schedules. They cover notice, consent managers, security, breach reporting, retention, children, Significant Data Fiduciaries, rights, cross-border transfer, exemptions, the Board, appeals and calling for information.