DPDP Rules: What the Digital Personal Data Protection Rules, 2025 Cover

Rule 1 doesn't create any compliance obligation of its own — it names the Rules and sets the exact dates on which every other rule comes into force.

Rule 2 defines a handful of terms used elsewhere in the Rules — short, technical, and easy to skim past, but worth understanding because three of them (user account, techno-legal measures, verifiable consent) shape how several other rules are read.

Rule 3 is the rulebook for the single most visible piece of DPDP compliance: the notice a Data Fiduciary shows before collecting someone's personal data.

Rule 4 is only relevant if your business wants to become a Consent Manager — a registered intermediary that lets individuals manage their consent across multiple companies from one platform.

Rule 5 governs a narrower audience than most: government bodies processing personal data to issue a subsidy, benefit, service, certificate, licence or permit.

Rule 6 is the closest thing the DPDP Rules have to a security checklist — the minimum measures every Data Fiduciary is expected to have in place to prevent a personal data breach.

Rule 7 is the operational detail behind the Act's breach-notification duty — exactly what has to be said, to whom, and by when, once a Data Fiduciary becomes aware of a personal data breach.

Rule 8 answers a question every data-retention policy needs answered: how long can you actually keep personal data once the reason you collected it has run its course?

Rule 9 is short and easy to overlook, but it's one of the most commonly missed basics: every Data Fiduciary must publish, visibly, who a Data Principal can actually contact about her data.

Rule 10 sets out exactly how a Data Fiduciary must check that the person consenting on behalf of a child is genuinely an identifiable adult parent — with four detailed illustrations covering the realistic ways this actually plays out.

Rule 11 mirrors Rule 10's verification logic, but for a different, easily overlooked category: adults with disabilities whose personal data is being consented to by a lawful guardian.

Rule 12 recognises that strict, verified parental consent for every single interaction isn't always practical — and carves out specific, narrow exemptions for specific classes of Data Fiduciary and purposes.

Rule 13 is where the extra scrutiny on the largest, highest-risk data processors gets specific: annual audits, algorithmic risk checks, and possible data-localisation duties.

Rule 14 is the operational backbone of every individual's rights under the Act — how a request actually gets made, how quickly it must be answered, and how someone can act on another person's behalf.

Rule 15 is short, but it's the rule every organisation using overseas cloud infrastructure or global vendors needs to watch — because the Central Government can add conditions to it at any time.

Rule 16 gives researchers, archivists and statisticians room to work — but only if that processing follows the same Second Schedule standard used elsewhere in the Rules.

Rule 17 is purely administrative — it doesn't touch businesses or individuals at all.

Rule 18 fixes what the Data Protection Board's Chairperson and Members are paid and the terms they serve under, by pointing to the Fifth Schedule.

Rule 19 is the Data Protection Board's own internal rulebook for how it runs meetings, votes, and signs off on its orders — plus a firm six-month clock on how long its inquiries can take.

Rule 20 is a one-line rule with a practical consequence: you may never need to physically visit the Data Protection Board's office to deal with a matter before it.

Rule 21 covers the Board's own staff — not its Chairperson and Members (that's Rules 17-18), but the officers and employees who do its day-to-day work.

Rule 22 is where you go if you disagree with a Data Protection Board order — how to appeal, what it costs, and how the Appellate Tribunal is expected to run the process.

Rule 23 is the final rule in the set, and it's a government information-demand power — who can require what information from a Data Fiduciary or intermediary, and when that disclosure can be kept from the affected individual.