Top Qs
Timeline
Chat
Perspective
Digital Personal Data Protection Rules, 2025
Digital Personal Data Protection rules in India From Wikipedia, the free encyclopedia
Remove ads
The Digital Personal Data Protection Rules, 2025 (commonly known as DPDP Rules, 2025) is a subordinate legislation notified by the Government of India under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023). The rules provide detailed operational requirements for implementation of the Act, specifying obligations of data fiduciaries and procedures for data principals, breach reporting, cross-border transfers and the functioning of the Data Protection Board of India.[1][2][3]
Remove ads
Summary
The rules set out practical steps for consent collection, notice requirements, breach notification, record-keeping, and special protections (for children and persons with disabilities). They also define timelines for phased compliance and provide details on the constitution and powers of the Data Protection Board of India envisaged under the DPDP Act, 2023. The notification of the Rules followed public and stakeholder consultations and was presented as the final step to operationalize India’s data-protection framework.
Remove ads
Background
The Digital Personal Data Protection Act, 2023 established the legal framework for personal data protection in India but delegated many technical and procedural requirements to subordinate rules. After stakeholder consultations and draft releases, the Ministry of Electronics and Information Technology (MeitY) finalized the Rules and notified them on 14 November 2025.[4]
Key provisions
Summarize
Perspective
The key elements of the Rules include:
- Consent and notice — Data fiduciaries must provide clear and concise privacy notices that specify purpose(s) of processing, categories of data processed, retention periods, and mechanisms to withdraw consent. Consent requirements emphasise informed, unambiguous and freely given consent for processing personal data.[5]
- Data breach notification — Fiduciaries are required to notify the Data Protection Board and affected data principals of personal data breaches within specified timelines, and to provide details about the nature of the breach and mitigation steps taken.[6]
- Special categories and vulnerable groups — The Rules provide enhanced protections for children's data (verifiable guardian consent for certain processing) and for persons with disabilities, including guidelines for obtaining lawful guardian oversight where appropriate.[7]
- Cross-border data transfer — The Rules set out conditions and safeguards for transfer of personal data outside India; the Central Government retains power to specify countries or mechanisms for permitted transfers.[8]
- Data Protection Board of India — The Rules detail the composition, appointment process and functioning (including digital-first proceedings) of the Data Protection Board of India envisaged under the DPDP Act, 2023.[9]
- Phased compliance — Certain operational provisions are subject to phased implementation to allow businesses (including startups and small enterprises) to adapt to new compliance requirements.[10]
Implementation timeline
See also
References
External Sources
Wikiwand - on
Seamless Wikipedia browsing. On steroids.
Remove ads