DPDP Rules, 2025 explained

How the Rules were notified and corrected

The Digital Personal Data Protection Rules, 2025 were published as G.S.R. 846(E) on 13 November 2025. The commencement notification G.S.R. 843(E), dated the same day, brings the Act's provisions into force in three groups (s.1(2)). The Press Information Bureau announced the Rules on 14 November 2025.

A corrigendum, G.S.R. 892(E), corrected the English text of the Rules in December 2025. Separately, the Removal of Difficulties Order, 2026 (S.O. 5458(E), Gazette 6 October 2026) made two editorial changes to the Act itself, under the power in s.43. It adds no new duty.

All 23 rules and when each starts

Rule 1 starts the Rules in three phases: on publication (13 November 2025), one year later (13 November 2026) and eighteen months later (13 May 2027).

Rules 17 to 21 are shown by subject; read their full headings in the Gazette text.

What starts on 13 November 2026

Only Rule 4 starts on this date. It covers the registration and obligations of Consent Managers. The conditions in Part A of the First Schedule include being a company incorporated in India with a net worth of not less than ₹2 crore, and the Board can suspend or cancel a registration after giving a hearing.

What starts on 13 May 2027

Rules 3, 5 to 16, 22 and 23 start eighteen months after publication. For most Data Fiduciaries, this is when core obligations begin:

• Rule 3: a notice that is understandable on its own, in clear and plain language, with an itemised list of the personal data and purposes, and the means to withdraw consent, exercise rights and complain to the Board.
• Rule 6: minimum security safeguards, including encryption, masking or tokens, access control, logs and monitoring, backups, and keeping logs for one year.
• Rule 7: breach intimation to each affected Data Principal and to the Board, with a detailed report to the Board within 72 hours.
• Rule 8: erasure timelines for the classes in the Third Schedule, with at least 48 hours' notice before erasure, and at least one year of retention of data and logs for the Seventh Schedule purposes.
• Rules 10 to 12: verifiable consent of a parent or lawful guardian, and narrow exemptions for listed classes and purposes.
• Rule 13: a yearly DPIA and audit for Significant Data Fiduciaries.
• Rule 14: published ways to exercise rights, and a grievance response period of no more than 90 days.
• Rule 15: transfers abroad, subject to any government order about making data available to a foreign State.

The Schedules most fiduciaries will read

The Rules have seven Schedules. These four come up most often:

• First Schedule, Part A: conditions for registering as a Consent Manager (Rule 4).
• Third Schedule: the classes of e-commerce entities, social media intermediaries and online gaming intermediaries covered by the Rule 8 erasure timeline.
• Fourth Schedule: classes of Data Fiduciaries (Part A) and purposes (Part B) exempt from s.9(1) and s.9(3), within stated conditions (Rule 12).
• Seventh Schedule: purposes for which personal data, traffic data and logs are kept for at least one year (Rule 8(3)).

How TruePrivacy helps

TruePrivacy maps the Rules that start on 13 May 2027 to working features. Notices supports Rule 3, breach management runs the Rule 7 clocks, and retention rules set keep-for periods and expiry actions, with audit, access and consent logs kept for at least one year (Rule 6, Rule 8(3)).

Guardian consent records each request and decision with evidence (s.9), the SDF workspace sets yearly clocks for Rule 13, and rights requests and grievances run against the 90-day outer limit.