The Rules give the DPDP Act, 2023 its operating detail: what a notice must contain, which security safeguards are the minimum, how fast a breach must be reported, when data must be erased. All 23 rules, in plain English, with the date each one starts to bind.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
In three stages. Rules 1, 2 and 17 to 21 came into force on 13 November 2025. Rule 4 on Consent Managers comes into force on 13 November 2026. Rules 3, 5 to 16, 22 and 23, which hold notice, security, breach intimation, erasure, children's data and the Significant Data Fiduciary obligations, apply from 13 May 2027.
| Date | DPDP Act, 2023 · G.S.R. 843(E) | DPDP Rules, 2025 · Rule 1 |
|---|---|---|
| Sec 1(2), Sec 2, Sec 18–26, 35, 38–43, Sec 44(1) and (3) | Rules 1, 2, 17–21 | |
| Sec 6(9), Sec 27(1)(d) | Rule 4 (Consent Managers) | |
| Sec 3–5, Sec 6(1)–(8) and (10), Sec 7–17, Sec 27 (except (1)(d)), Sec 28–34, 36, 37, Sec 44(2) | Rules 3, 5–16, 22, 23 |
MeitY published a corrigendum to the Rules, G.S.R. 892(E), in December 2025. It corrects wording, references and numbering and does not change any obligation summarised below. Read the Rules together with it; both are on MeitY's data protection page.
The Rules commence in three stages. Rules 1, 2 and 17 to 21 took effect on publication, 13 November 2025. Rule 4 follows one year later. Rules 3, 5 to 16, 22 and 23, which carry almost every operational obligation, apply eighteen months after publication.
Defines "user account" broadly: any profile, page, handle, email address or mobile number through which a Data Principal reaches your service. That matters because breach intimation and erasure notices are to be sent through it. "Verifiable consent" means the consent specified in Rules 10 and 11.
The notice must stand on its own, independent of any other information you publish, and give in clear and plain language an itemised description of the personal data and the specified purpose. It must also give a link and a description of how the Data Principal can withdraw consent (as easily as it was given), exercise her rights, and complain to the Board.
Consent notice guide and templateSets out how a Consent Manager is registered by the Board and what it must do. The First Schedule requires, among other things, an Indian company with net worth of at least ₹2 crore and sound management. The Board can direct, suspend or cancel a registration. TruPriv is software for Data Fiduciaries and is not a Consent Manager.
Consent Manager vs consent management platformProcessing by the State and its instrumentalities to provide a subsidy, benefit, service, certificate, licence or permit must follow the standards in the Second Schedule. The rule defines what counts as provision "under law", "under policy" and "using public funds".
The minimum safeguards: encryption, obfuscation, masking or tokenisation; access control; logs, monitoring and review that can detect and investigate unauthorised access; backups for continuity; retention of those logs and data for one year; security obligations in Data Processor contracts; and technical and organisational measures to make all of it effective.
On becoming aware of a breach, tell each affected Data Principal without delay, through her user account or registered contact: what happened, the likely consequences, what you are doing, what she can do, and who to contact. Tell the Board without delay too, and send a detailed report, including causes, mitigation and the intimations given, within 72 hours unless the Board allows longer.
Large e-commerce entities and social media intermediaries (two crore or more registered users in India) and online gaming intermediaries (fifty lakh or more) must erase personal data three years after the user last engaged or after these Rules commence, whichever is later, unless another law requires it to be kept, with 48 hours' notice first. Separately, every Data Fiduciary must keep personal data, traffic data and processing logs for at least one year from the processing, for the Seventh Schedule purposes, before erasing them.
Prominently publish, on your website or app and in every response to a rights request, the business contact of your Data Protection Officer where you have one, or of a person who can answer the Data Principal's questions about the processing of her personal data.
Before processing a child's personal data, obtain verifiable consent of the parent and check that the person is an identifiable adult (18 or over), using identity and age details you already reliably hold, or details or a virtual token issued by an authorised entity, including one made available through a Digital Locker service provider (for example, DigiLocker). The rule's illustrations cover four account-creation cases.
Where an individual consents as the lawful guardian of a person with disability, verify that the guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law.
The parental consent requirement and the ban on tracking, behavioural monitoring and targeted advertising at Sec 9(1) and (3) do not apply to the classes of Data Fiduciary in Part A of the Fourth Schedule, or for the purposes in Part B, subject to the conditions stated there.
Once every twelve months a Significant Data Fiduciary must carry out a DPIA and an audit, and have the report of significant observations furnished to the Board. It must check that algorithmic software it uses is not likely to risk Data Principals' rights, and keep personal data that the Government specifies, with its traffic data, inside India.
Publish how a Data Principal can make a rights request and what identifier you need from her. Publish, and meet, a grievance response period of no more than 90 days, with measures that make the system effective. A Data Principal may also nominate one or more individuals to exercise her rights.
Personal data may be transferred abroad, subject to any requirements the Central Government specifies by order about making it available to a foreign State or to entities under the control of a foreign State.
The Act does not apply to processing necessary for research, archiving or statistical purposes, but only where it is carried on in accordance with the standards in the Second Schedule.
Search-cum-Selection Committees, chaired by the Cabinet Secretary for the Chairperson and by the MeitY Secretary for other Members, recommend candidates. The Central Government then appoints.
The Chairperson's and Members' salary, allowances and conditions of service are set out in the Fifth Schedule.
Procedure for Board meetings: quorum of one-third, majority voting with a casting vote, and emergency action by the Chairperson subject to ratification. An inquiry must be completed within six months of the intimation, complaint, reference or direction, extendable by up to three months at a time with written reasons.
The Board functions as a digital office and may use techno-legal measures to conduct proceedings without anyone being physically present, while keeping its power to summon and examine on oath.
The Board may appoint officers and employees with the Central Government's prior approval, on the terms in the Sixth Schedule.
Appeals against the Board's orders go to the Appellate Tribunal in digital form, with a fee matching TRAI Act appeals unless reduced or waived, payable via UPI or another RBI-authorised system. The Tribunal is guided by natural justice rather than the Code of Civil Procedure, and also runs as a digital office.
For the purposes in the Seventh Schedule, an authorised person may require a Data Fiduciary or intermediary to furnish information within a set period, and, where disclosure would prejudice sovereignty, integrity or security, may bar it from telling the affected Data Principal.
This page summarises the Rules; the Gazette text governs. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
