DPDP Rules, 2025: every rule and when it applies

The DPDP Rules, 2025 were notified by the Ministry of Electronics and Information Technology under section 40 of the DPDP Act, 2023 and published in the Gazette on 13 November 2025 (PIB release). Rule 1 sets three commencement dates. The Act’s own sections were brought into force on the same three dates by G.S.R. 843(E) (Act commencement notification), so the duties on businesses in both the Act and the Rules, and the Act’s penalties, apply from 13 May 2027.

What do the seven Schedules contain?

Notice (Rule 3)

A Data Fiduciary’s notice must:

• stand on its own, understandable without any other information the Data Fiduciary provides;
• give, in clear and plain language, an itemised description of the personal data and the specified purpose, with a specific description of the goods, services or uses the processing enables;
• give the link to the website or app, and any other means, through which the Data Principal can withdraw consent as easily as she gave it, exercise her rights and complain to the Board.

Section 5(3) of the Act adds that the notice must be available in English or any language in the Eighth Schedule to the Constitution. Try the free privacy notice generator.

Consent Managers (Rule 4)

A Consent Manager is registered by the Board after it checks the First Schedule conditions, which include being a company incorporated in India with a net worth of at least two crore rupees, and having its platform independently certified against the Board’s data protection standards. Once registered, a Consent Manager must, among other things, keep records of consents given, denied or withdrawn for at least seven years, ensure it cannot read the personal data it routes, not sub-contract its obligations, act in a fiduciary capacity towards the Data Principal and avoid conflicts of interest with Data Fiduciaries. The Board can suspend or cancel a registration (Rule 4(5)). More on the Consent Manager page.

Section 8(7) of the Act requires erasure once the purpose is no longer served, unless a law requires retention. Rule 8 and the Third Schedule fix when the purpose is deemed no longer served for three classes of Data Fiduciaries:

• 48-hour warning. At least forty-eight hours before the erasure period ends, the Data Fiduciary must tell the Data Principal her data will be erased unless she logs in or otherwise makes contact (Rule 8(2)).
• One-year minimum retention. Every Data Fiduciary must keep personal data, associated traffic data and processing logs for at least one year from the date of processing, for the Seventh Schedule purposes, and make its Data Processors do the same (Rule 8(3)).

Rule 9 adds that every Data Fiduciary must prominently publish the contact details of its Data Protection Officer or a person who can answer questions about processing, and mention them in every response to a rights request.

Rule 10 requires a Data Fiduciary to make sure verifiable consent of a parent is obtained before processing any personal data of a child, and to check that the person identifying as the parent is an identifiable adult. It can rely on reliable identity and age details it already holds, or on details provided voluntarily, either directly or through a virtual token issued by an authorised entity, including through a Digital Locker service provider.

Rule 11 requires due diligence that a person claiming to be the lawful guardian of a person with disability was appointed by a court, a designated authority or a local level committee under the applicable guardianship law.

Rule 12 and the Fourth Schedule lift the parental-consent and no-tracking rules (section 9(1) and 9(3)) in limited cases, each restricted to what is necessary:

• Clinical establishments, mental health establishments, healthcare and allied healthcare professionals, for health services to the child.
• Educational institutions, for tracking and behavioural monitoring for educational activities or children’s safety.
• Crèches and child day care centres, and those engaged to transport enrolled children, for safety and location tracking.
• Purposes such as creating an email-only user account, tracking a child’s real-time location for her safety, blocking harmful content and advertising, and confirming that a user is not a child.

Significant Data Fiduciaries (Rule 13)

• A Data Protection Impact Assessment and an audit once every twelve months from notification, with a report of significant observations furnished to the Board.
• Due diligence that technical measures, including algorithmic software, are not likely to pose a risk to Data Principals’ rights.
• Personal data the Central Government specifies, on a committee’s recommendation, must not be transferred outside India, along with the traffic data on its flow.

Data Principal rights (Rule 14)

• Data Fiduciaries and Consent Managers must prominently publish how to make a rights request and what identifier, such as a username, customer number or email address, is needed.
• They must publish the period for responding to grievances, which cannot exceed ninety days, and have measures in place to meet it.
• A Data Principal may nominate one or more individuals to exercise her rights.

Transfers outside India (Rule 15)

Personal data may be transferred outside India, subject to any requirements the Central Government specifies by general or special order about making it available to a foreign State or any person or entity under its control.

• Rule 16: the Act does not apply to processing for research, archiving or statistics carried on under the Second Schedule standards.
• Rules 17 to 21: the Board’s Chairperson and Members are recommended by Search-cum-Selection Committees; one-third of the membership is the quorum; an inquiry must finish within six months of the intimation or complaint, extendable by up to three months at a time; and the Board works as a digital office.
• Rule 22: appeals to the Appellate Tribunal are filed digitally, with the fee applicable to appeals under the TRAI Act, 1997, payable through UPI or another RBI-authorised system.
• Rule 23: the Central Government may require a Data Fiduciary or intermediary to furnish information for the Seventh Schedule purposes, and may bar disclosure of that request where sovereignty or security is at stake.

Breaching a rule that has no specific penalty can draw up to ₹50 crore under item 7 of the Schedule to the Act.

• Notice builder covering the Rule 3 items, in English and Eighth Schedule languages.
• Breach response workflow for the Rule 7 intimations to Data Principals and the Board.
• Retention and erasure schedules for Rule 8, including the 48-hour pre-erasure intimation.
• Verifiable parental consent workflow for Rule 10.
• Rights requests with response-time tracking for Rule 14.
• Processor register and contract tracking for the Rule 6(1)(f) contract clauses.

Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. See the DPDP Compliance Suite overview.

General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.