The Digital Personal Data Protection Rules, 2025
Notified by the Ministry of Electronics and Information Technology vide G.S.R. 846(E) dated 13 November 2025, in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023.
Overview
The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology under the DPDP Act, 2023. They set out how notices must be given, how Consent Managers are registered, the security safeguards and breach-intimation process, retention periods, verifiable consent for children and persons with disability, Significant Data Fiduciary duties, Data Principal rights and the working of the Data Protection Board. This page lists every rule and Schedule with official text and commentary.
Key facts
- Citation
- G.S.R. 846(E)
- Notified
- 13 November 2025
- Made under
- Section 40 of the Digital Personal Data Protection Act, 2023
- Structure
- 23 rules and 7 Schedules
- Issued by
- Ministry of Electronics and Information Technology
- Phased commencement
- 13 November 2025: Rules 1, 2 and 17–21
- 13 November 2026: Rule 4 (Consent Managers)
- 13 May 2027: Rules 3, 5–16, 22 and 23
Contents
- The Rules23 provisions
- First Schedule - Consent Manager1 provision
- Second Schedule - Standards for processing by State1 provision
- Third Schedule - Class of Data Fiduciaries, purposes and time periods1 provision
- Fourth Schedule - Exemptions from section 9(1) and 9(3)1 provision
- Fifth Schedule - Terms of service of Chairperson and Members1 provision
- Sixth Schedule - Terms of service of officers and employees1 provision
- Seventh Schedule - Purpose and authorised person1 provision
Frequently asked questions
What are the DPDP Rules, 2025?
Rules made by the Central Government under the DPDP Act, 2023 that fill in the procedure and detail the Act leaves to rule-making. Read the provision
What must a privacy notice contain under the Rules?
Rule 3 requires a notice that stands on its own, in clear and plain language, with an itemised description of the personal data and the specified purposes, and how consent can be withdrawn and rights exercised. Read the provision
How quickly must a personal data breach be reported?
Rule 7 requires intimation to affected Data Principals without delay, and a detailed report to the Board within seventy-two hours of becoming aware of the breach, or a longer period the Board allows. Read the provision
How is a child's consent verified?
Rule 10 requires a Data Fiduciary to take appropriate technical and organisational measures to obtain verifiable consent of a parent before processing a child's personal data. Read the provision
What extra duties apply to Significant Data Fiduciaries?
Rule 13 requires a Data Protection Impact Assessment and an audit once every twelve months, and due diligence on algorithmic software. Read the provision
The Rules
- R.1Short title and commencement
- R.2Definitions
- R.3Notice given by Data Fiduciary to Data Principal
- R.4Registration and obligations of Consent Manager
- R.5Processing for provision or issue of subsidy, benefit, service, certificate, licence or permit by State
- R.6Reasonable security safeguards
- R.7Intimation of personal data breach
- R.8Time period for specified purpose to be deemed as no longer being served
- R.9Contact information of person to answer questions about processing
- R.10Verifiable consent for processing of personal data of a child
- R.11Verifiable consent for processing of personal data of person with disability
- R.12Exemptions from certain obligations applicable to processing of personal data of a child
- R.13Additional obligations of Significant Data Fiduciary
- R.14Rights of Data Principals
- R.15Processing of personal data of Data Principals outside India
- R.16Exemption for research, archiving and statistical purposes
- R.17Appointment of Chairperson and other Members of Board
- R.18Salary, allowances and other terms and conditions of service of Chairperson and Members of Board
- R.19Procedure for meetings of Board and authentication of its orders, directions and instruments
- R.20Functioning of Board as digital office
- R.21Terms and conditions of appointment and service of officers and employees of Board
- R.22Appeal to Appellate Tribunal
- R.23Calling for information from Data Fiduciary or intermediary
First Schedule - Consent Manager
Second Schedule - Standards for processing by State
Third Schedule - Class of Data Fiduciaries, purposes and time periods
Fourth Schedule - Exemptions from section 9(1) and 9(3)
Fifth Schedule - Terms of service of Chairperson and Members
Sixth Schedule - Terms of service of officers and employees
Seventh Schedule - Purpose and authorised person