The DPDP Rules 2025 are 23 rules and seven schedules long. Most of what you'll find about them is written for law students, compliance teams or exam preparation. That's useful if you're studying the law. It's less useful if you run a business and want to know what actually changes for you, and when.
So I read the Gazette notification itself and put each rule into the terms a business owner cares about: your forms, your systems, your vendors and your deadlines.
This is the companion to my DPDP compliance checklist, which covers what to change in your app and website. This guide covers what the rules say, rule by rule, so you can see where each item on that checklist comes from.
A note first: I'm a CTO, not a lawyer. This explains what the rules mean for your technology and operations. For legal interpretation of how they apply to your business, speak to a lawyer.
When each of the DPDP Rules 2025 takes effect
- Rules notifiedData Protection Board set up
- Consent ManagersRule 4: registration and obligations
- Everything else that affects youRules 3, 5–16, 22 and 23
Rule 1 sets out the dates. Here's the full map:
| Rules | What they cover | In force from |
|---|---|---|
| 1, 2 | Title, commencement, definitions | 13 Nov 2025 |
| 17–21 | The Data Protection Board: appointments, pay, meetings, working as a digital office, staff | 13 Nov 2025 |
| 4 | Consent Managers: registration and obligations | 13 Nov 2026 |
| 3, 5–16 | Notices, State processing, security, breaches, retention, contact person, children, people with disabilities, exemptions, Significant Data Fiduciaries, rights, transfers abroad, research | 13 May 2027 |
| 22, 23 | Appeals to the Appellate Tribunal; the government calling for information | 13 May 2027 |
Source: Rule 1, G.S.R. 846(E).
In January 2026, MeitY proposed shortening parts of this timeline to 12 months. As of 27 October 2026, that change hasn't been notified, so 13 May 2027 is still the date (MirvoLegal, dpdprules.org). Treat it as the latest date, not the target.
Key terms in plain English
The rules use the Act's vocabulary. Here's what the terms mean for a business:
- Data Principal: the person the data is about. Your customer, user, employee or lead. For a child, it includes the parent.
- Data Fiduciary: the business that decides why and how personal data is processed. If you collect customer data, that's you.
- Data Processor: anyone who processes personal data on your behalf. Your app agency, cloud host, CRM or email tool.
- Consent Manager: a registered company that lets people give, manage and withdraw consent across many businesses from one platform.
- Significant Data Fiduciary (SDF): a business the government notifies as significant, based on factors such as the volume and sensitivity of the data it handles and the risk to people. SDFs have extra duties.
- Data Protection Board of India: the body that will investigate breaches and complaints, and impose penalties under the Act.
The one that matters most is the second. If your website has an enquiry form or your app has a login, you're a Data Fiduciary, and the obligations below are yours, even when a vendor runs the systems.
What each rule means for your business
R3Notices must stand on their own
Your consent notice has to make sense on its own, in clear and plain language. At the minimum, it has to:
- list the personal data you collect, item by item
- state the specific purpose, and the goods, services or uses it enables
- give a link and other means to withdraw consent, as easily as consent was given
- explain how to exercise rights and complain to the Board
What changes: a single "I agree to the privacy policy" checkbox won't do. Each form that collects personal data needs its own short, clear notice.
R6Reasonable security safeguards
At the minimum, you need:
- encryption, masking, obfuscation or tokenisation of personal data
- access control on the systems that hold it
- logs, monitoring and review, so unauthorised access can be detected and investigated
- backups, so processing can continue after an incident
- logs and the related personal data kept for one year
- security obligations written into your contracts with Data Processors
What changes: shared admin logins, unencrypted databases and vendor contracts that say nothing about security all become problems. The contract point matters more than most owners expect. Here's what to check in your software contract.
R7Telling people and the Board about a breach
When you become aware of a personal data breach, you must:
- tell each affected person, without delay, what happened, what it means for them, what you're doing and what they can do, plus a contact person
- tell the Board without delay, then send a detailed report within 72 hours: the facts, the cause, the steps taken, any findings about who caused it, and a report on how you informed people
The Board can allow more time if you ask in writing. What changes: without logs and monitoring, you can't meet any of this. Most small businesses find out about a breach weeks later.
R8How long you keep data, and when you must delete it
This rule has two parts, and they pull in different directions.
Large platforms must delete data from inactive users. This applies to three kinds of business: e-commerce entities with at least 2 crore registered users in India, online gaming intermediaries with at least 50 lakh, and social media intermediaries with at least 2 crore. They must erase a person's data three years after that person last used the service. They must also warn the person at least 48 hours before erasing it (Third Schedule).
Everyone must keep data and logs for at least a year. Every Data Fiduciary must keep personal data, traffic data and processing logs for at least one year from the date of processing, for purposes the government specifies. After that, they must be erased, unless another law requires a longer period (Rule 8(3), Seventh Schedule).
The Gazette's own example: a customer buys an e-book. Once it's delivered, the purpose is served. But the platform must still keep the order details, personal data and logs for at least a year, even if the customer deletes their account.
What changes: your systems need retention rules. Keep the minimum, delete what's no longer needed, and know which is which.
R9A named contact for privacy questions
Your website or app must prominently show the business contact details of someone who can answer questions about your processing. That's your Data Protection Officer, if you have one. Include them in every reply to a rights request.
R10–11Children and people with disabilities
Before processing a child's data (anyone under 18), you need verifiable consent from a parent, and you must check that the parent is an identifiable adult. You can check this using reliable identity and age details you already hold. Or the parent can provide them voluntarily, including through a virtual token from an authorised entity such as a DigiLocker provider. Rule 11 sets a similar check for lawful guardians of persons with disabilities.
R12The exemptions for children's data
Some businesses and purposes are exempt from parts of the children's-data rules, within strict conditions (Fourth Schedule):
- Businesses: clinical establishments and healthcare professionals (for health services), allied healthcare professionals, educational institutions (for educational activities and safety), crèches and day-care centres (for safety), and school transport providers (for location tracking during travel)
- Purposes: creating an email-only account, tracking a child's real-time location for safety, blocking content harmful to children, and confirming that a user isn't a child
What changes: if you run an ed-tech, coaching or kids' product, check carefully whether an exemption covers your use. Most commercial products won't be covered.
R13Extra duties for Significant Data Fiduciaries
If your business is notified as an SDF, you must carry out a Data Protection Impact Assessment and an audit every 12 months. The significant findings go to the Board. You must check that your algorithms don't put people's rights at risk. You must also keep any categories of data the government specifies inside India. Most small and mid-sized businesses won't be SDFs, but large platforms should plan for it.
R14People's rights
You must publish, prominently, how people can make a request (to see, correct or erase their data, or to nominate someone) and what details they'll need to identify themselves. You must also publish your grievance response period, which can't exceed 90 days, and have systems that actually meet it.
R15Sending data outside India
You can transfer personal data abroad. That's subject to any requirements the government sets about making it available to a foreign state or its agencies. This isn't a blanket ban. Only SDFs face a hard localisation rule, and only for the data the government specifies.
R5, 16Government services and research
Rule 5 sets standards for government departments processing data to provide subsidies, benefits, certificates, licences and permits. Rule 16 exempts processing for research, archiving or statistics, if it meets the standards in the Second Schedule. Neither changes much for a typical private business.
Unsure what this means for your product? I can look at what you've built, or what a vendor is proposing to build, and tell you where it falls short. Send it to me for a free second opinion.
Consent Managers: what starts on 13 November 2026
Rule 4 is the first part of the DPDP Rules 2025 that touches the market, and it takes effect on 13 November 2026. It lets companies register with the Board as Consent Managers: platforms where people give, review and withdraw consent across many businesses.
To register, a Consent Manager must (First Schedule):
- be a company incorporated in India, with a net worth of at least ₹2 crore
- run a platform that's independently certified against the Board's standards
- be unable to read the personal data that passes through it
- keep records of consents given, denied and withdrawn for at least seven years
- avoid conflicts of interest with the businesses using it, and not subcontract its obligations
What it means for you: most businesses won't become Consent Managers. But once they exist, people may manage their consent to you through one. If your systems store and check consent properly, connecting to a Consent Manager later is straightforward.
The Data Protection Board: where things stand
The Board was legally established on 13 November 2025, with four members. As of the latest public reports (October 2026), no Chairperson or Members have been appointed. On 7 October 2026, the government's counsel told the Kerala High Court that the Board had yet to be made functional (dpdprules.org).
What it means for you: don't read a slow start as a reason to wait. The Board is designed to work as a digital office (Rule 20). Once it's running, complaints can come in online, and your obligations from 13 May 2027 don't depend on how quickly it's staffed.
Two things in the DPDP Rules that surprise owners
01Deleting an account doesn't mean deleting everything
Rule 8(3) requires you to keep personal data and logs of processing for at least a year, even if the customer deletes their account. Your deletion process needs two tracks: what goes immediately, and what's kept for the minimum period and then erased.
02Your vendors are your problem
Rule 6 makes you responsible for security safeguards, "including in respect of any processing undertaken by it or on its behalf by a Data Processor". If your agency, cloud host or CRM gets it wrong, the obligation still sits with you. That's why the vendor questions in my DPDP compliance checklist matter as much as your own systems.
I've seen how much this changes when it's built in from the start. A2Z Group's workforce system holds the details of more than 12,000 employees. When I chose its platform, one of my four tests was whether A2Z could run it on its own infrastructure. That decision makes questions like "who can access this data, and where is it?" far easier to answer. Here's how we chose the platform.
Frequently asked questions
When do the DPDP Rules 2025 come into force?
In three steps. The rules setting up the Data Protection Board took effect on 13 November 2025. The Consent Manager rule takes effect on 13 November 2026. Almost everything else takes effect on 13 May 2027, including notices, security, breach reporting, retention, children's data and people's rights.
Where can I find the DPDP Rules 2025 PDF?
On MeitY's website, as Gazette notification G.S.R. 846(E) dated 13 November 2025. The document is bilingual, and the English text starts on page 24. Download the official DPDP Rules 2025 PDF.
What is a data fiduciary under the DPDP Rules?
The business or organisation that decides why and how personal data is processed. If you collect personal data from customers, users or employees, you're a Data Fiduciary, even if a vendor runs the systems for you.
What is a Significant Data Fiduciary?
A Data Fiduciary the central government notifies as significant, based on factors like the volume and sensitivity of its data and the risk to people. SDFs must do an annual impact assessment and audit, check their algorithms, and keep specified data in India.
Have the DPDP Rules 2025 been amended?
Not in substance, as of 27 October 2026. A December 2025 corrigendum (G.S.R. 892(E)) corrected wording in Rule 1 without changing any dates.
In October 2026, the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) corrected two phrases in the Act itself. One concerns consent for children and people with disabilities, and the other "data audits" by Significant Data Fiduciaries. It adds no new duties and no new dates. The January 2026 proposal to shorten the timeline hasn't been notified.
Do the DPDP Rules apply to small businesses?
Yes. There's no size exemption for the core rules. Only the extra duties for Significant Data Fiduciaries, and the three-year erasure rule for very large platforms, depend on size.
Turning the rules into a plan
To turn this into work, start with my DPDP compliance checklist and 90-day plan. For a quick outside view of your website's forms and risks, run a free Website Health Check. If AI is part of your plans, here's how the DPDP Act applies to AI agents.
This guide explains the DPDP Rules 2025 for business owners. It isn't legal advice. For how the rules apply to your business, speak to a lawyer.