Digital Personal Data Protection Rules, 2025

What it does

The Rules were notified on 13 November 2025 as G.S.R. 846(E). They fill in what the Digital Personal Data Protection Act, 2023 leaves to rules: the notice a data fiduciary gives, the security measures it takes, how a breach is reported, when data is erased, how the rights of a data principal are exercised, how a parent's consent for a child is verified, and what exemptions apply. They also contain the machinery of the Data Protection Board of India.

They run on the same clock as the Act. Rules 1, 2 and 17 to 21 came into force on 13 November 2025, and they concern the Board's chairperson and members, its meetings, its working as a digital office and its staff. Rule 4, on the registration and obligations of a consent manager, starts on 13 November 2026. Rules 3, 5 to 16, 22 and 23 start on 13 May 2027, together with sections 3 to 17 of the Act.

Who it binds

Data fiduciaries, the persons that decide the purpose and means of processing personal data, and the data processors that act for them. Consent managers are bound by rule 4 and its Schedule. The Board and its officers are bound by the rules on their own functioning. The rights the Rules describe belong to data principals, the individuals to whom the data relates, and, for a child, to the parent exercising them.

The significant data fiduciary, a class the Act allows the Government to notify, carries heavier duties. Whether a business is in that class is a question for the notification and cannot be assumed from its size.

What has changed, and when

The Rules were issued with two other instruments on the same day. G.S.R. 843(E) appoints the dates on which the Act comes into force in tranches, and G.S.R. 844(E) establishes the Data Protection Board. Reading any one of the three alone gives the wrong answer about what a business owes and from when.

The structure is this. The provisions that set up the Board and the rule-making power took effect on 13 November 2025. A year on, on 13 November 2026, the consent manager provisions start. Eighteen months on, on 13 May 2027, the substantive duties in the Act and the matching rules start together. Until that date a company processing personal data in India owes none of those duties under this Act, and the older regime, section 43A of the Information Technology Act, 2000 and the rules under it, remains the operative data security law.

What turns on it in practice

On 13 May 2027 a business owes every duty at once, and so the work is in the months before: mapping the personal data it processes, building notices, setting breach procedures, and settling who is a processor and on what terms. The practice area on technology, data and product handles this, and the practice area on artificial intelligence advises on how it applies to training data and to model outputs.

The children's provisions illustrate how the Rules and the Act are read together. Section 9 of the Act requires the verifiable consent of a parent before any personal data of a child, a person under eighteen, is processed, and bars tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 and its Schedule lift both duties for an educational institution, but only for tracking and behavioural monitoring done for its educational activities or for the safety of children enrolled with it. The site's note on the point concludes that admission, fee and examination records fall outside that condition on an ordinary reading, and that neither the section nor the rule lifts the bar on processing that is detrimental to a child.

A company with a school, a learning application or a youth product should read the Rule against its own data flows, purpose by purpose, and not rely on the general exemption of the institution.