A comprehensive guide to India's data protection framework. Understand your obligations as a Data Fiduciary and the rights of Data Principals.
The Digital Personal Data Protection Rules, 2025 were published on November 13, 2025, under the Digital Personal Data Protection Act, 2023. These rules provide the operational framework for data protection compliance in India.
Commencement: Rules 1, 2, and 17-21 came into force immediately. Rule 4 (Consent Manager) comes into force after 1 year. Rules 3, 5-16, 22-23 come into force after 18 months.
Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
The individual to whom the personal data relates.
The online account registered by the Data Principal with the Data Fiduciary, including profiles, pages, handles, email address, mobile number and other similar presences.
A consent as specified in rules 10 or 11, particularly for processing children's data or data of persons with disabilities.
Technical and legal measures as referred to under rules 20 and 22 for digital proceedings.
The notice given by a Data Fiduciary to a Data Principal must:
Important: Consent withdrawal must be as easy as giving consent. The Data Principal must be able to withdraw consent with comparable ease.
A Consent Manager is a registered entity that helps Data Principals manage their consent across multiple Data Fiduciaries.
Data Fiduciaries must protect personal data by implementing the following minimum security measures:
Encryption, obfuscation, masking, or virtual tokens mapped to personal data
Appropriate measures to control access to computer resources
Visibility on data access through logs, monitoring, and review for detecting unauthorized access
Measures for continued processing in event of data compromise or loss
Retain logs and personal data for minimum 1 year for investigation and remediation
Appropriate provisions in contracts with Data Processors for security safeguards
Critical Requirement: All personal data breaches must be reported to the Data Protection Board within 72 hours.
Without delay, inform each affected Data Principal through their user account or registered communication mode:
Within 72 hours, provide:
Personal data must be erased when the specified purpose is no longer being served, subject to the following:
| Entity Type | Threshold | Retention Period |
|---|---|---|
| E-commerce Entity | 2 crore+ registered users | 3 years from last interaction |
| Online Gaming Intermediary | 50 lakh+ registered users | 3 years from last interaction |
| Social Media Intermediary | 2 crore+ registered users | 3 years from last interaction |
Mandatory Log Retention: All Data Fiduciaries must retain personal data, traffic data, and processing logs for a minimum of 1 year from the date of processing, regardless of entity type.
Every Data Fiduciary must prominently publish on its website or app:
Requirement: The contact information must be mentioned in every response to a communication for the exercise of Data Principal rights under the Act.
Processing personal data of children requires verifiable parental consent with due diligence to verify the parent is an identifiable adult.
Healthcare: Clinical establishments, mental health establishments, and healthcare professionals for health services
Education: Educational institutions for tracking and behavioural monitoring for educational activities or safety
Child Care: Creches and day care centres for safety monitoring
Transport: Transport providers for location tracking during travel to/from institutions
Data Fiduciaries notified as "Significant" have additional obligations:
Conduct DPIA and audit every 12 months to ensure compliance
Furnish significant observations from DPIA and audit to the Board
Verify that algorithmic software does not pose risk to Data Principal rights
Certain personal data may be restricted from transfer outside India as specified by Central Government
Data Fiduciaries must enable Data Principals to exercise their rights under the Act:
Access personal data being processed and obtain a summary
Request correction of inaccurate or incomplete personal data
Request deletion of personal data no longer necessary
Withdraw previously given consent at any time
File grievances and receive response within 90 days
Nominate individuals to exercise rights on their behalf
Response Timeline: Data Fiduciaries must respond to grievances within 90 days through their grievance redressal system.
Personal data may be transferred outside India subject to restrictions specified by the Central Government regarding:
Note: Significant Data Fiduciaries may be subject to additional data localisation requirements for certain categories of personal data.
The following rules cover administrative matters, exemptions, and the functioning of the Data Protection Board:
Processing for research, archiving, or statistical purposes is exempt if carried out per Second Schedule standards.
Covers appointment of Chairperson and Members, salaries, procedures, and digital office functioning. The Board operates as a digital office using techno-legal measures.
Appeals against Board orders go to the Appellate Tribunal. Must be filed digitally with applicable fees (payable via UPI).
Central Government may require Data Fiduciaries or intermediaries to furnish information for purposes specified in Seventh Schedule (national security, law enforcement, etc.).
Schedules: The Rules include 7 Schedules covering Consent Manager requirements, processing standards, retention periods, children's data exemptions, Board member terms, employee conditions, and government information requests.
Privacy Labs provides end-to-end compliance automation for the DPDP Act 2025. From consent management to breach notifications, we've got you covered.