Digital Personal Data Protection Rules, 2025
Digital Personal Data Protection rules in India
- 2 min read
- 5 chapters
Explore on Lably
ToursExplore Lably’s 3D toursSummary
The rules set out practical steps for consent collection, notice requirements, breach notification, record-keeping, and special protections (for children and persons with disabilities). They also define timelines for phased compliance and provide details on the constitution and powers of the Data Protection Board of India envisaged under the DPDP Act, 2023. The notification of the Rules followed public and stakeholder consultations and was presented as the final step to operationalize India’s data-protection framework.
Sign in to keep reading
4 more chapters are free with a Lably account.
Background
The Digital Personal Data Protection Act, 2023 established the legal framework for personal data protection in India but delegated many technical and procedural requirements to subordinate rules. After stakeholder consultations and draft releases, the Ministry of Electronics and Information Technology (MeitY) finalized the Rules and notified them on 14 November 2025.
Key provisions
The key elements of the Rules include:
- Consent and notice — Data fiduciaries must provide clear and concise privacy notices that specify purpose(s) of processing, categories of data processed, retention periods, and mechanisms to withdraw consent. Consent requirements emphasise informed, unambiguous and freely given consent for processing personal data.
- Data breach notification — Fiduciaries are required to notify the Data Protection Board and affected data principals of personal data breaches within specified timelines, and to provide details about the nature of the breach and mitigation steps taken.
- Special categories and vulnerable groups — The Rules provide enhanced protections for children's data (verifiable guardian consent for certain processing) and for persons with disabilities, including guidelines for obtaining lawful guardian oversight where appropriate.
- Cross-border data transfer — The Rules set out conditions and safeguards for transfer of personal data outside India; the Central Government retains power to specify countries or mechanisms for permitted transfers.
- Data Protection Board of India — The Rules detail the composition, appointment process and functioning (including digital-first proceedings) of the Data Protection Board of India envisaged under the DPDP Act, 2023.
- Phased compliance — Certain operational provisions are subject to phased implementation to allow businesses (including startups and small enterprises) to adapt to new compliance requirements.
Implementation timeline
External Sources
Text of the Rules published by the Ministry of Electronics and Information Technology