The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 as G.S.R. 846(E). They have 23 Rules and seven Schedules. Under Rule 1, Rules 1, 2 and 17 to 21 applied at once, Rule 4 applies from 13 November 2026, and Rules 3, 5 to 16, 22 and 23, which hold the core obligations, apply from 13 May 2027.
Key takeaways
- The Rules are G.S.R. 846(E), made under section 40 and published in the Gazette on 13 November 2025.
- Rules 3 and 5 to 16 carry the business obligations: notice, security, breach, retention, children, SDFs, rights, transfers.
- Rules 17 to 21 set up the Board and have applied since 13 November 2025; Rule 4 on consent managers since 13 November 2026.
- The final Rules added a one-year log and data retention duty for every fiduciary (Rule 8(3)) and a 90-day grievance cap.
- Download the official text from MeitY, not a third-party copy, and check the G.S.R. number.
The DPDP Act sets the principles. The Rules tell you how to meet them: what a notice must contain, which security measures are the minimum, what to send the Board after a breach, how long to keep logs. If you are building a compliance programme, the Rules are where the engineering requirements live.
This guide summarises every Rule and Schedule, gives the date each one applies from, and sets out what changed between the January 2025 draft and the final text.
What are the DPDP Rules, 2025?
The Digital Personal Data Protection Rules, 2025 were made by the Central Government under section 40 of the DPDP Act, 2023 and published in the Gazette of India (Extraordinary, Part II, Section 3(i)) on 13 November 2025 as G.S.R. 846(E). On the same day the government notified the commencement of the Act (G.S.R. 843(E)) and established the Data Protection Board (G.S.R. 844(E) and 845(E)).
A draft was published for consultation in January 2025. The final version keeps its structure but changes several obligations, covered below.
How are the Rules phased?
Rule 1 brings the Rules in over eighteen months. The Board machinery came first, the consent manager framework second, and the obligations on businesses last.
For the matching sections of the Act in each phase, see the enforcement date guide.
What does each Rule say?
A short summary of each Rule. The linked guides cover implementation detail.
| Rule | Subject | What it says | From |
|---|---|---|---|
| 1 | Title and commencement | Names the Rules and fixes the three commencement dates | 13 Nov 2025 |
| 2 | Definitions | Defines "user account", "verifiable consent" and "techno-legal measures"; other terms take their meaning from the Act | 13 Nov 2025 |
| 3 | Notice | Notice must stand on its own, use clear plain language, give an itemised description of the data and specific purposes, and link to withdrawal, rights and Board complaints | 13 May 2027 |
| 4 | Consent managers | Registration with the Board on the First Schedule conditions, and ongoing obligations | 13 Nov 2026 |
| 5 | State subsidies and benefits | Processing by the State for subsidies, benefits, services, certificates, licences and permits must follow the Second Schedule standards | 13 May 2027 |
| 6 | Security safeguards | Minimum safeguards: encryption, masking or tokens; access control; logs and monitoring; backups; one-year retention of logs; processor contract clauses; organisational measures | 13 May 2027 |
| 7 | Breach intimation | Tell affected people without delay; tell the Board without delay and send a detailed report within 72 hours | 13 May 2027 |
| 8 | Erasure and retention | Third Schedule erasure periods for large platforms, a 48-hour warning before erasure, and a one-year minimum retention of data, traffic data and logs for every fiduciary | 13 May 2027 |
| 9 | Contact details | Publish the DPO's or a contact person's business contact on your website or app and in every rights response | 13 May 2027 |
| 10 | Children | Due diligence that the parent is an identifiable adult, using details already held, or details or a virtual token provided voluntarily, including via DigiLocker | 13 May 2027 |
| 11 | Persons with disability | Verify that a lawful guardian was appointed by a court, designated authority or local level committee | 13 May 2027 |
| 12 | Children's exemptions | Classes and purposes in the Fourth Schedule exempt from parental consent and the tracking ban | 13 May 2027 |
| 13 | SDF duties | Annual DPIA and audit, report significant observations to the Board, check algorithmic software, keep specified data in India | 13 May 2027 |
| 14 | Rights | Publish how to make requests and the identifiers needed; publish a grievance response period of no more than 90 days; nomination of one or more individuals | 13 May 2027 |
| 15 | Cross-border transfer | Transfers abroad are subject to any government order on making data available to a foreign State | 13 May 2027 |
| 16 | Research and statistics | The Act does not apply to research, archiving or statistics carried on to the Second Schedule standards | 13 May 2027 |
| 17 | Board appointments | Search-cum-selection committees recommend the Chairperson and Members | 13 Nov 2025 |
| 18 | Board service terms | Salary and conditions of the Chairperson and Members, in the Fifth Schedule | 13 Nov 2025 |
| 19 | Board procedure | Meetings, voting and authentication of orders; inquiries completed within six months, extendable by three months at a time | 13 Nov 2025 |
| 20 | Digital office | The Board works as a digital office and can hold proceedings without physical presence | 13 Nov 2025 |
| 21 | Board staff | Officers and employees, on the Sixth Schedule terms | 13 Nov 2025 |
| 22 | Appeals | Appeals to TDSAT are filed digitally, with a fee matching TRAI Act appeals, and TDSAT works as a digital office | 13 May 2027 |
| 23 | Calls for information | The government may require fiduciaries or intermediaries to provide information for Seventh Schedule purposes, and, where disclosure could harm sovereignty, integrity or security of the State, may bar telling the person concerned | 13 May 2027 |
What do the seven Schedules cover?
The Schedules carry much of the operational detail. Each one applies from the date its parent Rule applies.
| Schedule | Used by | Contents | From |
|---|---|---|---|
| First | Rule 4 | Part A: registration conditions for consent managers (Indian company, net worth of at least ₹2 crore, capacity, sound management, certified platform). Part B: obligations (cannot read the data it carries, keeps consent records for at least seven years, no sub-contracting, fiduciary capacity, no conflicts, audits, no change of control without Board approval) | 13 Nov 2026 |
| Second | Rules 5 and 16 | Standards for State processing under section 7(b) and for research, archiving and statistics: lawful, purpose-limited, data-minimised, accurate, retained only as long as needed, secure and accountable | 13 May 2027 |
| Third | Rule 8 | Erasure after three years of inactivity for e-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh | 13 May 2027 |
| Fourth | Rule 12 | Part A: classes exempt from parental consent and the tracking ban (healthcare, allied healthcare, education, crèches, school transport). Part B: purposes exempt (for example email-only accounts, real-time location for safety, confirming a user is not a child) | 13 May 2027 |
| Fifth | Rule 18 | Salary, allowances and service conditions of the Board's Chairperson and Members | 13 Nov 2025 |
| Sixth | Rule 21 | Service conditions of the Board's officers and employees | 13 Nov 2025 |
| Seventh | Rules 23 and 8(3) | Purposes for which the government may call for information, and the authorised person for each: State use for sovereignty, integrity or security; State functions and legal disclosures; assessing whether to notify an SDF | 13 May 2027 |
The Seventh Schedule matters more than it looks. Rule 8(3) requires every fiduciary to keep personal data, associated traffic data and processing logs for at least one year for the purposes in this Schedule, which pulls ordinary businesses into a retention obligation they did not have in the draft.
What changed from the January 2025 draft?
If your team prepared against the draft, check these changes. MeitY's FAQs were written for the draft and there is no official FAQ on the final Rules.
| Area | Final Rules (November 2025) | Effect on your programme |
|---|---|---|
| Commencement | Fixed three-phase commencement; the draft had none | A hard date of 13 May 2027 to plan against |
| Notice | Data description must be itemised; goods and services description must be "specific" | Generic "we collect information such as" notices no longer fit |
| Security | Rule 6 measures introduced with "such as" | The list is illustrative; you still need each outcome, chosen to suit your risk |
| Retention | New Rule 8(3): every fiduciary keeps data, traffic data and logs for at least one year | Retention schedules need a one-year floor as well as erasure ceilings |
| Grievances | Grievance response period capped at 90 days | Publish a period of 90 days or less |
| Children and disability | Split into Rules 10 and 11 | Separate verification flows for parents and lawful guardians |
| Cross-border | Condition applies to all personal data | Any transfer may be affected by a future government order |
Several things did not change: the 72-hour detailed breach report to the Board, the 48-hour notice before erasure, the Third Schedule thresholds, the one-year log retention in Rule 6, and the ₹2 crore net worth for consent managers.
Where to get the DPDP Rules 2025 PDF
Use the official text on MeitY's data protection framework page, which hosts the Act and the Rules. When you save or share a copy, check three things:
- It is G.S.R. 846(E) dated 13 November 2025, not the January 2025 draft, which circulated widely and differs in the ways listed above.
- You read it alongside the Act as amended by the DPDP (Removal of Difficulties) Order, 2026 (S.O. 5458(E), 5 October 2026), which adjusted the wording of sections 9(1) and 10(2)(c)(ii) of the Act. The Rules themselves were not changed.
- You track later notifications. Several Rules depend on future government action: SDF notifications for Rule 13, orders under Rule 15, a localisation list under Rule 13(4). None has been issued yet.
Writ petitions challenging parts of the Act and the Rules are pending before the Supreme Court. Notice was issued on 16 February 2026, there is no stay, and the matter has been referred to a larger bench.
What to do next
Turn the Rules into work items. For most organisations the order is:
- Rewrite notices to the Rule 3 standard and rebuild consent capture and withdrawal.
- Gap-assess security against the seven Rule 6 measures, starting with logging and one-year retention.
- Write a breach runbook that meets Rule 7's two-stage Board report and individual intimation, alongside CERT-In's six-hour reporting.
- Set retention floors and ceilings under Rule 8, and erasure jobs with the 48-hour warning where the Third Schedule applies.
- Publish contact details (Rule 9) and a grievance period of no more than 90 days (Rule 14).
The DPDP compliance checklist lists each item with its Rule reference. If you want an implementation team to work through it with your counsel, see our services.
Frequently asked questions
Where can I download the DPDP Rules 2025 PDF?
The official Gazette text is on MeitY's data protection framework page at meity.gov.in/data-protection-framework. Check that the copy you use is G.S.R. 846(E) dated 13 November 2025, not the January 2025 draft.
When do the DPDP Rules 2025 come into force?
In three phases under Rule 1: Rules 1, 2 and 17 to 21 on 13 November 2025; Rule 4 on 13 November 2026; and Rules 3, 5 to 16, 22 and 23 on 13 May 2027.
What is G.S.R. 846(E)?
It is the Gazette notification number of the Digital Personal Data Protection Rules, 2025, published on 13 November 2025. G.S.R. 843(E) was the Act's commencement notification and G.S.R. 844(E) and 845(E) established the Board.
How many rules are there in the DPDP Rules 2025?
There are 23 Rules and seven Schedules. The Schedules hold the detail: consent manager conditions, standards for State and research processing, erasure periods for large platforms, children's exemptions, Board service terms, and purposes for calling for information.
Did MeitY publish FAQs on the final DPDP Rules?
No. MeitY issued FAQs only for the January 2025 draft. There is no official FAQ on the final Rules as of 13 November 2026, so be careful with answers based on the draft.
What changed between the draft and final DPDP Rules?
The final Rules fixed a phased commencement, made notices itemised and specific, listed Rule 6 safeguards with 'such as', added a one-year retention duty for every fiduciary in Rule 8(3), capped the grievance period at 90 days and split children and disability into separate Rules.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.