India · MeitY notification · 13 November 2025
DPDP Rules, 2025: what the framework asks organisations to do
The Rules turn parts of the DPDP Act into operating requirements: how notices are presented, how consent is verified, what security and breach processes need to cover, and how people can exercise their rights. Their start dates are staggered, so preparation needs a timeline as well as a task list.
01 · Staggered commencement
Three dates shape the preparation plan
Rules 1, 2 and 17–21
These include preliminary provisions and rules relating to the Data Protection Board and its functioning.
Rule 4
Registration and obligations for Consent Managers are scheduled to start one year after publication.
Rules 3, 5–16, 22 and 23
This group includes notice, security, breach intimation, retention, child data, rights, grievance and related duties.
Rule 1’s commencement clause: notified DPDP Rules, 2025. Also see the Act commencement notification.
02 · What the Rules cover
A framework that connects notices to operations
- Rule 3 — notice: a standalone, clear notice with itemised personal data, specified purposes, and ways to withdraw consent, exercise rights or complain to the Board.
- Rules 5–9 — public services, security, breaches and contact: standards for specified government services, safeguards, breach intimation, specified retention periods and published contact information.
- Rules 10–12 — children and lawful guardians: verifiable consent requirements and limited exemptions under the schedules.
- Rule 13 — Significant Data Fiduciaries: added impact assessment, audit and other obligations for those notified in that category.
- Rule 14 — rights: publish request channels and required identifiers, and a reasonable grievance response period no longer than 90 days.
- Rules 15–16 — transfers and exemptions: provisions on transfers outside India and specified research, archiving or statistical processing.
- Rules 22–23 — appeals and information requests: procedures tied to appeals and calls for information.
The Rules should be read with the Act, its schedules, applicable commencement notifications and any later corrigenda. A business will need to identify which provisions apply to its role and processing rather than treating the document as one universal checklist.
03 · Read with context
The same rule can matter differently across services
An education platform, a clinic and a retailer may all process personal data, but the purposes, people affected, legal duties and exceptions can differ. The Rules use targeted scopes and schedules; record why a provision applies to each processing activity.
Start with the enabling Act section
Check the Act provision that authorises or requires the Rule, then read definitions, conditions, illustrations and schedules alongside it.
Check the timing and any corrigendum
Separate provisions already in force from those scheduled later. Use the official MeitY publication and its listed corrigenda to confirm the current text.
Official publication and related documents: MeitY DPDP Rules 2025 page.
04 · Prepare
Turn the Rules into owned work
- Map systems, data categories, purposes, user groups and service providers.
- Review notices and consent journeys against the requirements that apply to each purpose.
- Assign owners for security, incidents, rights requests, grievances, retention and children’s data.
- Set internal milestones ahead of the applicable commencement date and keep evidence of decisions.
- Revisit the plan when the Rules, notifications or organisation’s processing changes.
For a working overview, see the DPDP Act summary, compliance checklist and industry-specific guides.
Questions teams ask
DPDP Rules 2025 FAQs
When do the main business requirements start?
Rules 3, 5–16, 22 and 23 are scheduled for 13 May 2027. Rule 4, which covers Consent Manager registration and obligations, is scheduled for 13 November 2026.
Are all Rules in force already?
No. Rule 1 creates three commencement groups. Rules 1, 2 and 17–21 commenced on publication; Rule 4 follows one year later; Rules 3, 5–16, 22 and 23 follow after eighteen months.
Do the Rules replace the DPDP Act?
No. The Rules provide details under the Act. Read both together, including schedules, notifications and corrigenda.
Where is the authoritative text?
Use the official Gazette and MeitY publication. The MeitY Rules page also lists related documents and the corrigendum.
Start with the rules that touch your work
Use the checklist to map responsibilities, assign owners and prepare evidence for your organisation.