ResourcesThe Rules
Digital Personal Data Protection Rules, 2025
G.S.R. 846(E) · Notified 13 November 2025 · Official text, rule by rule
Download PDF of the DPDP Rules, 2025English · 18 pages · 366 KBRead the full textOfficial copy (MeitY) (opens in a new tab)
Search the Rules
Look up a word, a figure such as “72 hours”, or go straight to a provision with “rule 7”. Every result opens the official text.
Try:
At a glance
Figures taken from the text. Each one links to the provision it comes from.
72 hours
Deadline for updated and detailed breach information to the Board
Within seventy-two hours of becoming aware, the Data Fiduciary gives the Board updated, detailed information, unless the Board allows longer.
Commencement: 13 May 2027 (computed)Source: Rule 7(2)(b)
1 year
Minimum retention of data and logs for Seventh Schedule purposes
A Data Fiduciary retains personal data, traffic data and logs of processing for at least one year, for Seventh Schedule purposes.
Commencement: 13 May 2027 (computed)Source: Rule 8(3)
90 days
Ceiling on grievance response time
Data Fiduciaries and Consent Managers must publish a grievance redressal system that responds within a reasonable period not exceeding ninety days.
Commencement: 13 May 2027 (computed)48 hours
Minimum notice before a Third Schedule erasure
A Data Fiduciary in a Third Schedule class must inform the Data Principal at least forty-eight hours before the erasure period ends.
Commencement: 13 May 2027 (computed)Source: Rule 8(2)
6 months
Board inquiry to be completed within
The Board's inquiry must be completed within six months of receiving the intimation, complaint, reference or direction, extendable for recorded reasons.
Commencement: 13 November 2025Source: Rule 19(9)
23 rules
Followed by seven Schedules
Rules 1 to 23 are followed by the First to Seventh Schedules.
Commencement: 13 May 2027 (computed)
The Rules, rule by rule
Titles are as printed in the Gazette. The “in brief” lines and commencement dates are Agicentral’s own aids.
Rules
23 rules
- 1 RuleShort title and commencementGives the Rules their short title and staggers their start: rules 1, 2 and 17–21 on publication, rule 4 one year after publication, and rules 3, 5–16, 22 and 23 after eighteen months.Commencement: 13 November 2025
- 2 RuleDefinitionsDefines terms used in the Rules, such as 'Act', 'techno-legal measures', 'user account' and 'verifiable consent', and carries over the Act's meanings for words the Rules do not define.Commencement: 13 November 2025
- 3 RuleNotice given by Data Fiduciary to Data PrincipalSets out what the Data Fiduciary's notice to the Data Principal must contain, such as an itemised description of the personal data, the purposes of processing, and ways to withdraw consent or complain to the Board.Commencement: 13 May 2027 (computed)
- 4 RuleRegistration and obligations of Consent ManagerLets a person who meets the First Schedule conditions apply to the Board for registration as a Consent Manager, and sets out the Board's powers to register, reject, direct compliance, suspend or cancel.Commencement: 13 November 2026 (computed)
- 5 RuleProcessing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalitiesRequires the State and its instrumentalities to follow the Second Schedule standards when processing personal data to provide benefits such as subsidies or licences, and explains 'under law', 'under policy' and 'using public funds'.Commencement: 13 May 2027 (computed)
- 6 RuleReasonable security safeguardsRequires a Data Fiduciary to take reasonable security safeguards to prevent personal data breach, including, at a minimum, measures such as encryption, access controls, log monitoring and data backups.Commencement: 13 May 2027 (computed)
- 7 RuleIntimation of personal data breachSets out what a Data Fiduciary must tell affected Data Principals and the Board after becoming aware of a personal data breach, including detailed information to the Board within 72 hours, or longer if the Board allows.Commencement: 13 May 2027 (computed)
- 8 RuleTime period for specified purpose to be deemed as no longer being servedRequires specified classes of Data Fiduciary to erase personal data after a Third Schedule period of inactivity, with at least 48 hours' notice; any Data Fiduciary must also retain personal data and logs at least one year.Commencement: 13 May 2027 (computed)
- 9 RuleContact information of person to answer questions about processingRequires a Data Fiduciary to prominently publish, and mention in every response to a rights request, the business contact details of its Data Protection Officer (if applicable) or another person who can answer Data Principals' questions.Commencement: 13 May 2027 (computed)
- 10 RuleVerifiable consent for processing of personal data of childRequires a Data Fiduciary to take appropriate measures and due diligence to obtain verifiable parental consent before processing a child's personal data, including checking that the person claiming to be the parent is an adult.Commencement: 13 May 2027 (computed)
- 11 RuleVerifiable consent for processing of personal data of person with disability who has lawful guardianRequires a Data Fiduciary obtaining verifiable consent from the lawful guardian of a person with disability to exercise due diligence in checking the guardian was appointed by a court, designated authority or local level committee.Commencement: 13 May 2027 (computed)
- 12 RuleExemptions from certain obligations applicable to processing of personal data of childExempts certain classes of Data Fiduciaries, such as healthcare professionals and educational institutions, and certain purposes, from section 9's parental-consent requirement and bar on tracking or targeted advertising aimed at children, subject to Fourth Schedule conditions.Commencement: 13 May 2027 (computed)
- 13 RuleAdditional obligations of Significant Data FiduciaryAdds duties for a Significant Data Fiduciary, including a Data Protection Impact Assessment and audit once every twelve months, a report of significant observations to the Board, and limits on transferring certain personal data outside India.Commencement: 13 May 2027 (computed)
- 14 RuleRights of Data PrincipalsRequires Data Fiduciaries and, where applicable, Consent Managers to publish how Data Principals can make rights requests and a grievance response period no longer than ninety days, and lets Data Principals nominate others to exercise their rights.Commencement: 13 May 2027 (computed)
- 15 RuleTransfer of personal data outside the territory of IndiaAllows a Data Fiduciary to transfer personal data outside India, subject to requirements the Central Government may specify by order for making it available to a foreign State, its agencies or entities it controls.Commencement: 13 May 2027 (computed)
- 16 RuleExemption from Act for research, archiving or statistical purposesTakes processing of personal data necessary for research, archiving or statistical purposes outside the Act, provided it is carried on in accordance with the standards in the Second Schedule.Commencement: 13 May 2027 (computed)
- 17 RuleAppointment of Chairperson and other MembersRequires the Central Government to constitute separate Search-cum-Selection Committees to recommend the Board's Chairperson and its other Members, and to appoint them after considering the recommendations.Commencement: 13 November 2025
- 18 RuleSalary, allowances and other terms and conditions of service of Chairperson and other MembersPoints to the Fifth Schedule for the salary, allowances and other terms and conditions of service of the Board's Chairperson and other Members.Commencement: 13 November 2025
- 19 RuleProcedure for meetings of Board and authentication of its orders, directions and instrumentsSets out Board meeting procedure, such as quorum, voting and conflicts of interest, how its orders are authenticated, and a six-month period for completing inquiries unless extended.Commencement: 13 November 2025
- 20 RuleFunctioning of Board as digital officeHas the Board function as a digital office that may adopt techno-legal measures to conduct proceedings without requiring anyone's physical presence, while keeping its power to summon people and examine them on oath.Commencement: 13 November 2025
- 21 RuleTerms and conditions of appointment and service of officers and employees of BoardLets the Board, with the Central Government's prior approval, appoint the officers and employees it considers necessary, and points to the Sixth Schedule for their terms and conditions of service.Commencement: 13 November 2025
- 22 RuleAppeal to Appellate TribunalLets a person aggrieved by a Board order or direction appeal digitally to the Appellate Tribunal, normally with a fee, and says the Tribunal is guided by natural justice, not bound by the Code of Civil Procedure.Commencement: 13 May 2027 (computed)
- 23 RuleCalling for information from Data Fiduciary or intermediaryLets the Central Government, through authorised persons in the Seventh Schedule, require a Data Fiduciary or intermediary to furnish information and, where disclosure is likely to prejudice India's sovereignty or State security, to keep the request undisclosed.Commencement: 13 May 2027 (computed)
Schedules
7 schedules
Schedule descriptions are Agicentral’s labels for navigation, not part of the law.
- First ScheduleConsent Managers — conditions of registration and obligationsLists conditions for registering as a Consent Manager, such as being a company incorporated in India with net worth of at least ₹2 crore, and sets obligations for registered Consent Managers.
- Second ScheduleStandards for processing by the State and for research, archiving or statistical purposesSets standards for processing personal data, such as lawfulness, necessity and security safeguards, when the State processes under section 7(b) and when processing is for research, archiving or statistical purposes under section 17(2)(b).
- Third ScheduleTime periods after which personal data must be erasedSets a three-year period after which e-commerce entities, online gaming intermediaries and social media intermediaries with a minimum number of registered users in India erase personal data if the Data Principal does not approach them, for most purposes.
- Fourth ScheduleExemptions from certain obligations on children's dataLists classes of Data Fiduciaries, such as clinical establishments and educational institutions, and purposes, such as tracking a child's real-time location for safety, to which section 9(1) and (3) do not apply, on stated conditions.
- Fifth ScheduleTerms of service of the Board's Chairperson and MembersSets terms of service for the Board's Chairperson and other Members, including a consolidated monthly salary of ₹4.5 lakh for the Chairperson and ₹4 lakh for Members, plus allowances and leave.
- Sixth ScheduleTerms of service of the Board's officers and employeesSets terms for the Board's officers and employees, including deputation from government bodies for up to five years, plus gratuity, travel, medical assistance and leave, many linked to Central Government rules.
- Seventh SchedulePurposes and authorised persons for calling for informationLists purposes for which the Central Government may call for information, such as assessment for notifying a Significant Data Fiduciary or State use of data for the security of the State, and the authorised person for each.
Keep exploring
DPDP Act, 2023
The 44 sections and the Schedule that set out the law, read section by section.
OpenTimeline of key dates
When each part of the Act and the Rules begins, on one page.
OpenAct-to-Rules map
Which rules relate to which section of the Act.
OpenGlossary
Every term the Act and the Rules define, in the exact words of the Gazette, linked to the provision.
OpenAbout this text
Reproduced verbatim from the official Gazette PDF. Text last verified against the official PDF on 1 October 2026.
- Instrument
- The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))
- Published
- 13 November 2025 · The Gazette of India, Extraordinary, Part II — Section 3(i), New Delhi, 13 November 2025 (F. No. AA-11038/1/2025-CLandES)
- Issued by
- Ministry of Electronics and Information Technology
Official sources
- The DPDP Rules, 2025 — official Gazette PDF (Hindi pp. 1–23, English pp. 24–41) (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)
- G.S.R. 892(E) — corrigendum to the DPDP Rules, 2025 (opens in a new tab) — Ministry of Electronics and Information Technology (MeitY)
General information, not legal advice. The Gazette notification is the authoritative text. The summaries, links and labels around the text are Agicentral’s own and are not part of the law.
Read the law, then see where you stand.
Take the ten-minute DPDPA readiness assessment and get a clear view of the gaps that matter for your organisation.