TL;DR
- The Digital Personal Data Protection Rules, 2025 were notified by G.S.R.
- 846(E) and commence in three tranches measured from publication in the Official Gazette.
- Rules 1, 2 and 17 to 21 took effect on publication, Rule 4 one year after, and Rules 3, 5 to 16, 22 and 23 eighteen months after.
Quick Answer: The Digital Personal Data Protection (DPDP) Rules require every Data Fiduciary in India to meet obligations under twenty-three rules in three tranches. Rules 1, 2 and 17 to 21 took effect on publication, Rule 4 one year later, and the rest eighteen months later. The duties cover consent notices, security safeguards, breach intimation, retention and children's data.
The Rules are notified, not draft. G.S.R. 846(E) carries twenty-three rules and seven Schedules, and a December 2025 corrigendum has since corrected the commencement sub-rules themselves. The staggered structure matters more than any single date, because it turns one rulebook into three dated work queues.
The Rules sit under the Digital Personal Data Protection Act, 2023, Act 22 of 2023. Act-level applicability, the definitions and the rights framework are covered in LexComply's guide to DPDP Act obligations for Indian companies.
Commencement at a glance, under Rule 1 of the notified Digital Personal Data Protection Rules, 2025
| Tranche | Rules in it | When it bites | Calendar reading |
|---|---|---|---|
| 1 | Rules 1, 2 and 17 to 21 | on the date of publication in the Official Gazette | 13 or 14 November 2025 |
| 2 | Rule 4, Consent Manager registration | one year after the date of publication | 13 or 14 November 2026 |
| 3 | Rules 3, 5 to 16, 22 and 23 | eighteen months after the date of publication | 13 or 14 May 2027 |
The notification is dated 13 November 2025. The Government's own gazette stamp and the Press Information Bureau release both put publication at 14 November 2025. Because every tranche runs from publication, the calendar column gives both readings.
What Do the DPDP Rules Require?
Five rules carry almost all of the operational load: consent notices (Rule 3), security safeguards (Rule 6), breach intimation (Rule 7), retention and erasure (Rule 8) and children's data (Rule 10). All five sit in the eighteen-month tranche, so the substantive build has one planning horizon.
| Obligation | Rule | What it requires | Who it binds |
|---|---|---|---|
| Consent notice | Rule 3 | A plain-language notice, presented and understandable independently of any other information, with an itemised description of the personal data and the specified purpose | Every Data Fiduciary relying on consent |
| Security safeguards | Rule 6(1) | Seven minimum measures, including encryption, obfuscation, masking or virtual tokens, access control, logging and monitoring, backups, one-year log retention and contractual flow-down to the Data Processor | Every Data Fiduciary |
| Breach intimation | Rule 7 | Intimation to each affected Data Principal without delay, plus two separate intimations to the Data Protection Board | Every Data Fiduciary |
| Retention and erasure | Rule 8 | Erasure after three years for the Third Schedule classes, with at least forty-eight hours of prior notice to the Data Principal | Data Fiduciaries at or above the Third Schedule thresholds |
| Children's data | Rule 10 | Verifiable parental consent, plus due diligence that the self-identified parent is an identifiable adult who has completed 18 years | Any Data Fiduciary processing a child's personal data |
| Exemptions | Rule 12 | Carries the exemptions in Sections 9(1) and 9(3) of the Act through the Fourth Schedule | Classes and purposes listed in Parts A and B |
What must a Data Fiduciary do after a personal data breach?
Rule 7 requires three intimations, not one. The affected Data Principal must be told without delay, through her user account or registered mode of communication, with five itemised contents including the nature, extent and timing of the breach and a business contact who can respond.
The Board receives two of the three. Rule 7(2)(a) requires a first intimation without delay, covering nature, extent, timing, location of occurrence and likely impact. Rule 7(2)(b) then requires a detailed report within seventy-two hours, "or within such longer period as the Board may allow on a request made in writing". The clock is extendable, and it governs the second Board-facing duty rather than the only one. Anyone running a cyber incident reporting workflow for SEBI will recognise the pattern.
How long may personal data be retained?
Rule 8 applies a three-year erasure duty to three classes of Data Fiduciary listed in the Third Schedule. The three years run from the date she last approached the Data Fiduciary or last exercised her rights, or the commencement of the Rules, whichever is latest.
| Class of Data Fiduciary | Registered users in India | Retention before erasure |
|---|---|---|
| E-commerce entity | 2 crore or more | 3 years |
| Online gaming intermediary | 50 lakh or more | 3 years |
| Social media intermediary | 2 crore or more | 3 years |
Rule 8(2) then requires the Data Fiduciary to inform her at least forty-eight hours before the erasure period completes, so that logging in or exercising a right can stop the deletion.
Do the Rules themselves set the penalties?
No. The penalties sit in the Schedule to the Digital Personal Data Protection Act, 2023, read with Section 33(1), and not in the Rules. Every entry is a maximum expressed as "may extend to", not a band with a floor.
Attribution matters more than the headline figure. Up to ₹250 crore attaches only to the Section 8(5) security-safeguards duty, and up to ₹200 crore attaches to two entries, Section 8(6) breach notification and Section 9 children's data. Section 42 permits amendment by notification.
When Do the DPDP Rules Come Into Force?
In three stages, each measured from the date of publication in the Official Gazette.
The Act's own commencement was notified separately by G.S.R. 843(E) and is wider than commonly written. Sections 18 to 26 took effect on publication. Two provisions bite at one year rather than eighteen months, namely Section 6(9) and Section 27(1)(d). A compliance calendar tracking statutory due dates across jurisdictions should hold the Act and the Rules as separate commencement series.
Which rules are already operative?
The rules in force govern the regulator rather than the regulated. Rule 17 sets up the Search-cum-Selection Committees, Rule 18 and Rule 21 fix salaries and staffing through the Fifth and Sixth Schedules, and Rule 20 makes the Data Protection Board a digital office.
Why has the commencement wording itself been corrected?
Because a corrigendum amended Rule 1(3) and Rule 1(4). G.S.R. 892(E), dated 10 December 2025, makes eight corrections at five places in the notified text, and two of them land on the commencement sub-rules, replacing "of this Gazette" with "in the Official Gazette".
That phrase occurs exactly twice in the notified text, at those two sub-rules. Any page quoting either one from the November text is quoting superseded wording. The corrigendum of 10 December 2025 also corrects Rule 23(1) and a cross-reference in the Schedules.
What Must a Consent Notice Contain?
Rule 3 sets three requirements, and the first is about format rather than content. The notice must be presented and be understandable independently of any other information the Data Fiduciary has given or makes available. A privacy clause buried inside terms of service does not satisfy it.
The second requirement is substantive. The notice must give a clear and plain-language fair account, carrying at the minimum an itemised description of the personal data and the specified purpose, with a specific description of the goods or services provided or the uses enabled.
How must withdrawal of consent be offered?
Through the particular communication link, and with comparable ease. Rule 3(c) requires the notice to give that link to the website or app, plus a description of other means by which the Data Principal may do three things.
- Withdraw consent, with ease comparable to that with which it was given
- Exercise her rights under the Act
- Make a complaint to the Data Protection Board
The comparability test is the operative one: a consent captured in a single tap cannot be withdrawn only through a written request to a support desk. Mapping each capture surface to a matching withdrawal surface belongs in a single register of statutory obligations, owners and due dates.
Who Is a Significant Data Fiduciary and What Extra Applies?
A Significant Data Fiduciary, or SDF, is a Data Fiduciary or class that the Central Government may notify as such under Section 10(1) of the Act. Designation is by notification, not by self-assessment against a threshold. The factors include the volume and sensitivity of personal data, risk to Data Principals' rights, the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order.
Section 10(2) of the Act separately requires a Data Protection Officer based in India and an independent data auditor. Rule 13 adds four obligations, and its twelve-month cycle runs from the date of notification rather than a financial year end, so each entity carries its own recurring date.
| Rule | Additional obligation on a Significant Data Fiduciary |
|---|---|
| 13(1) | A Data Protection Impact Assessment, or DPIA, and an audit, once every twelve months from the date of notification as an SDF |
| 13(2) | The person carrying out the DPIA and audit must furnish a report of significant observations to the Data Protection Board |
| 13(3) | Algorithmic due diligence: verify that technical measures including algorithmic software used for hosting, display, upload, modification, publishing, transmission, storage, updating or sharing are not likely to pose a risk to the rights of Data Principals |
| 13(4) | A conditional restriction on transferring specified personal data, and the traffic data pertaining to its flow, outside the territory of India |
Does Rule 13(4) require personal data to stay in India?
Not yet, and not generally. Rule 13(4) restricts transfer of personal data "specified by the Central Government on the recommendations of a committee" of Ministry of Electronics and Information Technology officials, defined in Rule 13(5). Until a category is specified, nothing is localised by this rule.
Rule 15 is the general transfer provision. It makes a transfer outside India subject to requirements the Central Government may specify by general or special order for making personal data available to a foreign State or its agencies. Neither rule is a blanket localisation mandate, and where the question also turns on sector rules, advisory support helps.
Common Mistakes to Avoid
- Stating 13 May 2027 as the date the substantive obligations begin. Rule 1(4) runs eighteen months from publication. The notification is dated 13 November 2025 while the gazette stamp and the Press Information Bureau both put publication at 14 November 2025, so write the offset.
- Describing the breach duty as "72 hours to the Board". Rule 7(2)(a) requires a first intimation without delay, and the Rule 7(2)(b) report is extendable on a written request. The shorthand omits one duty and overstates the other.
- Reading Rule 13(4) as a localisation mandate on an SDF. It reaches only personal data specified by the Central Government on the Rule 13(5) committee's recommendation. No category has been specified.
- Attributing the four-member Data Protection Board to the Rules. Section 19(1) of the Act leaves the number to notification, and four was fixed by G.S.R. 845(E) of 13 November 2025.
- Quoting Rule 1(3) or Rule 1(4) from the November text. Both were corrected by G.S.R. 892(E) of 10 December 2025, which replaced "of this Gazette" with "in the Official Gazette". Rule 1(1) also gives the short title without "(DPDP)".
Legal Disclaimer
This article is general information on the Digital Personal Data Protection Rules, 2025 and the parent Act, and it is not legal advice. Verify the current text of each rule against the Official Gazette, and obtain professional advice before acting.
To see how a statutory obligation register handles a three-tranche commencement, talk to our team.
