Digital Personal Data Protection Rules, 2025
India · Regulation · Ministry of Electronics and Information Technology, Government of India
High impact. A reviewer confirms each change before it is listed here.
Our summary
These regulations operationalize the Digital Personal Data Protection Act, 2023 by establishing practical rules for protecting personal data in India's digital environment. They define the rights of individuals including consent, access, correction and erasure of data, while imposing responsibilities on organizations to handle data securely and transparently. The framework includes a phased eighteen-month compliance period, mandatory breach notification protocols, and establishes a digital Data Protection Board to enforce protections.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
4 sections
Jump to a chapter
Regulatory framework overview
The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 to operationalise the Digital Personal Data Protection Act, 2023 and create a framework balancing individual privacy rights with lawful data processing. The government received 6,915 inputs from startups, businesses, civil society and citizens during nationwide consultations that shaped the final Rules. Key defined terms include Data Fiduciary (entity deciding why and how data is processed), Data Principal (the individual to whom data relates, including parents for children and guardians for persons with disabilities), Data Processor (entity processing data on behalf of a Data Fiduciary), and Consent Manager (platform enabling individuals to give, manage and withdraw consent).
Core principles and enforcement
The framework operates on seven foundational pillars: obtaining and managing agreement transparently, limiting use to specified purposes, collecting only necessary data, ensuring accuracy, restricting retention periods, implementing protective measures, and assigning responsibility for processing actions. The Data Protection Board of India functions as the independent regulator overseeing adherence, investigating incidents of data compromise, and enforcing corrective actions. Financial penalties for Data Fiduciaries include up to 250 crore rupees for inadequate security, up to 200 crore rupees each for failing to report breaches or breaching children's protections, and up to 50 crore rupees for other violations.
Key implementation provisions
The Rules establish an eighteen-month period for phased compliance, requiring every Data Fiduciary to issue clear, separate consent notices explaining the specific purpose of collection. Consent Managers must be India-based companies. Data Fiduciaries must notify affected individuals without delay in plain language following a personal data breach, explaining the impact and remedial steps.
Rights of data principals
Individuals have the right to give or refuse consent (withdrawable at any time), know how their data is collected and used, access their personal data, correct inaccurate or incomplete information, update changed details, request erasure in certain situations, nominate another person to exercise rights on their behalf, receive breach notification at the earliest, and access clear contact information for queries. Data Fiduciaries must respond to all such requests within ninety days. Children require verifiable parental or guardian consent unless processing relates to healthcare, education or real-time safety.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.