The DPDP Rules, 2025: What Organisations Must Do

The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), notified on 13 November 2025) tell organisations how to carry out the duties in the Digital Personal Data Protection Act, 2023. In short, an organisation that handles your personal data must give you a clear notice, take valid consent, keep the data secure, report breaches to you and to the Data Protection Board, erase data it no longer needs and answer your requests within 90 days. Most of these duties apply from 13 May 2027, after an 18 month transition period.

This explainer is for B.A. LL.B. and LL.B. students preparing for cyber law or constitutional law papers, and for any citizen who wants to know what a bank, school, hospital or app now owes them. If you run a small business, a tuition centre in Nagercoil for example, it also shows what you will need to change.

Where do the Rules come from?

The parent law is the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). The Act sets the duties; Section 40 allows the Central Government to make Rules filling in the details. The Rules were made by the Ministry of Electronics and Information Technology (MeitY) after a draft was published on 3 January 2025 for public comment.

The constitutional foundation is Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017, where a nine judge bench unanimously held that privacy is a fundamental right protected by Article 21 and Part III of the Constitution. A data protection statute is the legislative follow up to that recognition.

The Act is a law of Parliament and the Rules are central Rules. There are no separate Tamil Nadu rules, so the same Act and Rules apply to a firm in Chennai and a clinic in Kanyakumari District.

When does each part come into force?

Rule 1 sets a phased start:

• 13 November 2025: Rules 1, 2 and 17 to 21, which deal with the Data Protection Board.
• 13 November 2026 (one year): Rule 4, on registration and duties of Consent Managers.
• 13 May 2027 (eighteen months): Rules 3, 5 to 16, 22 and 23, which carry most of the obligations of organisations.

These dates run from the date of publication in the Gazette. The Government can amend the Rules by a fresh notification, so check the Gazette and the MeitY website before relying on the May 2027 date.

What must every organisation (Data Fiduciary) do?

The Act calls the organisation that decides why and how data is processed a "Data Fiduciary". Read the Act and Rules together:

1. Give a standalone notice (Section 5, Rule 3). The notice must make sense on its own, in clear and plain language, list the personal data being collected and the specific purpose, and explain how to withdraw consent, exercise rights and complain to the Board. Withdrawal must be as easy as giving consent.
2. Take valid consent or rely on a legitimate use (Sections 4, 6 and 7). Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. Section 7 lists the limited cases where data can be processed without consent, such as data the person has voluntarily provided for a specified purpose, or compliance with a court order.
3. Keep reasonable security safeguards (Section 8(5), Rule 6). The minimum list includes encryption, masking or tokenisation, access controls, logs and monitoring, backups, and contract terms with data processors. Logs and related personal data are to be kept for one year unless another law says otherwise.
4. Report breaches (Section 8(6), Rule 7). Each affected person must be told without delay, in plain language: what happened, likely consequences, what the organisation has done and whom to contact. The Board must also be told without delay, followed by a detailed report within 72 hours covering the cause and remedial steps.
5. Erase data when the purpose is over (Section 8(7), Rule 8). For large e-commerce platforms, online gaming intermediaries and social media intermediaries listed in the Third Schedule, the period is three years from the later of the user's last contact or the date the Rules commenced, and the user must get at least 48 hours' notice before erasure.
6. Publish a contact person (Section 8(9), Rule 9) and run a grievance mechanism (Section 8(10)).
7. Answer grievances and rights requests within 90 days (Rule 14). Rule 14 sets a maximum of ninety days for grievance redressal, and the Government's summary of the Rules applies the same limit to requests to access, correct, update or erase data.

Picture a private hospital in Madurai whose patient database is hacked. Under the new regime it must message each affected patient, inform the Board, and file the detailed follow up report within 72 hours. Silence is no longer an option.

What extra rules apply to children and Significant Data Fiduciaries?

A "child" is anyone below 18 (Section 2(f)). Section 9 requires verifiable consent of a parent or lawful guardian, and bars tracking, behavioural monitoring and targeted advertising aimed at children, subject to exemptions. Rule 10 says the organisation must check that the person giving consent is an identifiable adult, using details it already holds or a virtual token, for example one issued through a digital locker provider. Rule 12 and the Fourth Schedule exempt certain classes and purposes, such as clinical establishments, educational institutions and real time location tracking for a child's safety.

The Government may notify large or high risk organisations as Significant Data Fiduciaries (Section 10). They must appoint a Data Protection Officer based in India and an independent data auditor. Under Rule 13 they must conduct a Data Protection Impact Assessment and an audit every twelve months and report significant findings to the Board.

What are your rights, and what happens if rules are broken?

Sections 11 to 14 give you the right to access a summary of your data, to correct and erase it, to grievance redressal and to nominate someone to act for you on death or incapacity. Section 15 also imposes duties on you: no false or frivolous complaints, no impersonation. A breach of these duties can attract a penalty of up to Rs 10,000.

For organisations the Schedule to the Act fixes maximum penalties: up to Rs 250 crore for failing to keep security safeguards, up to Rs 200 crore each for failing to report a breach and for breaching children's obligations, up to Rs 150 crore for Significant Data Fiduciary obligations, and up to Rs 50 crore for other breaches. These are monetary penalties imposed by the Board under Section 33. You must first use the organisation's grievance mechanism before going to the Board (Section 13(3)). Appeals against the Board lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days (Section 29).

If the breach involves online fraud or identity theft, the criminal law still applies separately: report it on the National Cyber Crime Reporting Portal. The Bharatiya Nyaya Sanhita, 2023 now replaces the IPC for offences such as cheating.

What is the current challenge in the Supreme Court?

Section 44(3) of the Act amended Section 8(1)(j) of the Right to Information Act, 2005, so that it now simply exempts "information which relates to personal information". Petitioners argue this removes the earlier public interest override. On 16 February 2026 a bench of Chief Justice Surya Kant, Justice Joymalya Bagchi and Justice Vipul M. Pancholi issued notice, refused to stay the Act and referred the challenge to a larger bench. Cases include Venkatesh Nayak v. Union of India (W.P.(C) No. 177/2026) and National Campaign for People's Right to Information v. Union of India (W.P.(C) No. 212/2026). Until the larger bench decides, the law stands as enacted.

How should you write about this in an exam?

• Open with Puttaswamy (2017) and Article 21 as the source of the right.
• Name the Act and the Rules with notification dates, then explain the Fiduciary and Principal relationship.
• Pair each duty with its section and rule: notice (Section 5, Rule 3), security (Section 8(5), Rule 6), breach (Section 8(6), Rule 7).
• Mention the phased commencement and the penalty Schedule.
• For a critical answer, discuss the RTI amendment and the pending reference.

Students who want practical exposure can see how privacy complaints come in through the college legal aid clinic.

Sources

• Digital Personal Data Protection Rules, 2025 (Gazette, G.S.R. 846(E)): official text of the Rules.
• Digital Personal Data Protection Act, 2023: official text of the Act on the MeitY website.
• PIB press release, 14 November 2025: Government summary of the Rules.
• Supreme Court Observer: Fundamental Right to Privacy: case page on Puttaswamy (2017).
• LiveLaw report, 16 February 2026: reference of the RTI amendment challenge to a larger bench.