The DPDP Rules, 2025: notified, with a phased commencement

The Ministry of Electronics and Information Technology published draft Digital Personal Data Protection Rules on 3 January 2025 for public consultation. The final Rules, the Digital Personal Data Protection Rules, 2025, were notified in November 2025. They are the instrument that turns the Act’s obligations into procedure, and they must be read alongside it, never as a substitute for it.

Commencement in stages

The notification brings the Act and the Rules into force in phases. The provisions needed to constitute the Data Protection Board of India under Section 18 of the Act take effect first. The registration of consent managers follows after twelve months. The substantive obligations on data fiduciaries, including the form of notice, security safeguards, breach intimation, retention and erasure, and the additional obligations of Significant Data Fiduciaries, take effect eighteen months from notification. On that timetable, the general obligations of the Act become enforceable in the first half of 2027.

Two consequences follow. Until the relevant phase arrives, an obligation is not in force, and a claim that an organisation is already in breach of it is not correct. And the eighteen-month period is the implementation window the Act allows; the procedures, competencies and evidence an organisation will be examined on have to be built inside it.

What the Rules prescribe

The Rules set the contents of the notice a data fiduciary must give under Section 5 of the Act, in plain language and itemised so that the data principal can see what is collected and for which purpose. They set the conditions for registration of a consent manager under Section 6, including its obligations to the data principal and the technical and organisational measures it must maintain. They describe the reasonable security safeguards expected under Section 8(5), the manner and timing of breach intimation under Section 8(6), the periods after which personal data must be erased where the purpose is served, and the means of obtaining verifiable consent of a parent under Section 9.

They also set out the procedure of the Data Protection Board of India established under Section 18 of the Act, the manner in which the Central Government may call for information from a data fiduciary under Section 36, and the conditions under which personal data may be transferred outside India.

How the Forum reads them

The Forum’s frameworks are drafted against the Act and the Rules as notified, and each framework states which provision it carries. Where a Rule leaves a matter to the judgement of the data fiduciary, the framework records the interpretation the Forum has taken and the reason for it. That reading is the Forum’s own. It has no legal force, and it is published so that it can be examined and contested.

Back to the Bulletin, or read the standards.