Standards update · Data protection and privacy

DPDP Rules, 2025 and Their Phased Commencement

The Digital Personal Data Protection Rules, 2025 were notified by MeitY in November 2025 under section 40 of the Digital Personal Data Protection Act, 2023. They come into force in three stages over eighteen months. This update sets out what we verified in the Gazette text, what each stage brings and what a forensic laboratory or training institute should start doing now.

By DFRTI editorial teamPublished 2 November 2026Reviewed 2 November 2026

This is an educational summary, not legal advice. We read the Rules as published on the Ministry of Electronics and Information Technology website and the Press Information Bureau backgrounder of 17 November 2025. The notification is G.S.R. 846(E), issued by MeitY under sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023). The notification carries the date 13 November 2025 and appears in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i). The PIB backgrounder describes the Rules as notified on 14 November 2025, and the electronic Gazette identifier on the document also carries that date.

Every commencement period in the Rules runs from the date of publication of the Gazette, so that one-day difference matters when you count twelve or eighteen months forward. We could not open the eGazette portal to settle it. Readers who need an exact date should check the notification on egazette.gov.in and go by what it says. The draft Rules, for reference, were published for comment on 3 January 2025 as G.S.R. 02(E), and PIB reports 6,915 inputs were received.

Three Stages of Commencement

Rule 1 sets the timetable. The rule numbers below are quoted from the notified text.

01
On publication: Rules 1, 2 and 17 to 21
The short title, definitions and the rules that set up the Data Protection Board of India, covering its members, their service conditions, meeting procedure, functioning as a digital office and its officers and staff. These were in force from the day of publication.
02
One year after publication: Rule 4
Registration and obligations of Consent Managers, the platforms through which an individual gives, reviews and withdraws consent. The First Schedule requires a Consent Manager to be a company incorporated in India, with a net worth of not less than two crore rupees among other conditions.
03
Eighteen months after publication: Rules 3, 5 to 16, 22 and 23
Everything an ordinary organisation will feel. Notice to the Data Principal (Rule 3), processing by the State for benefits and services (Rule 5), reasonable security safeguards (Rule 6), intimation of personal data breach (Rule 7), erasure timelines and log retention (Rule 8), published contact information (Rule 9), verifiable consent for children and persons with disability (Rules 10 to 12), additional duties of Significant Data Fiduciaries (Rule 13), exercise of rights (Rule 14), transfer outside India (Rule 15), the research and statistics exemption (Rule 16), appeals to the Appellate Tribunal (Rule 22) and the Government's power to call for information (Rule 23).

What the Rules Set Out in Substance

Rule 6 lists minimum security safeguards every Data Fiduciary must have: measures such as encryption, obfuscation, masking or tokenisation of personal data; access control over the computer resources used; logs, monitoring and review that give visibility of who accessed personal data so that unauthorised access can be detected, investigated and remedied; backups or similar measures for continuity; retention of those logs and the personal data for one year to support detection and investigation unless another law requires otherwise; contract terms that bind Data Processors to the same safeguards; and technical and organisational measures that make all of this work in practice.

Rule 7 says that on becoming aware of a personal data breach the Data Fiduciary must tell each affected individual without delay, in plain language, what happened, what it may mean for them, what is being done, what they can do and whom to contact. The Board must be told without delay with a description of the breach, and within seventy-two hours it must receive the detailed account: facts and causes, mitigation, any findings on who caused it, remedial steps and a report on the intimations sent to individuals. The Board may allow longer on a written request.

Rule 8 and the Third and Seventh Schedules deal with how long data may be kept. Certain classes of Data Fiduciary must erase personal data once the purpose is served and the scheduled period passes, with a forty-eight hour warning to the individual before erasure. Separately, every Data Fiduciary must keep personal data, traffic data and processing logs for at least one year from the date of processing for the purposes in the Seventh Schedule, then erase them unless another law requires longer retention. PIB summarises the rights provisions as requiring a response to access, correction and erasure requests within ninety days.

What a Forensic Laboratory Should Start Doing

A digital forensics laboratory is an unusual Data Fiduciary. Its evidence copies hold the personal data of suspects, victims, witnesses and bystanders who never dealt with the lab at all, and its client files hold the personal data of the people who hired it. The Act contains exemptions for processing in the interest of prevention, detection, investigation or prosecution of offences. How far those exemptions reach a private laboratory working for a corporate client, as against a police forensic unit, is exactly the kind of question to put to counsel rather than to assume.

Whatever the answer, the Rule 6 safeguards describe things a well-run lab already does under ISO/IEC 27037:2012 and its own chain-of-custody discipline: controlled access to the evidence store, a log of every access, encrypted storage of images, written contracts with any cloud or processing vendor. The eighteen-month window is the time to write these down as a policy, assign an owner and test the breach procedure once.

Map where personal data sits: evidence images, case notes, client records, student files
Reconcile Rule 8 retention and erasure with legal hold on live matters
Check that evidence-store access logs would show who read a case image and when
Write the breach procedure, including the seventy-two hour report to the Board
Put Rule 6 safeguard clauses into vendor and processor contracts
Sanitise case media at closure with a documented method and keep the certificate

What a Training Institute Should Start Doing

An institute holds student personal data of a plain kind, and often the personal data of children if it admits learners under eighteen.

Review admission and enquiry forms. The notice required by Rule 3 must state the specific purpose for which data is collected, in clear language, and must be a separate notice.
Decide how verifiable parental consent under Rule 10 will be obtained for any learner who is a child, and record it.
Publish the business contact details required by Rule 9 for questions about personal data on the website.
Set a retention schedule for student records, certificates issued, attendance logs and recorded sessions, and an erasure routine when it expires.
Audit third-party tools used in teaching, such as video platforms and learning management systems, as Data Processors under Rule 6(f).
Train staff. Rule 6(g) asks for organisational as well as technical measures, and the Act's penalties fall on the Data Fiduciary, not the vendor.

Common Questions

Is the DPDP Act, 2023 itself in force?

Parliament enacted the Act on 11 August 2023 and PIB states that the Rules give it full effect, with provisions operationalised in the same phased manner. The precise commencement of individual sections is notified by the Government. Check the latest MeitY notifications rather than relying on a summary, including this one.

Does following NIST SP 800-88 Rev. 2 or ISO/IEC 27001 make us compliant with the DPDP Rules?

No. Those are guidelines and standards; the Rules are law. A guideline can help you design the safeguards Rule 6 asks for and prove how you erased data under Rule 8, but compliance is a question of what you actually did and recorded, judged against the Rules.

Do evidence images count as personal data we process?

They contain digital personal data of identifiable people, so the question is whether an exemption applies to your processing of them. Treat them as personal data in your safeguards and retention planning and ask counsel about the exemption, not the other way around.

This is an standards update written by the DFRTI editorial team from the sources below. It is not a vendor announcement and DFRTI has not independently tested any product named in it unless the text says so.