+91 85277 09690Enrol

Digital Personal Data Protection Rules, 2025

The Rules fill in the detail the Act left to the Government: what a notice must say, what counts as reasonable security, how a breach is reported, how long data is kept and how the Board works. They come into force in three stages over eighteen months.

RulesMinistry of Electronics and Information Technology2025Phased commencementReviewed 2 November 2026
Digital Personal Data Protection Rules, 2025, DFRTI

The Digital Personal Data Protection Rules, 2025 were made by the Ministry of Electronics and Information Technology under sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023. The notification is G.S.R. 846(E), dated 13 November 2025, published in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), on 14 November 2025. The draft had been published for comment on 3 January 2025 as G.S.R. 02(E); the Press Information Bureau reports that 6,915 inputs were received before the final text was settled.

The Rules run to 23 rules and seven Schedules. Most of the length is procedure for the Data Protection Board of India and its officers. The parts a working organisation will read are short: Rule 3 on notices, Rule 6 on security safeguards, Rule 7 on breach intimation, Rule 8 on retention and erasure, Rules 10 to 12 on children and Rule 14 on how rights are exercised.

Rules are subordinate legislation. They can only fill in what the Act delegates and they take their force from it. Where this page says a rule requires something, that requirement starts on the day the rule commences, not before.

Three Stages of Commencement

Rule 1 sets the timetable. The periods run from the date of publication of the Gazette, which the Gazette identifier and the PIB release give as 14 November 2025. The Act's own commencement notification, G.S.R. 843(E), follows the same three stages so that each rule starts together with the section it serves.

  1. 01
    On Publication: Rules 1, 2 and 17 to 21

    The short title, the definitions and the rules that set up the Data Protection Board of India: appointment of the Chairperson and Members through search-cum-selection committees (Rule 17), their pay and conditions (Rule 18 and the Fifth Schedule), meeting procedure, a quorum of one-third and a six-month limit on inquiries extendable three months at a time (Rule 19), the Board as a digital office (Rule 20) and its officers and staff (Rule 21 and the Sixth Schedule).

  2. 02
    One Year After Publication: Rule 4

    Registration and obligations of Consent Managers. Part A of the First Schedule requires an applicant to be a company incorporated in India with a net worth of not less than two crore rupees, sound finances and management and independent certification of its platform. Part B sets the platform duties, including a record of every consent given and withdrawn and a bar on sub-contracting.

  3. 03
    Eighteen Months After Publication: Rules 3, 5 to 16, 22 and 23

    Notice to the Data Principal (Rule 3), processing by the State for subsidies and services (Rule 5), reasonable security safeguards (Rule 6), intimation of personal data breach (Rule 7), erasure timelines and log retention (Rule 8), published contact information (Rule 9), verifiable consent for children and for persons with disability (Rules 10 to 12 and the Fourth Schedule), additional duties of Significant Data Fiduciaries (Rule 13), the exercise of rights (Rule 14), transfer outside India (Rule 15), the research exemption (Rule 16 and the Second Schedule), digital appeals to the Appellate Tribunal (Rule 22) and the Government's power to call for information (Rule 23 and the Seventh Schedule).

The Rules an Organisation Will Feel

Paraphrased from the Gazette text. Rule numbers are given so that readers can check the original.

  • Rule 3, Notice

    A consent notice must stand on its own, give an itemised description of the personal data and the specific purpose, describe the goods or services involved and tell the individual how to withdraw consent, exercise rights and complain to the Board, with a link to the website or app.

  • Rule 6, Security Safeguards

    At the minimum: encryption, obfuscation, masking or tokens; access control on computer resources; logs, monitoring and review that let unauthorised access be detected, investigated and remedied; backups for continuity; retention of those logs and the personal data for one year unless another law says otherwise; safeguard clauses in Data Processor contracts; and technical and organisational measures to make it all work.

  • Rule 7, Breach Intimation

    On becoming aware of a breach the Data Fiduciary tells each affected person without delay, in plain language, what happened, what it may mean, what is being done, what she can do and whom to contact. The Board gets an immediate description and, within seventy-two hours or a longer period it allows on written request, the detailed facts, causes, mitigation, findings on who caused it, remedial steps and a report on the intimations sent.

  • Rule 8, Retention and Erasure

    Classes of Data Fiduciary listed in the Third Schedule must erase personal data after the scheduled period of inactivity, with forty-eight hours' warning to the individual. Separately, every Data Fiduciary must keep personal data, associated traffic data and processing logs for at least one year from the processing for the purposes in the Seventh Schedule, then erase them unless another law requires longer retention.

  • Rules 9 and 14, Contact and Rights

    The business contact of the Data Protection Officer or another person who can answer questions must be published prominently and quoted in every reply. The means of making a rights request must be published, and the grievance system must respond within a period not exceeding ninety days.

  • Rule 13, Significant Data Fiduciaries

    A Data Protection Impact Assessment and an audit once every twelve months with a report of significant observations to the Board, due diligence on algorithmic software and a bar on transferring personal data and traffic data that a Government committee specifies outside India.

Terms the Rules Add

C
Computer Resource and Intermediary
Both carry the meaning given in the Information Technology Act, 2000. Rule 6 uses the first for access control and Rule 23 uses the second for the Government's power to call for information.
D
Data Protection Impact Assessment
The periodic process a Significant Data Fiduciary must run under section 10 of the Act, describing the rights of Data Principals, the purposes of processing and the assessment and management of risk to those rights.
T
Techno-Legal Measures
The means by which the Board and the Appellate Tribunal conduct proceedings as digital offices without requiring anyone's physical presence, under Rules 20 and 22.
U
User Account
The online account the Data Principal registered with the Data Fiduciary, including profiles, handles, email address and mobile number through which she reaches the service. Breach intimations under Rule 7 go to this account or another registered mode.
V
Verifiable Consent
Consent obtained under Rule 10 or Rule 11. For a child, the Data Fiduciary must check that the person claiming to be the parent is an identifiable adult, using identity and age details it already holds, details the individual provides or a virtual token issued by an authorised entity such as a Digital Locker service provider.

What a Forensic Laboratory Should Prepare

The Rule 6 safeguards describe things a well-run laboratory already does under ISO/IEC 27037:2012 and its chain-of-custody procedure: controlled access to the evidence store, a log of who opened which case image and when, encrypted storage of images, written contracts with any cloud or processing vendor. The eighteen-month window is the time to write these down as a policy, name an owner and test the breach procedure once with a tabletop exercise.

Rule 8(3) deserves a careful read. Its one-year minimum retention of personal data and logs sits alongside legal hold on live matters and alongside the Act's duty to erase once the purpose is served. A laboratory needs one retention schedule that reconciles the three. Case evidence is held until the matter and any appeal end. Working copies and exports are erased on closure with a documented method and a certificate. Access logs are kept for at least the Rule 6(e) year.

Rule 7 is where most organisations will be caught out, because seventy-two hours is short and the detailed report asks for facts, causes and findings about who did it. That is an incident response and forensic readiness problem, not a legal drafting problem. Logs that were never enabled cannot be analysed in time.

  • Map where personal data sits: evidence images, extractions, case notes, client records, student files
  • Check that evidence-store access logs would show who read a case image and when
  • Write the breach procedure with the seventy-two hour report to the Board in mind
  • Put Rule 6 safeguard clauses into vendor and Data Processor contracts
  • Sanitise case media at closure with a documented method and keep the certificate

What the Rules Do Not Do, and Common Misunderstandings

  • The Rules do not prescribe a technical standard for encryption, logging or erasure. Rule 6 names kinds of measures, not products or settings. A guideline such as NIST SP 800-88 Rev. 2 can help an organisation choose a method, but following it is not compliance in itself.
  • They do not require every organisation to keep data in India. Rule 15 leaves transfer open subject to Government orders, and the localisation restriction in Rule 13(4) applies only to Significant Data Fiduciaries and only to data a committee specifies.
  • They did not all take effect on 14 November 2025. Only the title, the definitions and the Board rules did. Any vendor claiming that breach reporting is already mandatory under these Rules is ahead of the Gazette.
  • They do not change the criminal procedure for seizing or examining devices, and they do not give a laboratory any new authority to access data.
  • The seventy-two hours in Rule 7 is for the detailed report to the Board. The first description to the Board and the message to affected individuals are both due without delay.

Common Questions

From which date do the eighteen months run?

From the date of publication of the Gazette. The notification is dated 13 November 2025 and the Gazette issue carries the identifier of 14 November 2025, which is also the date in the PIB release. Anyone counting to the day should take the date from the notification on egazette.gov.in rather than from a summary.

Do the Rules apply to a laboratory's evidence images?

The Rules apply wherever the Act applies, so the answer depends on the section 17 exemptions discussed on the Act page. Rule 6 safeguards are the sensible baseline whatever the answer, because section 8(5) of the Act stays in force even inside the investigation exemption.

What must the breach notice to an individual contain?

Rule 7(1) lists five things: a description of the breach with its nature, extent and timing; the consequences likely to arise for her; the measures taken or being taken to mitigate risk; the safety measures she can take; and the business contact of a person who can answer her questions.

Is there a fee or form for complaints to the Board?

The Rules make the Board a digital office under Rule 20 and PIB describes a portal and app for filing and tracking complaints. Rule 22 requires appeals to the Appellate Tribunal to be filed digitally with a fee equal to that under the Telecom Regulatory Authority of India Act, 1997, which the Chairperson may reduce or waive.

Official sources

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Disciplines where this applies

Courses that teach it

Go deeper with DFRTI

Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.

Explore the AcademyAbout membershipTalk to a counsellor