What the Digital Personal Data Protection Rules, 2025 ask of a business

Parliament passed the Digital Personal Data Protection Act in August 2023, but the Act could not operate until the Government made rules under it. The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 in November 2025. The Act and the Rules together now set the timetable.

A phased start

The law comes into force in three stages, counted from the date the Rules were notified.

• On notification: the provisions that set up the Data Protection Board of India.
• One year later: the system for registering Consent Managers, the intermediaries through which a person can manage consents given to different businesses.
• Eighteen months later: the main duties on businesses, covering notice, consent, security, breach reporting, retention and the rights of individuals.

For most businesses the third date is the one that matters.

Who the law applies to

The Act calls the person who decides why and how personal data is processed a Data Fiduciary, and anyone who processes it on that person’s behalf a Data Processor. It covers personal data in digital form that is processed in India. It also covers processing outside India when that is done to offer goods or services to people in India.

A business remains responsible for what its processors do with the data. Outsourcing the work does not outsource the duty.

What a business will have to do

• Give a clear notice. It must say what personal data is collected and for what purpose, and how a person can withdraw consent, exercise their rights and complain to the Board. The Rules require the notice to be in plain language and to make sense on its own.
• Obtain valid consent. Consent must be free, specific, informed, unconditional and unambiguous, unless the Act permits the processing without it as one of a limited set of “legitimate uses”. Withdrawing consent must be as easy as giving it.
• Keep the data secure. The Act requires reasonable security safeguards. The Rules list minimum measures, including encryption or similar protection, access controls, logs and backups.
• Report breaches. When a personal data breach happens, the business must tell both the people affected and the Board, within the periods the Rules set.
• Erase data that is no longer needed. Once the purpose has been served, the data must go, unless another law requires it to be kept.
• Publish a point of contact. People must be able to reach someone who can answer questions about how their data is used, and there must be a way to raise a grievance.
• Take extra care with children’s data. A child is anyone under eighteen. Processing a child’s personal data needs the verifiable consent of a parent, and tracking, behavioural monitoring and advertising targeted at children are restricted, subject to exemptions in the Rules.

Significant Data Fiduciaries

The Government may designate some businesses as Significant Data Fiduciaries, having regard to matters such as the volume and sensitivity of the data they handle. They carry further duties: a Data Protection Officer based in India, an independent data auditor, and periodic audits and data protection impact assessments.

Penalties

The Board can impose monetary penalties. The Schedule to the Act sets a maximum for each kind of breach. The highest, for failing to take reasonable security safeguards to prevent a personal data breach, is up to ₹250 crore.

What to do in the meantime

• Find out what personal data the business holds, where it came from and why it is kept.
• Read the privacy notices and consent requests the business uses today against what the Act and Rules require.
• Review contracts with vendors who process personal data, and add the terms the business will need to meet its own duties.
• Write down what happens when a breach is discovered, and who decides what.
• Decide who inside the business is responsible for all of this.

Most of this work is organisational, not technical, and it is easier to do before the duties begin than after.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts