Digital Personal Data Protection (DPDP Rules), 2025

Not yet. India’s Digital Personal Data Protection Act, 2023 is law, but many operational details depend on the Digital Personal Data Protection (DPDP) Rules, 2025, which were released as drafts for consultation by MeitY on 3 Jan 2025. MeitY formally extended the comment window; the status page on MeitY still lists the Rules as draft (check the Act & Policies page). In September 2025, the IT Minister publicly targeted late‑September for notification, but as of today you should treat the Rules as pending final notification and monitor the Official Gazette / MeitY for updates. Practically, legal and security teams should proceed with implementation aligned to the draft text to compress time‑to‑compliance when the final Rules land.

Under the draft Rules (Rule 7), when you become aware of a personal data breach, you must:

• Inform each affected Data Principal “without delay” in clear, plain language, covering what happened, likely consequences, mitigation steps, what the user should do, and a business contact able to answer questions.

• Notify the Data Protection Board without delay with a description, and within 72 hours provide an updated, detailed report (or request a longer period the Board may allow). That report must include facts and circumstances, mitigation, who caused the breach (if known), remedial measures, and a summary of the intimations sent to affected users.

Draft Rule 3 is explicit: the notice must stand alone (not buried in other copy), use clear, plain language, and at minimum include:

1. Itemised description of the personal data requested;

2. Specified purpose and an itemised description of the goods/services or uses enabled by processing;

3. A direct link to your website/app (or other means) where the individual can withdraw consent (as easily as they gave it), exercise rights, and file a complaint with the Board.

A Consent Manager is a Board‑registered entity through which Data Principals can give, manage, review, or withdraw consent in an interoperable way. Draft Rule 4 says applicants must meet Part A of the First Schedule conditions and submit required particulars; the Board may inquire before granting registration, publish registrant details on its site, and suspend or cancel registration if conditions aren’t met—after giving a hearing and recording reasons. Ongoing obligations are in Part B of the First Schedule. For product teams, this means building CMI hooks (discoverability, API integration, user verification, audit trails).

Yes—Draft Rule 6 (Reasonable Security Safeguards) lists concrete baselines:

• Data security measures including encryption, obfuscation/masking, or tokenisation for personal data.

• Access controls over computer resources of the Data Fiduciary and its processors.

• Visibility through logs, monitoring, and reviews to detect and investigate unauthorised access.

• Business continuity (backups) to maintain processing if confidentiality/integrity/availability are impacted.

• Contractual clauses to bind processors.

• Retention mandate: keep **logs and relevant personal data for one year to support detection, investigation, remediation, and continuity (unless another law requires otherwise).

The Act’s Schedule sets graded caps (per violation, subject to the Board’s assessment of factors in Section 33). Key maxima include:

• ₹250 crore for failing to implement reasonable security safeguards to prevent personal data breaches (s.8(5));

• ₹200 crore for failing to notify the Board or affected Data Principals of a breach (s.8(6));

• ₹200 crore for non‑compliance with children’s data obligations (s.9);

• ₹150 crore for failing SDF obligations (s.10);

• ₹50 crore for other breaches of the Act/Rules; and smaller caps for duties of Data Principals.

Under Section 10 of the Act, the Central Government may notify an organisation or class as SDF based on factors like the volume/sensitivity of data, risk to Data Principals, and potential impact on sovereignty, public order, electoral democracy, or State security. SDFs must:

• Appoint a DPO based in India reporting to the Board/CEO‑level governance;

• Engage an independent data auditor for periodic data audits;

• Conduct periodic DPIAs and other prescribed measures.

Yes, by default—Section 16 empowers the Central Government to restrict transfers to notified countries/territories. Until such a negative list is notified, cross‑border transfers are generally permitted, but sectoral rules or contracts may impose stricter localisation (e.g., payments, telecom, health). Maintain transfer registers, ensure contractual safeguards with processors/sub‑processors, and prepare to pivot if a country is later restricted.

Yes. Section 5(2) addresses pre‑commencement consents. A Data Fiduciary must, as soon as reasonably practicable, inform Data Principals about (i) the personal data processed, (ii) how to exercise their rights, and (iii) how to complain to the Board—in the prescribed manner. Processing may continue on the earlier consent unless the individual withdraws. Tactically, queue a batch notification via email, in‑app, or SMS, point users to your rights portal, and record proof of delivery to answer Board queries later.

The Act requires you to publish the business contact of your DPO (if applicable) or a responsible person—and include it in responses to rights requests and notices. The draft Rules reinforce user‑centric discoverability: publish the means to make rights requests (channels, identifiers) on your site/app, and—in notices—give a direct link to manage consent/rights and complain to the Board. Pair this with a self‑service rights portal, a ticketing queue, and CIEM‑backed access controls to avoid disclosure risk.