/The Rules
The Digital Personal Data Protection Rules, 2025
G.S.R. 846(E), notified by the Ministry of Electronics and Information Technology on 13 November 2025 under section 40 of the Act.
Opening words
G.S.R. 846(E).––– Whereas draft of the Digital Personal Data Protection Rules, 2025 were published, as required under sub-section (1) of section 40 of the of the Digital Personal Data Protection Act, 2023 (22 of 2023), vide notification of the Government of India in the Ministry of Electronics and Information Technology vide number G.S.R. 02 (E), dated the 3rd January, 2025, in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), dated the 3rd January, 2025, inviting objections and suggestions from all persons likely to be affected thereby, before the expiry of the period of forty-five days from the date on which copies of the Official Gazette containing the said notification were made available to public; And whereas copies of the said Official Gazette were made available to the public on the 3rd January, 2025; And whereas objections and suggestions were received from the public in respect of the said draft rules have been considered by the Central Government; Now, therefore in exercise of powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), the Central Government hereby makes the following rules, namely: —
The rules
- r. 1Short title and commencementUnder s. 40In force
- r. 2DefinitionsUnder s. 40In force
- r. 3Notice given by Data Fiduciary to Data PrincipalUnder s. 5Upcoming
- r. 4Registration and obligations of Consent ManagerUnder s. 6Upcoming
- r. 5Processing of personal data for provision or issue of subsidy, benefit, service, certificate, licence or permit by State and its instrumentalitiesUnder s. 7Upcoming
- r. 6Reasonable security safeguardsUnder s. 8Upcoming
- r. 7Intimation of personal data breachUnder s. 8Upcoming
- r. 8Time period for specified purpose to be deemed as no longer being servedUnder s. 8Upcoming
- r. 9Contact information of person to answer questions about processingUnder s. 8Upcoming
- r. 10Verifiable consent for processing of personal data of childUnder s. 9Upcoming
- r. 11Verifiable consent for processing of personal data of person with disability who has lawful guardianUnder s. 9Upcoming
- r. 12Exemptions from certain obligations applicable to processing of personal data of childUnder s. 9Upcoming
- r. 13Additional obligations of Significant Data FiduciaryUnder s. 10Upcoming
- r. 14Rights of Data PrincipalsUnder s. 11, s. 12, s. 13, s. 14Upcoming
- r. 15Transfer of personal data outside the territory of IndiaUnder s. 16Upcoming
- r. 16Exemption from Act for research, archiving or statistical purposesUnder s. 17Upcoming
- r. 17Appointment of Chairperson and other MembersUnder s. 19In force
- r. 18Salary, allowances and other terms and conditions of service of Chairperson and other MembersUnder s. 20In force
- r. 19Procedure for meetings of Board and authentication of its orders, directions and instrumentsUnder s. 23In force
- r. 20Functioning of Board as digital officeUnder s. 28In force
- r. 21Terms and conditions of appointment and service of officers and employees of BoardUnder s. 24In force
- r. 22Appeal to Appellate TribunalUnder s. 29Upcoming
- r. 23Calling for information from Data Fiduciary or intermediaryUnder s. 36Upcoming
The schedules
- IConsent Managers: conditions of registration and obligations[See rule 4]
- IIStandards for processing of personal data by State and its instrumentalities under clause (b) of section 7 and for processing of personal data necessary for the purposes specified in clause (b) of sub-section (2) of section 17[See rules 5(1) and 16]
- IIITime periods after which specified Data Fiduciaries must erase personal data[See rule 8(1)]
- IVExemptions from section 9(1) and 9(3) for processing children's data[See rule 12]
- VTerms and conditions of service of Chairperson and other Members[See rule 18]
- VITerms and conditions of appointment and service of officers and employees of Board[See rule 21(2)]
- VIIPurposes for which the State may call for information, and authorised persons[See rule 23(1) and 8(3)]