The DPDP Rules are the Digital Personal Data Protection Rules, 2025, the regulations that put India’s Digital Personal Data Protection Act, 2023 into practice. The Ministry of Electronics and Information Technology (MeitY) notified them on 13 November 2025 as G.S.R. 846(E), and the government’s PIB release of 14 November 2025 describes an 18-month phased compliance timeline. The Act sets out the rights and duties; the Rules fill in how a consent notice must read, how fast a breach must be reported and how long data may be kept.

This explainer covers what the Rules require, when each part starts and what they mean for an ordinary user of apps and websites in India.

When the DPDP Rules take effect

Rule 1 of the notified Rules brings them in over three stages, counted from publication in the Gazette on 13 November 2025.

Stage Rules Starts What it covers
1 Rules 1, 2 and 17 to 21 On publication, 13 November 2025 Definitions and the Data Protection Board of India
2 Rule 4 One year after publication Registration and duties of Consent Managers
3 Rules 3, 5 to 16, 22 and 23 Eighteen months after publication Notices, security, breach reporting, retention, children’s data, rights, Significant Data Fiduciaries, appeals

Source: Digital Personal Data Protection Rules, 2025, rule 1.

So most duties that touch users directly, such as consent notices, breach alerts and erasure, apply from the third stage, around May 2027. A MeitY answer in the Lok Sabha on 12 August 2026 confirmed the same three phases.

Under rule 3, the notice a company (a “Data Fiduciary” in the Act) gives before asking for consent must stand on its own, apart from any other terms. In clear and plain language it must give an itemised description of the personal data collected and the specified purpose, along with the goods, services or uses that processing enables.

The notice must also give a link and other means by which you can withdraw consent, use your rights under the Act and complain to the Data Protection Board. Rule 3 adds that withdrawing consent must be as easy as giving it.

A Consent Manager is a registered platform through which you give, review and withdraw consent across many companies in one place. Under the First Schedule, an applicant must be a company incorporated in India with a net worth of at least ₹2 crore, and must meet tests of technical, operational and financial capacity. A Consent Manager must keep records of consents given, denied and withdrawn for at least seven years.

Registration with the Board under rule 4 is the one provision that starts one year after publication, ahead of the main duties. The August 2026 Lok Sabha answer lists it as Phase 2, “within one year”.

Security safeguards and breach reporting

Rule 6 sets the minimum security a company must keep for personal data, including when a contractor (a “Data Processor”) handles it. The list covers:

  • encryption, obfuscation, masking or virtual tokens;
  • access control over the computer systems used;
  • logs, monitoring and review to detect unauthorised access;
  • backups so that processing can continue after a compromise;
  • keeping those logs for a year;
  • security terms in contracts with processors.

Rule 7 sets two clocks once a company becomes aware of a personal data breach. It must tell each affected person without delay, through their account or registered contact. The alert must describe the breach and its likely consequences, the steps taken, the steps the person can take and a contact for questions. It must also tell the Board without delay, and send a detailed report within 72 hours, or a longer period the Board allows on a written request. That report covers the facts, the cause, any findings about who caused the breach and the remedial steps.

These clocks sit alongside existing ones. Many cyber incidents, data breaches among them, must already be reported to CERT-In within six hours, as our CERT-In incident reporting explainer sets out.

How long data may be kept

Rule 8 and the Third Schedule set an end date for data held by the largest platforms when a user goes quiet:

Class of company Size threshold in India Erase after
E-commerce entity At least 2 crore registered users Three years of inactivity
Online gaming intermediary At least 50 lakh registered users Three years of inactivity
Social media intermediary At least 2 crore registered users Three years of inactivity

Source: Digital Personal Data Protection Rules, 2025, Third Schedule. The three years run from the user’s last contact or exercise of rights, or from the Rules’ commencement, whichever is latest.

Data needed only to let you log in, or to use a stored balance or voucher on the platform, is left out of this limit. At least 48 hours before erasure, the company must warn you that the data will go unless you log in or otherwise get in touch.

Separately, rule 8(3) requires every company to keep the personal data, traffic data and logs of any processing for at least one year from that processing, for purposes set out in the Seventh Schedule, before erasing them. Other laws that require longer retention still apply.

Children and persons with disabilities

Under rule 10, a company must obtain verifiable consent from a parent before processing a child’s personal data, and check that the parent is an identifiable adult. It can rely on identity and age details it already holds, details the parent provides, or a virtual token from an authorised entity, which includes a token made available through a Digital Locker service provider.

Rule 11 applies a similar check to the lawful guardian of a person with a disability who cannot take legal decisions even with support. The Fourth Schedule lists limited exemptions from the child-consent rule, such as for healthcare, education and real-time safety.

Your rights and the 90-day limit

Rule 14 requires companies to publish on their website or app how you can ask to access, correct, update or erase your data, and what identifier, such as a username or customer ID, you need to give. You can also nominate one or more people to use these rights on your behalf.

Companies must publish, and keep to, a grievance response time of no more than 90 days. If a company does not resolve a complaint, the next step is the Data Protection Board.

Significant Data Fiduciaries and transfers abroad

The government can notify large or sensitive data handlers as Significant Data Fiduciaries. Under rule 13, each must carry out a Data Protection Impact Assessment and an audit every twelve months, and send the Board a report of significant observations. It must also check that its algorithmic software does not pose a risk to users’ rights, and keep within India any personal data that the government specifies on a committee’s recommendation.

For everyone else, rule 15 allows personal data to go abroad, subject to any requirements the government sets by order on making it available to a foreign State or entities it controls.

The Data Protection Board

The Board was set up on 13 November 2025 by notification G.S.R. 844(E), as a digital office. The PIB release says citizens will be able to file and track complaints online and through a mobile app, and that appeals against the Board’s decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Under rule 19, the Board must finish an inquiry within six months, extendable by up to three months at a time.

The Board’s members are still being chosen. On 6 May 2026, a MeitY circular invited applications for its Chairperson and Members, and the Lok Sabha answer said the advertisement for a Chairperson and four Members appeared in Employment News on 6 June 2026. That answer announced no appointment.

For how these duties apply when staff feed personal data into AI tools, see our explainer on the DPDP Act and AI at work.