The Central Government finalised and notified the Digital Personal Data Protection Rules, 2025 after reviewing public comments on the earlier draft published on February 3, 2025

The notification brings the DPDP Rules, 2025 into force in a phased manner. It activates the commencement structure under Rule 1, introduces operative definitions in Rule 2, and sets standards for notices under Rule 3.

Rule 4 establishes the complete framework for consent-manager registration and responsibilities.

Rules 5 to 9 lay out requirements for State-related processing, minimum security safeguards, breach-notification obligations, retention and deletion timelines, and publication of contact details for grievances.

Rules 10 to 12 specify how personal data of children and persons with disabilities must be processed, including verification of parental or guardian consent. Rule 13 introduces obligations for significant data fiduciaries, such as DPIAs, audits, and oversight of technical systems.

Rule 14 requires facilitation of data-principal rights, while Rule 15 governs cross-border personal-data transfers, and Rule 16 provides exemptions for research, archival, and statistical purposes.

Rules 17 to 21 establish the structure, appointment process, functioning, and staffing norms of the Data Protection Board.

Finally, Rule 22 sets the digital appeal mechanism, and Rule 23 enables the Government to seek information from data fiduciaries or intermediaries for purposes specified in the Schedule.