Notification of Digital Personal Data Protection Rules | Update

The Ministry of Electronics and Information Technology (“MeitY”) has officially notified the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), laying out the operational framework for India’s data protection regime under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Kindly note that the implementation timelines vary across different rules, with several provisions effective upon notification from today, while others will come into force over the next 12 to 18 months.

Certain administrative and procedural rules take effect immediately, while the core operational obligations are phased in over the next 12 and 18 months, as follows:

Effective immediately (13 November 2025): Rules 1–2 and 17–21, covering the short title and definitions, and the constitution, functioning and staffing of the Data Protection Board (including its digital office, meeting procedures, and timelines).

Effective in 12 months (13 November 2026): Rule 4 on registration and obligations of Consent Managers.

Effective in 18 months (13 May 2027): Rules 3, 5–16, 22 and 23, comprising the main operational obligations on notices, security, breach reporting, retention and erasure, children’s data, rights handling, cross-border transfers, Significant Data Fiduciary governance, appeals, and government information requests.