DPDP Rules, 2025: what the notified Rules add

The Rules operationalise the Act. They were notified in November 2025 (not the earlier draft). They add practical detail in areas such as the content of notices, security safeguards, breach reporting and retention.

Areas the Rules detail

• Notice: itemised, in clear and plain language, understandable independently of other information, with how to withdraw consent, exercise rights and complain to the Board.
• Reasonable security safeguards: for example encryption, obfuscation or masking, access control, logging and monitoring to detect compromise, backups, and retention of relevant logs.
• Breach reporting: informing affected individuals without delay, and the Board without delay with a more detailed report within a prescribed period.
• Retention and erasure: erase when the purpose is served, with specified rules for certain large platforms and minimum log-retention periods.
• Contact point: publish business contact details for questions about processing.
• Children and persons with disabilities: how verifiable consent is obtained, and prescribed exemptions for certain classes (for example some healthcare and educational purposes).
• Significant Data Fiduciaries: periodic impact assessment and audit, and due diligence on algorithmic software.
• Consent Managers: registration conditions and obligations - a separate commencement stage.