The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025. This marks the full operationalisation of the Digital Personal Data Protection Act, 2023 (DPDP Act). Together, the Act and the Rules form a clear and citizen-centred framework for the responsible use of digital personal data. They place equal weight on individual rights and lawful data processing. With the notification of the Rules, India now has a practical, innovation-friendly data protection system. It supports ease of understanding, encourages compliance and strengthens trust in the country’s growing digital ecosystem.

The DPDP Rules lay out a comprehensive framework for implementing the provisions of the Digital Personal Data Protection Act, covering critical aspects of data governance. Key highlights include guidelines for notices by Data Fiduciaries to individuals, ensuring transparency in data collection and usage. They also specify registration requirements and the responsibilities of Consent Managers, which are crucial for managing user consents effectively. The Rules address the processing of personal data for delivering subsidies, benefits, and services by the State, emphasising lawful and secure data handling.

Furthermore, the rules also mandate the adoption of reasonable security safeguards, protocols for reporting personal data breaches, and clear processes for individuals to exercise their data rights. Special provisions are included for processing the personal data of children or persons with disabilities, ensuring their data is handled with extra care. The Rules outline the establishment of the Data Protection Board, detailing the appointment and service conditions of its Chairperson and members, as well as its functioning as a digital-first office. Additionally, they provide a structured procedure for filing appeals with the Appellate Tribunal, enabling streamlined redressal of disputes. This comprehensive approach ensures a robust framework for data protection, balancing individual rights with organisational responsibilities, while fostering trust in the digital ecosystem.

Understanding the Digital Personal Data Protection Act, 2023

Parliament enacted the Digital Personal Data Protection Act on 11 August 2023. The law creates a full framework for the protection of digital personal data in India. It explains what organisations must do when they collect or use such data. The Act follows the SARAL approach. This means it is Simple, Accessible, Rational and Actionable. The text uses plain language and clear illustrations so that people and businesses can understand the rules without difficulty.

The DPDP Act, passed in August 2023, sets out India’s framework for protecting digital personal data. It explains the duties of organisations handling such data and follows the SARAL (Simple, Accessible, Rational and Actionable) approach so that the rules remain simple, clear and easy to follow. The DPDP framework also aligns with the Right to Information (RTI) Act, 2005 by balancing privacy rights with the public’s right to information. Figure 1 briefly explains key terms under the DPDP Act, 2023.

Core principles

The law rests on seven core principles. These include consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. These principles guide every stage of data processing. They also ensure that personal data is used only for lawful and specific purposes.

Data Protection Board of India

The Act sets up the Data Protection Board as an independent body to oversee compliance, investigate breaches and ensure corrective steps. It helps protect individual rights and strengthens trust in India’s digital environment. It helps protect individual rights and strengthens trust in India’s digital environment.

The law rests on seven core principles. These include consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. These principles guide every stage of data processing. They also ensure that personal data is used only for lawful and specific purposes. A central feature of the Act is the creation of the Data Protection Board of India. The Board functions as an independent body that oversees compliance, inquires into breaches and ensures that corrective measures are taken. It plays a key role in enforcing the rights granted under the Act and maintaining trust in the system. Figure 2 demonstrates the penalty framework established by the DPDP Act, 2023.

The Act places clear responsibilities on Data Fiduciaries to keep personal data safe and to stay accountable for its use. It also gives Data Principals the right to know how their data is handled and the right to seek correction or removal when needed. Together, the Act and the Rules create a strong and balanced system. They strengthen privacy, build public trust and support responsible innovation. They also help India’s digital economy grow in a secure and globally competitive way.

To read more, please subscribe.