Centre Notifies Digital Personal Data Protection Rules, 2025, Data Protection Board Established [Read Notification]

The Ministry of Electronics and Information Technology has notified the Digital Personal Data Protection Rules, 2025 under the Digital Personal Data Protection Act, 2023, marking a significant step in India’s data privacy regime. The notification, published in the Gazette of India on November 13, 2025, follows the draft rules issued earlier in January 2025 and incorporates public feedback received during the consultation period.

The rules provide a comprehensive framework for data fiduciaries, consent managers, and state authorities in handling personal data, while also establishing the Data Protection Board of India to oversee compliance and enforcement.

Key Highlights

1. Phased Implementation:

● Rules 1, 2, and 17-21 are effective immediately.

● Rule 4 (consent manager registration) will take effect one year later.

● Rules 3, 5-16, 22, and 23 will come into force eighteen months after publication.

2. Notice Obligations: Data fiduciaries must issue clear, independent, and easily understandable notices to data principals, detailing categories of personal data processed, purposes, and means to withdraw consent or lodge complaints.

3. Consent Managers: Entities meeting prescribed conditions can apply for registration. They will manage verifiable consent and face suspension or cancellation for non-compliance.

4. Processing by State Authorities: Personal data used for subsidies, benefits, services, certificates, licenses, or permits must comply with standards in the Second Schedule, ensuring lawful and policy-driven use of public funds.

Know the complete aspects of tax implications of succession, Click here

5. Security Measures: Fiduciaries must adopt safeguards such as encryption, masking, controlled access, logging, and backup mechanisms. Contracts with processors must include security obligations.

6. Breach Notification: Fiduciaries must notify affected individuals promptly in case of a personal data breach, outlining the nature, scope, consequences, and remedial measures. They must also inform the Data Protection Board within 72 hours, providing detailed reports on causes, impacts, and corrective actions.

7. Data Retention & Deletion: Personal data must be deleted once the specified purpose is fulfilled, unless retention is required by law. Fiduciaries must notify principals 48 hours before deletion. Logs and traffic data must be retained for at least one year before erasure.

Through a parallel notification, the government has established the Data Protection Board of India under Section 18 of the Act. The Board will adjudicate complaints, direct remedial measures, and ensure compliance. Its headquarters will be located in the National Capital Region.

Phased Enforcement of the Act

Another notification specifies staggered enforcement of the Act’s provisions:

● Sections 1(2), 2, 18–26, 35, 38–43, and 44(1) & (3) are effective immediately.

● Section 6(9) and Section 27(1)(d) will be enforced one year later.

● Sections 3–5, 6(1)–(8) & (10), 7–17, 27 (except clause d), 28–34, 36–37, and 44(2) will come into force eighteen months after publication.