Digital Personal Data Protection Rules, 2025 Notified, Establishing Operational Framework for Data Protection

The Central Government, through the Ministry of Electronics and Information Technology, issued the Digital Personal Data Protection Rules, 2025, on November 13, 2025. These Rules, published in the Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), were made under the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023). The issuance followed a public consultation process, where a draft of the Rules was published on January 3, 2025, inviting objections and suggestions from affected persons. Copies of the draft were made available to the public on the same date, and the Central Government considered the feedback received before finalizing the Rules. While Rules 1, 2, and 17 to 21 came into force upon their publication on November 13, 2025, Rule 4 will be effective one year later, and Rules 3, 5 to 16, 22, and 23 will come into force eighteen months after the publication date.

The Rules introduce a comprehensive framework for Data Fiduciaries (entities determining personal data processing) and Data Principals (individuals to whom personal data relates). Key provisions include detailed requirements for notices provided by Data Fiduciaries to Data Principals, ensuring clarity and transparency regarding data processing purposes and the specific personal data involved. The Rules also establish a registration and obligation framework for Consent Managers, entities designed to facilitate Data Principals in giving, managing, reviewing, and withdrawing their consent for data processing. These Consent Managers are mandated to maintain records of consent activities and avoid conflicts of interest with Data Fiduciaries. Furthermore, the Rules prescribe stringent reasonable security safeguards for Data Fiduciaries to prevent personal data breaches, including measures like encryption, access control, and logging, with a minimum retention period of one year for logs and personal data. Data Fiduciaries are now obligated to promptly intimate both affected Data Principals and the Data Protection Board about any personal data breach, providing details on its nature, extent, and mitigation measures. Specific timelines for data erasure are introduced, particularly for large e-commerce, online gaming, and social media intermediaries, requiring data to be erased when the specified purpose is no longer served, subject to certain exceptions and notifications to Data Principals. The Rules also detail the process for obtaining verifiable consent for the personal data of children and persons with disabilities who have lawful guardians, along with exemptions for certain classes of Data Fiduciaries and purposes. Significant Data Fiduciaries, identified based on criteria like volume and sensitivity of data, face additional obligations, including annual Data Protection Impact Assessments and audits, and restrictions on cross-border data transfers. The operational aspects of the Data Protection Board, including the appointment of its Chairperson and Members, their terms of service, and the Board's meeting procedures, are also laid out. Both the Data Protection Board and the Appellate Tribunal are mandated to function as digital offices, adopting techno-legal measures to conduct proceedings without requiring physical presence. The Central Government is empowered to call for information from Data Fiduciaries or intermediaries for specific purposes, with provisions for non-disclosure to Data Principals in matters affecting national security.

The legislative intent behind these Rules is to operationalize the Digital Personal Data Protection Act, 2023, by providing the necessary detailed procedures and standards for its effective implementation. The policy rationale is to create a robust and transparent ecosystem for digital personal data protection in India, balancing the needs of data processing with the fundamental rights of individuals. The Rules address statutory gaps left by the principal Act, which provided the overarching legal framework, by specifying granular requirements for compliance, enforcement, and grievance redressal. They introduce new obligations for Data Fiduciaries and Consent Managers, ensuring greater accountability and fostering a culture of data privacy. For instance, the legislation provided: “A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum, — appropriate data security measures, such as securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data;...” This provision underscores the emphasis on proactive security measures. The Rules also clarify the earlier legal position by defining specific conditions under which personal data can be processed, particularly for vulnerable groups like children and persons with disabilities, and for state-provided services. The establishment of the Data Protection Board and the Appellate Tribunal, with their digital functioning mandates, aims to create efficient and accessible enforcement mechanisms. The Rules also incorporate real-world scenarios, such as illustrations for data erasure and child consent, to provide clarity on their application.

Keywords: Digital Personal Data Protection Rules, Data Fiduciary, Data Principal, Consent Manager, Data Protection Board, Personal Data Breach, Data Erasure, Child Data Protection, Significant Data Fiduciary, Digital Office

Geo Tags: India District: Not Applicable