G.S.R. 846(E) · India · Primary text with plain-English notes
Digital Personal Data Protection Rules, 2025
The Rules that make the DPDP Act work: 23 rules and seven schedules notified on 13 Nov 2025, with the consent notice, the security floor, the 72-hour breach report, retention periods, children's consent, the duties of Significant Data Fiduciaries and the Data Protection Board's procedure. One page per rule and schedule, with the notified text, a plain-English reading, what you must do, and the date each part applies.
Sources: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy); Corrigenda G.S.R. 892(E), 10 Dec 2025 (MeitY copy); Gazette of India, G.S.R. 846(E), 13 Nov 2025 (eGazette); DPDP Act 2023, s. 40: Power to make rules · Change log
- Status
- In force in part
- Fully applies
- 13 May 2027Rule 1(4)
- Penalties
- Under the Act's ScheduleDPDP Act 2023
- Binds
- Data Fiduciaries, Consent Managers and the Board
Countdown · Every remaining rule
190days
to 13 May 2027, when notice, consent, security, breach intimation, rights and the penalties all apply.
Consent Manager registration opens first, on 13 Nov 2026: 9 days from today.
Get ready with InfofacilityKey dates
- 13 Nov 2025In force
G.S.R. 846(E) publishes the Rules. Rules 1, 2 and 17 to 21, on commencement, definitions and the Data Protection Board, apply at once, together with the Fifth and Sixth Schedules.
Rule 1(2) - 10 Dec 2025In force
Corrigenda G.S.R. 892(E) correct typographical errors in the notification. Nothing substantive changes.
G.S.R. 892(E) - 13 Nov 2026Upcoming
Rule 4 and the First Schedule apply: Consent Managers may apply to the Board for registration.
Rule 1(3) - 13 May 2027Upcoming
Rules 3, 5 to 16, 22 and 23 apply, with the Second, Third, Fourth and Seventh Schedules: notice, security safeguards, breach intimation, retention, children's consent, Significant Data Fiduciary duties, rights, transfers, appeals and calls for information.
Rule 1(4)
Commencement follows Rule 1(2) to (4). The one-year and eighteen-month dates are counted from publication in the Gazette on 13 Nov 2025. The same three steps bring the matching sections of the Act into force (G.S.R. 843(E)).
Who the Rules apply to
In plain English
The Rules bind whoever the Act binds: every Data Fiduciary processing digital personal data in India, or outside India in connection with offering goods or services to people in India, and the Data Processors working for them. Rules 17 to 21 govern the Data Protection Board itself. Rule 4 and the First Schedule govern Consent Managers. Rule 5 and the Second Schedule govern the State and its instrumentalities. The Third Schedule reaches only the largest e-commerce, gaming and social media platforms. Everything else applies to every Data Fiduciary, large or small, from 13 May 2027.
Source: DPDP Act 2023, s. 3 and s. 40
Groups and rules
Preliminary
Rules 1 and 2
Notice, Consent Managers and processing by the State
Rules 3 to 5
Security, breach, erasure and contact
Rules 6 to 9
Children and persons with disability
Rules 10 to 12
Significant Data Fiduciaries, rights and transfers
Rules 13 to 15
Exemption for research, archiving and statistics
Rule 16
The Data Protection Board of India
Rules 17 to 21
Appeals and calling for information
Rules 22 and 23
The Schedules
Seven schedules: Consent Manager conditions and obligations; State and research standards; retention periods for large platforms; children's-data exemptions; Board terms of service; the Board's staff; purposes for calling for information. The Fifth and Sixth are in force, the First applies from 13 Nov 2026, the rest from 13 May 2027.
Status follows Rule 1(2) to (4). Each rule and schedule page carries its own date and source.
Most read rules
Intimation of personal data breach
Upcoming · 13 May 2027Rule 6Reasonable security safeguards
Upcoming · 13 May 2027Rule 3Notice given by Data Fiduciary to Data Principal
Upcoming · 13 May 2027Rule 8Time period for specified purpose to be deemed as no longer being served
Upcoming · 13 May 2027Rule 10Verifiable consent for processing of personal data of child
Upcoming · 13 May 2027Rule 4Registration and obligations of Consent Manager
Upcoming · 13 Nov 2026Read it with
Change log
- 4 Nov 2026 First version. Text of all 23 rules and the seven schedules from the Gazette of India notification G.S.R. 846(E) of 13 Nov 2025 (MeitY copy), with commencement dates from Rule 1. Tables in the Third, Fourth and Seventh Schedules transcribed row by row with the Gazette's column headings as labels. Words hyphenated across a line break rejoined and spacing after commas normalised; wording unchanged. Corrigenda G.S.R. 892(E) of 10 Dec 2025 not yet folded into the text.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators