DPDP Rules 2025: what they require and the compliance timeline

What are the DPDP Rules 2025?

The Digital Personal Data Protection Rules, 2025 are the subordinate legislation that operationalises the DPDP Act, 2023. Notified by India's Ministry of Electronics and Information Technology (MeitY) on 14 November 2025, they specify how Data Fiduciaries must actually meet the Act's obligations — the form of consent notices, how Consent Managers operate, what “reasonable security safeguards” mean in practice, how breaches are reported, how long data may be kept, and how children's data is handled.

What the DPDP Rules require

• Consent and notice — the content and form of consent notices, provided in English and India's scheduled languages, with a clear way to withdraw.
• Consent Managers — registration, obligations and the interoperable mechanism through which individuals manage consent across services.
• Reasonable security safeguards — measures such as encryption, access control, logging and monitoring, and backups to protect personal data.
• Breach notification — the obligation and timelines for notifying the Data Protection Board and affected Data Principals.
• Retention and erasure — default retention limits and deletion once the purpose is served.
• Children's data — verifiable parental consent and restrictions on tracking and targeted advertising to children.
• Significant Data Fiduciary obligations — a Data Protection Officer in India, Data Protection Impact Assessments and independent audits.
• Data Principal rights and grievance handling — the processes for access, correction, erasure and complaints.

The phased implementation timeline

The Rules follow a phased rollout rather than switching on at once:

• 14 November 2025 — DPDP Rules notified; the compliance clock starts.
• Mid-2026 — Consent Manager operationalisation and the core consent, notice and security obligations take practical effect.
• Late 2026 — the transitional period ends and the Data Protection Board moves from guidance to active supervision.
• Early 2027 — Significant Data Fiduciaries complete independent audits and Data Protection Impact Assessments.
• Around May 2027 — full enforcement, with the Board's penalty powers fully in effect.

What it means for your business

The phased timeline is a gift you shouldn't waste: it's a transition window to get consent, security, retention and breach processes in place before penalties bite. The organisations that treat 2026 as preparation time won't be scrambling in 2027. See the full DPDP compliance checklist.

How the Rules apply to AI

For AI-driven businesses, the Rules land hardest on training data and automated processing: every dataset used to train or fine-tune a model needs a valid consent and purpose trail, and an erasure request has to propagate to the systems — and models — that used the data. Read how this connects to AI governance.

How AramGRC helps

AramGRC maps your data flows and systems against the DPDP Rules 2025, identifies the gaps, and gives you a prioritised, sector-ready roadmap to close them before enforcement.