Act versus Rules
Parliament passed the Digital Personal Data Protection Act on 11 August 2023. The Act defines the duties of organisations ("Data Fiduciaries") and the rights of people ("Data Principals"). The Rules, published by the Ministry of Electronics and Information Technology, fill in the practical detail: what a notice must contain, how quickly a breach must be reported, how long data may be kept, and the dates each duty begins. New to the Act itself? Start with our one-example explainer.
The three-phase timeline
- 13 November 2025In force now · Rules 1, 2 and 17–21
Definitions and the setting up of the Data Protection Board of India — the body that will hear complaints and impose penalties.
- 13 November 2026One year after publication · Rule 4
Registration and obligations of Consent Managers — the platforms people can use to give, review and withdraw consent across organisations.
- 13 May 2027Eighteen months after publication · Rules 3, 5–16, 22 and 23
The core duties for every organisation: notices, security safeguards, breach reporting, retention and erasure, children's data, rights requests and Significant Data Fiduciary duties.
What each rule asks of you
Rule 3 — Notice
Every request for consent must come with a notice that stands on its own, in clear and plain language, itemising the personal data collected and the specific purpose, how to withdraw consent as easily as it was given, how to exercise rights, and how to complain to the Board.
Rule 6 — Reasonable security safeguards
Protect personal data with measures such as encryption or masking, access controls, logging and monitoring of access, and backups for continuity. Logs and related records are to be kept for at least one year to help detect and investigate unauthorised access.
Rule 7 — Personal data breaches
On becoming aware of a breach, inform affected people without delay in plain language, and inform the Board. A detailed report to the Board — facts, likely impact, steps taken and people notified — is due within 72 hours unless the Board allows longer.
Rule 8 — Retention and erasure
Large e-commerce platforms and social media intermediaries (two crore or more registered users in India) and online gaming intermediaries (fifty lakh or more) must erase data after three years without contact from the person, warning them at least 48 hours before. Separately, every organisation must keep personal data, traffic data and processing logs for at least one year from processing before erasing them, unless another law requires longer.
Rule 9 — Contact details
Publish, on your website or app, the contact details of the person who can answer questions about your processing — or your Data Protection Officer, where one is required.
Rules 10 and 11 — Children and persons with disability
Obtain verifiable consent from a parent — checked to be an identifiable adult using reliable identity and age details or a government-issued token such as DigiLocker — before processing a child's personal data. For a person with disability, verify that the guardian was appointed by a court or designated authority. Limited exemptions are listed in the Fourth Schedule.
Rule 13 — Significant Data Fiduciaries
Organisations notified as Significant Data Fiduciaries must carry out a Data Protection Impact Assessment and an audit every year, and check that the algorithms and software they use do not put people's rights at risk.
Rule 14 — Rights of Data Principals
Publish how people can request access, correction or erasure of their data, and how to nominate someone to act for them. Grievances are to be answered within a period of no more than 90 days.
Significant Data Fiduciary duties are covered in depth in our SDF requirements guide.
What to do before May 2027
- Map the personal data you hold, where it sits and why you collect it.
- Rewrite consent notices to the Rule 3 standard and make withdrawal one step.
- Set up a breach response plan that can produce a Board report within 72 hours.
- Fix retention periods for every purpose, and automate erasure.
- Publish a contact point and a working rights-request process.
Based on the Digital Personal Data Protection Rules, 2025 as published by the Ministry of Electronics and Information Technology on 13 November 2025, and its December 2025 corrigendum. This guide is general information, not legal advice; read the notified text for your specific situation.