India. Comprehensive data protection. Rules (subordinate legislation)
DPDP RulesDigital Personal Data Protection Rules, 2025
§1Summary
- Synopsis
Implementing rules for the DPDP Act that set out notice content, consent-manager registration, security safeguards, breach reporting mechanics, verifiable parental consent, retention/erasure periods, Significant Data Fiduciary duties and Board procedures. They switch on in three phases over 18 months from notification.
- Key themes
- Unique features
Large e-commerce (20m+ users), social media (20m+) and online gaming (5m+) platforms must erase data three years after the user's last interaction, with 48 hours' prior warning; logs must be kept at least one year. SDFs face annual DPIA and audit and possible localisation of government-specified data categories.
- SaaS relevance
Sets the concrete security, logging, breach-reporting and retention controls Indian customers will flow down to SaaS processors from 13 May 2027.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Board and data principals without delay; detailed report to Board within 72h
- DPO
- Conditional
- Cross-border transfers
- Transfers allowed subject to any requirements the Central Government specifies by order; SDF localisation for designated data
- Maximum penalty
- As per DPDP Act Schedule (up to INR 250 crore)
§3Dates
- Key dates
- Adopted
- In force
- Published in Gazette 2025-11-13. Rules 1, 2 and 17-21 (Board constitution and functioning) from 2025-11-13; Rule 4 (consent manager registration) from 2026-11-13; Rules 3, 5-16, 22 and 23 (notice, security, breach, retention, children, SDF, transfers, etc.) from 2027-05-13.
§4Text and authority
- Text
- Authoritative text egazette.gov.in
- Authority
- Data Protection Board of India
§5Where it applies
- Domestic law of
- India
§6Sources and verification
- Verification
High confidence.
Notified as G.S.R. 846(E)/companion to G.S.R. 843(E) (commencement notification); rule numbers per secondary sources. Specific egazette document URL not captured.