RegulationIndia

Digital Personal Data Protection Rules, 2025 (DPDP Rules)

Set out procedural detail for consent, notices, rights, Consent Managers, Significant Data Fiduciaries, cross-border processing and the Data Protection Board.

Request an Assessment

Verify current status

Phasing confirmed 13 Nov 2025 notification; re-check exact rule-wise dates against the Gazette.

Classification

Regulation

Issuing authority

Ministry of Electronics and Information Technology (MeitY)

Jurisdiction

India · Sector: All

Status / edition

Notified; phased commencement

Key dates

Notified 13 Nov 2025 (G.S.R. 846(E)). Phase 1 in force 13 Nov 2025; Consent Manager (Rule 4) from 13 Nov 2026; core rules from 13 May 2027

Mandatory or voluntary

Conditional

Who it applies to

Subordinate rules operationalising the DPDP Act, 2023.

Purpose

Set out procedural detail for consent, notices, rights, Consent Managers, Significant Data Fiduciaries, cross-border processing and the Data Protection Board.

Major requirements / obligations

  • Operational detail for notice/consent
  • Consent Manager registration (phased)
  • SDF obligations
  • Breach and rights procedures

Control domains

PrivacyGovernance

Official reference

https://www.meity.gov.in/data-protection-framework ↗

Last reviewed

2026-10-18 (source verification date)

This library provides general information for orientation only. It is not legal advice, a determination of applicability, or a substitute for formal certification or professional counsel. Verify current legal status, editions and dates against the official source before relying on any entry. Inclusion of a jurisdiction or instrument here is informational and does not imply that Srida IT provides regulated services, holds local authorisation, or has a presence in that jurisdiction.