DPDP Rules 2025: A Practical Guide for Indian Businesses

The DPDP Rules 2025 are the operational rulebook for India's Digital Personal Data Protection Act 2023. Published by MeitY in early 2025 as draft rules open for public consultation, they translate the Act's broad principles into concrete compliance steps: how to give notice, obtain consent, handle data principal rights, report breaches, and meet the heightened obligations that apply to Significant Data Fiduciaries. If your business collects, processes, or stores personal data of Indian users, these draft rules define what "compliant" will look like once notified. This guide breaks down every major provision and tells you what to do now.

What the DPDP Act 2023 Established

The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection legislation. Passed by Parliament and receiving Presidential assent in August 2023, it:

1. Defines Data Fiduciaries (entities that determine the purpose and means of processing) and Data Principals (the individuals whose data is processed)
2. Establishes the Data Protection Board of India as the adjudicating authority
3. Sets out a rights framework for Data Principals: right to access, correct, erase, and grieve
4. Mandates that personal data of Indian users be processed only for lawful purposes with notice and consent
5. Empowers the central government to designate Significant Data Fiduciaries based on volume, sensitivity, and risk

What the Draft DPDP Rules 2025 Operationalise

MeitY released the Draft DPDP Rules for a sixty-day public consultation window beginning January 2025. They cover six major areas.

1. Notice and Consent Mechanics

The draft rules prescribe the format, language, and granularity of the notice that must accompany or precede consent collection. Key requirements:

1. Notice must be in plain language, available in multiple scheduled languages where practicable
2. It must specify the purpose of processing, the categories of data, and the identity of any data processors engaged
3. Consent must be freely given, specific, informed, and unambiguous — pre-ticked boxes and bundled consents are non-compliant
4. A separate, itemised consent must be obtained for each distinct purpose
5. Withdrawal of consent must be as easy as giving it, and the Data Fiduciary must cease processing within a reasonable time after withdrawal

2. Consent Managers

The draft rules introduce Consent Managers — registered entities that act as intermediaries allowing Data Principals to grant, review, and revoke consents across multiple Data Fiduciaries through a single interface. Consent Managers must:

1. Be registered with the Data Protection Board
2. Maintain an interoperable, auditable consent artefact for each Data Principal
3. Provide Data Principals with a consolidated view of all active consents
4. Transmit consent signals to Data Fiduciaries in a standardised format

3. Reasonable Security Safeguards

Data Fiduciaries are required to implement security safeguards proportionate to the risk posed by the personal data they hold. The draft rules do not prescribe a fixed standard (such as ISO 27001 or PCI-DSS verbatim) but use the language of "reasonable technical and organisational measures." Indicators of compliance drawn from the rules and related MeitY guidance include:

1. Encryption of personal data at rest and in transit
2. Access controls based on the principle of least privilege
3. Regular vulnerability assessments and penetration testing of systems that hold or process personal data
4. Logging of access to personal data records
5. Data retention policies with defined deletion schedules

4. Breach Notification Procedure

The draft rules set timelines and formats for reporting personal data breaches to the Data Protection Board and, where required, to affected Data Principals. The framework mirrors global best practice:

1. Breaches must be reported to the Board without delay after the Fiduciary becomes aware — the draft rules use a short window benchmark broadly aligned with the seventy-two-hour reference in international frameworks
2. Notification to affected Data Principals must include: nature of the breach, categories of data affected, likely consequences, and remediation measures taken or planned
3. A Fiduciary must not delay notification on the grounds that investigation is ongoing; an initial report followed by a supplementary report is acceptable

5. Significant Data Fiduciaries — Elevated Obligations

The draft rules elaborate the additional duties that apply to entities designated as Significant Data Fiduciaries (SDFs) by the government. These entities — likely large platforms, aggregators, and businesses processing sensitive data at scale — must:

1. Appoint a Data Protection Officer (DPO) based in India, accountable to the Board
2. Conduct periodic Data Protection Impact Assessments (DPIAs) for high-risk processing activities
3. Commission annual independent audits of personal data processing practices
4. Implement algorithmic accountability measures for automated decision-making that produces significant effects on Data Principals

6. Children's Data and Verifiable Parental Consent

The Act classifies children as individuals under eighteen. The draft rules tighten how Data Fiduciaries must handle their data:

1. Verifiable parental or guardian consent is mandatory before processing a child's personal data
2. Data Fiduciaries must implement age-verification mechanisms — the draft rules acknowledge the technical challenge here and invite industry input
3. Processing for purposes that may cause detrimental effects on a child's well-being is prohibited regardless of parental consent
4. Behavioural monitoring and targeted advertising directed at children are expressly restricted

DPDP Readiness Workflow

graph TD
    A[Map all personal data flows] --> B[Classify as Data Fiduciary]
    B --> C{Significant Data Fiduciary?}
    C -- Yes --> D[Appoint DPO and schedule DPIA]
    C -- No --> E[Standard Fiduciary obligations]
    D --> F[Implement Notice and Consent framework]
    E --> F
    F --> G[Integrate with or assess Consent Manager]
    G --> H[Deploy reasonable security safeguards]
    H --> I[Draft Breach Notification runbook]
    I --> J[Establish Data Principal rights portal]
    J --> K[Annual review and audit cycle]

    style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style D fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style E fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style F fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style G fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style H fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style I fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style J fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style K fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

DPDP Readiness Checklist by Domain

pie title DPDP Readiness Domains
    "Consent and Notice" : 25
    "Security Safeguards" : 22
    "Breach Response" : 18
    "Data Principal Rights" : 20
    "Governance and Audit" : 15

Compliance Obligations at a Glance

Implementation Timeline Expectations

The draft rules propose a graded implementation timeline allowing smaller businesses longer runway compared to large platforms:

1. Phase 1 (expected shortly after formal notification): Core notice and consent obligations, breach notification framework, Data Principal rights portal
2. Phase 2: Consent Manager ecosystem operationalised; children's data verification mechanisms activated
3. Phase 3: Significant Data Fiduciary designation and elevated obligations (DPIA, audit, DPO) become enforceable

What Indian Businesses Should Do Right Now

Immediate (within 30 days):

1. Conduct a personal data inventory — every dataset, every processing purpose, every third-party processor
2. Identify whether your scale or data sensitivity could qualify you as a Significant Data Fiduciary
3. Audit existing consent flows for specificity, withdrawal mechanisms, and language clarity

1. Draft a Breach Notification Runbook aligned with the draft rules' disclosure requirements
2. Assess your current security posture with a vulnerability assessment — if you process personal data on internet-facing systems, this is non-negotiable. Bachao.AI provides automated VAPT scanning that surfaces the technical gaps the DPDP's "reasonable safeguards" standard will scrutinise
3. Begin vendor due diligence: identify which of your processors and SaaS tools handle personal data, and review their sub-processing agreements

1. Implement a Data Principal rights portal covering access requests, correction workflow, and grievance redressal
2. Begin integration with a Board-registered Consent Manager once the registry is published
3. If potentially SDF-bound, commission a preliminary DPIA for your highest-risk processing activity

Further Reading

1. MeitY — Digital Personal Data Protection
2. DSCI — India Data Protection Framework

How We Can Help

Dhisattva AI Pvt Ltd, a DPIIT Recognized Startup, works with Indian businesses on the technical security layer that DPDP compliance demands. Automated VAPT scanning surfaces the vulnerabilities in your personal-data-holding systems before an auditor or adversary does. For CERT-In empanelled audit requirements, we work with a CERT-In empanelled partner and can facilitate that engagement.

Start with a free VAPT scan to baseline your current technical exposure, then use the results to scope the remediation work your DPDP readiness programme will require.