DPDP Rules 2025: Rule-by-Rule Guide
Use this table as your map. For each rule you see what it says, who it affects and what a small company should actually do. The right-hand column links to a full how-to guide where one exists. This DPDPA 2023 course page explains rule by rule guide in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Advertisement
| Rule | What it says | Small-company action |
|---|---|---|
| 1 to 2 | Short title, start dates, and definitions such as “user account”, “techno-legal measures” and “verifiable consent”. | Note the three start dates. Read the definitions once. |
| 3 Notice | Notice must make sense on its own, itemise the personal data, state the specific purpose of each use, give a link to your website or app, and explain how to withdraw consent, exercise rights and complain to the Board. | Rewrite your privacy notice. Guide |
| 4 Consent Managers | Indian companies with 2 crore net worth can register with the Board. Duties include interoperability, no conflicts of interest, annual audit, 7-year records. | Probably not you. Watch for consent-manager tie-ups from 13 Nov 2026. |
| 5 State benefits | Standards for the State giving subsidies, benefits, licences and permits. | Only if you run government schemes. |
| 6 Security | Encryption, masking or tokens; access control; logs and monitoring; backups; keep logs 1 year; processor contract clauses; organisational measures. | Implement the checklist. Guide |
| 7 Breach | Tell each person without delay. Tell the Board without delay and send a detailed report within 72 hours. | Prepare a runbook and templates. Guide |
| 8 Erasure | Large e-commerce, gaming and social media platforms erase data of inactive users after 3 years with 48 hours notice. Everyone keeps logs and related data at least 1 year. | Set a retention schedule. Guide |
| 9 Contact | Publish the contact of a Data Protection Officer or another person who answers questions. Repeat it in replies to requests. | Add a contact block to your site. Guide |
| 10 Children | Verifiable consent of a parent who is an adult, checked from details you hold, an ID given voluntarily, or a digital locker token. | Add a parent check if you serve children. Guide |
| 11 Disability | Check that a person claiming to be a lawful guardian was appointed by a court, designated authority or local-level committee. | Ask for the guardianship order or certificate. |
| 12 and Fourth Schedule | Exemptions from children rules for healthcare professionals, educational institutions, creches, school transport, and for listed purposes (legal duty, benefits, email-only account, safety location, blocking harmful content, age check). | Use the decision tree in the children guide. |
| 13 Significant Data Fiduciary | DPIA and audit every 12 months, report to the Board, algorithmic due diligence, keep specified data in India. | Likely not you unless notified. DPIA guide |
| 14 Rights | Publish how people can exercise rights and what identifier you need. Answer grievances within a reasonable time, at most 90 days. People may appoint someone to act for them. | Build a request workflow. Guide |
| 15 Transfers abroad | Transfers are allowed subject to conditions the Government may set, including on access by foreign States. | Map where data goes. Guide |
| 16 and Second Schedule | Research, archiving and statistics are exempt if they follow the Second Schedule standards (lawful, limited, accurate, retained only as needed, secure, accountable). | Follow the standards if you rely on this. |
| 17 to 21 | Board: how members are chosen, paid, how meetings run (one-third quorum), digital office, staff. | Nothing to do. Good to know the Board works online. |
| 19 | Inquiries must finish within 6 months, extendable by up to 3 months. | Keep your evidence folder ready. |
| 22 Appeal | Appeal to the Appellate Tribunal, filed digitally. Fee as under the TRAI Act unless waived. | See the governance guide. |
| 23 Information demands | Government can require information for Seventh Schedule purposes and may bar you from telling the person. | Have a legal contact. Do not ignore notices. |
| First to Seventh Schedules | Consent Manager conditions; State standards; erasure periods; children exemptions; Board pay; Board staff; State and Government purposes including how Significant Data Fiduciaries are assessed. | Read the Third and Fourth Schedules at least. |
Check the exact words
This is a summary. When a decision depends on exact wording (for example a threshold or a time limit), read the rule in the official PDF on the MeitY website.
This is a summary. When a decision depends on exact wording (for example a threshold or a time limit), read the rule in the official PDF on the MeitY website.
Related guides (rule by rule guide)
Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.
Official sources for rule by rule guide: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.
Course content
"+acc(2,false)+"
";if(lead){lead.parentNode.insertBefore(hero,lead.nextSibling);hero.parentNode.insertBefore(g,hero.nextSibling)}else{dp.insertBefore(g,dp.firstChild);dp.insertBefore(hero,dp.firstChild)}try{var last=localStorage.getItem("dpdpa_last");if(last){var b=document.getElementById("tgo");b.href=last;b.textContent="Continue learning"}}catch(e){}}else{var wrap=document.createElement("div");wrap.className="tl";var side=document.createElement("aside");side.className="tcur";side.innerHTML="Course content
"+acc(1,true)+"
";var mob=document.createElement("button");mob.type="button";mob.className="tmob";mob.textContent="Course content (tap to open)";mob.onclick=function(){side.classList.toggle("open")};var main=document.createElement("div");main.className="tmain";dp.parentNode.insertBefore(wrap,dp);var kk=document.createElement("div");kk.className="tkick";var tp="DPDPA 2023 Course";C.forEach(function(t){t.l.forEach(function(x){if(x[1]===path){tp=t.t}})});kk.textContent=tp;main.appendChild(kk);var ttl=document.querySelector("h1.page-title");if(ttl){main.appendChild(ttl)}main.appendChild(mob);var idx=-1;all.forEach(function(x,i){if(x[1]===path){idx=i}});var bar=document.createElement("div");bar.className="tbar";bar.innerHTML="← Course home";main.appendChild(bar);main.appendChild(dp);var dn=document.createElement("div");dn.className="tdone";var nx=null;if(idx>=0){if(idx