New Delhi: The Union Government has formally notified the long-awaited rules under the Digital Personal Data Protection (DPDP) Act, marking India’s most comprehensive step toward operationalising its new privacy regime. The final notification follows a public consultation process on the draft rules released in January this year. Officials confirmed that several objections and stakeholder suggestions have now been incorporated into the final framework.

Phased Rollout Over 18 Months

The implementation is staggered to give industry time to transition.

• Rules 1, 2 and 17–21 come into effect immediately.
• Rule 4, governing registration of Consent Managers, will apply one year from publication.
• Rules 3, 5–16, 22 and 23 take effect 18 months from publication, offering businesses a longer runway for compliance.

Clear, Independent Privacy Notices (Rule 3)

Data Fiduciaries must now issue standalone, plain-language privacy notices listing:

• all personal data collected,
• precise purposes of data processing,
• direct links enabling consent withdrawal, user rights requests and complaint filing.

This aims to eliminate vague, bundled, or non-transparent disclosures.

Consent Manager Registration (Rule 4)

Consent Managers — key intermediaries under the DPDP framework — will be registered by the Data Protection Board (DPB) after meeting conditions in the First Schedule. The DPB may suspend or cancel registrations for violations or non-compliance.

Government Data Processing Standards (Rule 5)

Any personal data processed for subsidies, benefits, services, licences or permits must meet standards outlined in the Second Schedule. These standards cover activities mandated by law, policy or public expenditure.

Mandatory Security Safeguards (Rule 6)

Fiduciaries must adopt minimum security controls, including encryption, masking, tokenisation, access restrictions, activity logs and continuity measures. Logs and certain categories of personal data must be retained for at least one year to enable breach detection.
Contracts with Data Processors must include mandatory security clauses.

Breach Notification Framework (Rule 7)

In case of a breach, Data Fiduciaries must immediately notify:

• Affected users, detailing the nature of the breach, its implications, mitigation steps and a contact point;
• The Data Protection Board, with a detailed report within 72 hours.

Retention and Erasure Requirements (Rule 8)

Categories listed in the Third Schedule must be erased if users do not engage within prescribed timeframes, unless legally required to retain. Users must receive a 48-hour warning before erasure. At least one-year retention of traffic and processing logs is mandatory.

Children’s Data & Disability Safeguards (Rules 10–12)

Processing child data requires verifiable parental consent validated through identity data or authorised tokens. For persons with disabilities, guardianship must be verified through authorities designated under disability laws. Limited exemptions apply for purposes listed in the Fourth Schedule.

Obligations for Significant Data Fiduciaries (Rule 13)

SDFs face tighter requirements, including annual Data Protection Impact Assessments (DPIAs), audits, algorithmic safeguards, data-localisation compliance and mandatory reporting to the Board.

User Rights, Cross-Border Transfers & Research Exemptions

Rule 14 requires clear publication of rights exercise procedures and grievance redress mechanisms with a 90-day resolution window.
Rule 15 permits cross-border data transfers except to jurisdictions restricted by the government.
Rule 16 exempts research, archiving and statistical processing if compliant with Second Schedule standards.

Governance Structure Finalised

Rules 17–21 detail the appointment process for the DPB Chairperson and Members, handled by two high-level committees led respectively by the Cabinet Secretary and MeitY Secretary. Salaries and service conditions appear in the Fifth Schedule.

India Enters a New Privacy Era

The DPDP rules mandate stronger user protections, strict breach reporting timelines, safeguards for children and vulnerable users and heightened obligations for major data-intensive companies. With a phased rollout extending up to 18 months, businesses now face the challenge of overhauling systems to meet India’s new data-protection standards.