Govt Notifies Digital Personal Data Protection Rules, 2025

Notification No. GSR 846(E); Dated: 13.11.2025

1. Background

The Ministry of Electronics and Information Technology (MeitY) has notified the Digital Personal Data Protection (DPDP) Rules, 2025, providing detailed operational guidance for the implementation of the Digital Personal Data Protection Act, 2023.

The Rules establish the procedural framework for data fiduciaries, consent managers, and the Data Protection Board of India (DPBI), ensuring effective governance of personal data processing in India.

2. Key Provisions

2.1 Manner of Serving Notice by Data Fiduciaries

The Rules specify the procedure and format for serving notice by a data fiduciary to a data principal before processing personal data.

These notices must clearly state the purpose of processing, rights of the data principal, and available grievance redressal mechanisms.

2.2 Registration and Obligations of Consent Managers

The Rules lay down detailed registration norms for consent managers, including:

• Application and approval process for registration,
• Responsibilities for managing, updating, and withdrawing consent, and
• Data security and accountability obligations in handling personal data.

2.3 Processing of Personal Data by the State

The Rules outline conditions under which the State or its instrumentalities may process personal data for:

• National security,
• Law enforcement,
• Disaster management, or
• Delivery of public services.

Such processing must be proportionate, necessary, and authorised under applicable law.

2.4 Processing of Personal Data Outside India

The framework prescribes norms for cross-border data processing, including:

• Conditions under which personal data may be transferred to countries outside India, and
• Safeguards to ensure equivalent protection and accountability for the data of Indian citizens.

3. Constitution of the Data Protection Board of India (DPBI)

• The head office of the DPBI shall be located in the National Capital Region (NCR).
• The Board shall consist of four members, including the Chairperson, responsible for oversight, adjudication, and enforcement of data protection obligations.

4. Significance

The notification of the DPDP Rules, 2025 marks a key step in operationalising India’s new data protection regime.
It aims to:

• Strengthen user consent and transparency,
• Ensure accountability of data fiduciaries, and
• Create a robust regulatory ecosystem for digital privacy and data governance.

Click Here To Read The Full Notification