On November 13, 2025, the Government of India notified the Digital Personal Data Protection Rules, 2025 (“Rules”) under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). These rules follow the draft Digital Personal Data Protection Rules, 2025, which were released for public consultation and comments in January 2025.
The provisions of the DPDP Act and the Rules will come into force in three phases – with phase 1 provisions (relating to constitution of the Data Protection Board of India and other procedural provisions) becoming effective from November 14, 2025; phase 2 provisions (relating to consent managers) becoming effective in November 2026; and phase 3 provisions (substantive provisions) becoming effective in May 2027.
The Rules provide clarity on various aspects of the DPDP Act, including on consent notices, notification requirements in case of a personal data breach, conditions for registration and obligations of Consent Managers, verifiable parental consent for processing children’s data, additional obligations of Significant Data Fiduciaries, new data retention requirements for all data fiduciaries, reasonable security safeguards, and cross-border data transfers.
This note provides an overview of the key provisions under the Rules. Organizations should plan ahead and prepare for compliance under the DPDP Act and Rules.









