1. What Are the DPDPA 2025 Rules?

The DPDPA 2025 Rules were officially published by the Government of India on 13 November 2025.
They give detailed instructions on:
How companies should collect and use personal data
How consent must be taken
How data breaches must be reported
What parents need to do for child safety
What “Significant Data Fiduciaries” must follow
Data retention limits
How personal data can be transferred outside India

Rule-by-Rule Explanation of DPDPA 2025 (In Simple Words)

Rule 3 – What A Company Must Tell Users Before Taking Their Data
Before collecting any personal data, the company must show a clear, simple notice that explains:

• What personal data they are collecting

• Why they are collecting it (purpose)

• What service the data is needed for

• How the user can withdraw consent

• How they can raise a complaint

No more hidden terms inside long privacy policies.The explanation must be independent, readable, and easy.

Rule 4 – Consent Managers: How They’re Registered
Consent Managers must:

• Be registered companies in India

• Show they have technical and financial strength

• Maintain a platform where users can give, withdraw, and manage consent

• Avoid conflict of interest

• Publish details of ownership and key managers

They can also lose their license if they misuse data or violate conditions.

Rule 5–7 – Government Data Processing + Security + Breach Reporting
These Rules talk about:How the Government Uses Personal Data
When the government uses data for subsidies, benefits, licenses, certificates, etc., it must follow strict standards (Second Schedule).

Security Safeguards (Rule 6)
Every company must use reasonable security controls like:

• Encryption

• Access control

• Logging

• Monitoring

• Backups

• Contracts with vendors for data safety

They must store logs for one year.

Data Breach Reporting (Rule 7)
If a breach happens:

1. Inform the affected users immediately

2. Inform the Data Protection Board

3. Provide details within 72 hours

4. Explain the cause, impact, and actions taken

This pushes companies to be transparent instead of hiding incidents.

Rule 8 – How Long Companies Can Keep Your Data
Companies must delete personal data when:

• The purpose is over

• The user hasn’t used the service for a long time

• Retention period is completed

But they must keep logs for at least 1 year (Seventh Schedule).

Rule 9 – Publish Contact Details for Data Queries
Every company must publish:

• Email / phone of their Data Protection Officer or responsible contact

• Location on the website or app

• Include this info in user rights response emails

This makes it easier for users to ask questions.

Rule 10–11 – Consent for Children & Persons with Disabilities
Children below 18 years need verifiable parental consent.
A company must:

• Check parent’s identity

• Validate age using official IDs or Digital Locker

• Allow consent withdrawal easily

Same applies to persons with disabilities, but the lawful guardian must be verified.

Rule 12 – Exemptions for Schools, Hospitals, and Child Safety Organizations
Some organisations don’t need parental consent for certain operations:

• Schools

• Hospitals

• Day-care centres

• Child transport services

But only when the purpose is child safety, education, or health.

Rule 13 – Obligations for Significant Data Fiduciaries (SDF)
SDFs must:

• Conduct an annual Data Protection Impact Assessment

• Conduct an annual audit

• Ensure algorithms used don’t harm user rights

• Avoid transferring certain sensitive data outside India

• Submit reports to the Board

If your business is large, high-risk, or handles sensitive data, you may fall under this category.

Rule 14 – Making User Rights Easy to Access
Companies must:

• Explain how users can request access, correction, deletion

• Publish this process clearly

• Respond within 90 days

• Enable nomination (like how you assign nominees for bank accounts)

Rule 15 – Data Transfer Outside India
Personal data can be transferred outside India, but:

• Only to countries approved by the Government

• The company must follow government restrictions

• Sensitive categories may have more limitations . This ensures data sovereignty.

Rule 16 – Exemptions for Research & Statistics
Personal data used purely for research, archiving, analytics, or statistics (without harming user rights) is exempt from many obligations.
This promotes innovation while keeping privacy intact.

Rules 17–23 – Administrative, Governance, Tribunal & Enforcement Rules
These sections deal with:

• Appointment of Board members

• Their salaries and benefits

• How the Board functions as a digital office

• Appeals to the Tribunal

• How the government can request information from companies

Not directly relevant for most businesses, but useful for understanding enforcement.

What Does This Mean for Businesses in 2025?
Here’s the simplest breakdown:
If your business collects personal data (name, phone, email, location, KYC, behaviour, preferences… anything), you must:
1. Show a simple, clear privacy notice -No complicated legal jargon.
2. Take consent cleanly and track it
3. Build an easy option for users to withdraw consent
4. Delete data when it’s no longer needed
5. Report breaches fast - No hiding.
6. Secure data properly -Encrypt, log, monitor.
7. Have a DPO if you’re a large organisation
8. Keep data only for required time
9. Make grievance handling clear
10. Be transparent about data processing
Businesses that ignore these can be fined heavily.

Real-Life Scenarios To Make It Easy
You sign up for an e-commerce website
The company must show:

• What data they collect

• Why they collect it

• How to delete your account

• How to contact their DPO

Your data must be deleted after 3 years of inactivity.

The Big Picture: Why DPDPA 2025 Matters
India is now one of the world’s largest digital economies.
Every business collects data. Every customer shares data.
DPDPA 2025:

• Protects citizens

• Builds trust

• Forces companies to be responsible

• Aligns India with global standards (GDPR-like)

• Helps India become a safer digital nation

It’s a huge step for businesses, but an even bigger win for users.

Final Thoughts
The DPDPA Rules 2025 change how organisations collect, store, use, and protect personal data.
Compliance is not optional  and delaying it only increases risk.
digiALERT: Your Data Protection Partner
Our team helps enterprises streamline DPDPA implementation through:

• Enterprise-grade privacy frameworks

• Staff awareness training

• Consent architecture design

• Data mapping and classification

• Audit support and documentation

• End-to-end compliance consulting

We’ve helped organisations across industries modernise their security and privacy posture and we can help you too.
Book a quick call with digiALERT and start your DPDPA compliance journey with confidence.