DPDP Rules 2025 Decoded:
What They Mean for Your Business

Introduction: The Rules Are What Make the Law Real

The Digital Personal Data Protection Act, 2023 is the skeleton. The DPDP Rules 2025, notified by the Ministry of Electronics and Information Technology (MeitY), are the flesh and muscle — the specific, operational requirements that determine what your organisation must actually do to be compliant.

This post decodes every significant provision in the DPDP Rules 2025, explains its practical business implication, and highlights where most organisations currently have gaps.

What Are the DPDP Rules 2025?

Under Section 40 of the DPDP Act, the Central Government is empowered to make rules to carry out the provisions of the Act. The Rules fill in the operational detail that the Act intentionally left to secondary legislation — specific formats, timelines, technical standards, and procedures.

The Rules were notified in early 2025. They are legally binding on all Data Fiduciaries operating under the Act. Rule 1 confirms: if the Act applies to you, the Rules apply to you. No separate applicability test.

Notice — The Operational Detail You Need

Rule 3 operationalises Section 5 of the Act with specific requirements that go beyond the Act's general principles. It has five significant sub-provisions.

3.1 Plain Language Mandate

Notices must be written in clear and plain language — not legalese. A privacy notice full of defined terms, cross-references, and lawyer-drafted qualifications does not satisfy Rule 3.

3.2 Standalone Format — No Bundling

The notice must be standalone — it cannot be embedded inside Terms and Conditions, End User Licence Agreements, or similar documents. The Rules explicitly prohibit presenting the privacy notice as part of a broader document the user is expected to scroll through.

3.3 Five Mandatory Elements

Every notice must contain all five of these elements — not some, all:

1. What personal data is being collected — specific categories, not vague descriptions like "usage data"
2. The purpose for which data will be processed — specific, named purposes; not "to improve your experience"
3. The manner in which Data Principals can exercise their rights — a link to the rights portal, contact details, step-by-step process
4. The manner in which complaints/grievances can be filed — Grievance Officer name, contact details, filing process
5. The manner in which consent can be withdrawn — not just "you can withdraw consent" but the specific mechanism

3.4 Language: 22 + English

Notices must be available in English and at least one language from the Eighth Schedule to the Constitution — which lists 22 languages:

3.5 Existing Data Principals

For personal data collected before the Rules came into effect, notices must be issued "at the first opportunity" when interacting with existing Data Principals.

Consent Manager — The 7-Year Obligation

Rule 4 defines what it means to operate as a Consent Manager and sets the obligations for maintaining consent artifacts. This is the most technically demanding rule for most organisations.

4.1 Consent Artifacts: The 7-Year Retention Requirement

All consent artifacts must be maintained for a minimum of 7 years from the date of consent, or 7 years from the date of withdrawal — whichever is later.

A "consent artifact" is defined to include:

• The identity of the Data Principal
• The specific purpose for which consent was given
• The version of the notice that was active at the time of consent
• The exact timestamp
• The channel through which consent was given (portal, API, campaign, etc.)
• The mechanism by which consent was confirmed (email OTP, click, API call)

4.2 Consent Artifacts Must Be Produced on Demand

On request from:

• The Data Principal themselves (to verify their own consent history)
• The Data Protection Board of India (in enforcement proceedings)

Consent artifacts must be produced immediately in a form that is verifiable.

4.3 Consent Propagation Log

Consent Managers must maintain a log of consent propagation — documenting how consent decisions were communicated to every downstream Data Processor, the timestamp of communication, and whether delivery was confirmed.

Processing Personal Data of Children

Rule 6 adds operational detail to Section 9's protections for children's data.

Verifiable Parental Consent

The Rules reference two mechanisms for verifying parental consent:

• DigiLocker — India's digital document locker, linked to Aadhaar
• Aadhaar-based OTP verification — for age and identity confirmation

Prohibition on Tracking

Processing that involves tracking children's online behaviour, targeted advertising to children, or other activities "likely to cause detrimental effect" on children is prohibited.

Significant Data Fiduciaries

Rule 7 operationalises the SDF designation and its consequences. The DPBI may designate organisations as SDFs based on volume of personal data processed, sensitivity of personal data (health, financial, biometric), risk to national security or public order, and potential impact on sovereignty.

Large e-commerce platforms, major BFSI players, large HR/payroll processors, healthcare providers, and telecom companies are the most likely SDF candidates in the first wave of designations.

Requirement	What It Means
Data Protection Officer	Must be based in India; reports to the Board of Directors; single point of contact for DPBI
Independent Data Auditor	External auditor conducts periodic compliance audits; findings presented to the DPO
Data Protection Impact Assessments	Mandatory DPIA before commencing high-risk processing activities
Algorithm Assessment	Periodic assessment of algorithms used in profiling or automated decision-making for fairness and bias
DPIA submission to DPBI on request	DPIA register and individual DPIA reports must be producible for DPBI inspection on demand

Breach Notification — 72 Hours Is Not Much Time

Rule 8 operationalises Section 8(6)'s breach notification obligation with specific procedural requirements.

The 72-Hour Clock

From the moment a Data Fiduciary becomes aware of a personal data breach, a 72-hour clock starts for notifying the DPBI. The notification must include:

1. Nature of the personal data breach
2. Categories of personal data involved
3. Estimated number of Data Principals affected
4. Estimated volume of personal data involved
5. Likely consequences of the breach
6. Measures taken or proposed to address the breach and mitigate its effects

Notification to Data Principals

Notification to affected Data Principals must follow "as soon as reasonably practicable" — the Rules do not prescribe a specific deadline beyond DPBI filing, but prompt communication is expected.

Grievance Redressal

Rule 9 requires:

• Data Fiduciaries to publish the name and contact details of their Grievance Officer
• Grievances to be acknowledged and resolved within 30 days
• Responses to be in writing and, if rejected, to state reasons
• If the Data Fiduciary fails to resolve within 30 days, the Data Principal may approach the DPBI directly

Data Principal Rights — Operational Framework

Rule 10 provides the operational framework for how rights requests must be handled.

Response Timelines

Right	Response Deadline
Access (§11)	90 days
Correction / Erasure (§12)	90 days
Grievance (§13)	30 days
Nomination (§14)	As requested

Identity Verification

Before fulfilling a rights request — especially erasure — the Data Fiduciary must verify the identity of the requester. The Rules support:

• Email OTP verification
• DigiLocker / Aadhaar-based identity verification

Erasure Propagation

For erasure requests, Data Fiduciaries must communicate the erasure instruction to all Data Processors holding data for the relevant individual. Processors must confirm completion.

Compliance Gap Summary: Where Most Organisations Stand Today

Based on the Rules analysis above, here is a summary of the most common compliance gaps:

Area	Rule	Most Common Gap
Notice format	Rule 3	Bundled into T&Cs; English only; missing rights mechanism
Consent artifacts	Rule 4	No text snapshot; no 7-year retention; no on-demand production
Consent propagation	Rule 4	No log of downstream system notification or delivery confirmation
Children's data	Rule 6	No verifiable age / parental consent mechanism
SDF preparation	Rule 7	No DPO, no DPIA process, no audit relationship in place
Breach notification	Rule 8	No documented playbook; no 72-hour notification process
Grievance response	Rule 9	Ad-hoc inbox; no 30-day SLA tracking or written response process
Rights request SLA	Rule 10	No self-service portal; manual tracking; no erasure orchestration

How Vishwaas AI Maps to Each Rule

Every gap in the table above corresponds to a Vishwaas AI module purpose-built to close it:

Rule	Vishwaas AI Coverage
Rule 3 — Notice	Privacy Notice module: TipTap editor, standalone delivery, 22 languages, version control, acknowledgement tracking
Rule 4 — Consent artifacts	Non-repudiable consent ledger: SHA-256 hash chain, RSA signature, RFC 3161 TSA token, 7-year retention, on-demand export
Rule 4 — Propagation log	Consent Propagation module: HMAC-signed webhook delivery, delivery log, retry queue, propagation monitor
Rule 6 — Children	Minor flag, guardian linkage, DigiLocker / Aadhaar verification method support
Rule 7 — SDF / DPIA	DPIA module: questionnaire, risk heatmap, DPO approval gate, DPIA register export
Rule 8 — Breach notification	Breach Incident Management: 72-hour clock, DPBI notification panel, principal alert dispatch, immutable timeline
Rule 9 — Grievance	DPR module: grievance type, 30-day SLA, Grievance Officer assignment, written response, audit trail
Rule 10 — Rights	DPR module: self-service portal, 90-day SLA, identity verification, cross-system erasure job orchestration

Conclusion: The Rules Close the Gaps the Act Left Open

The DPDP Rules 2025 transform the Act's principles into specific, auditable obligations. The organisations that will emerge compliance-ready are those that read the Rules carefully, map them to their current processes, identify the gaps, and build or procure the infrastructure to close those gaps — before the DPBI is fully operational.