Master Report

17 July 2026 by

CKonnect

Executive Summary

The Digital Personal Data Protection Rules, 2025, were published under subsection (1) of section 40 of the Digital Personal Data Protection Act, 2023. The Rules fill the gaps which are left behind by the DPDP Act, 2023. The Notification of the Government of India in the Ministry of Electronics and Information Technology has 23 rules and 7 schedules, which extensively talk about commencement, notice, consent manager, data principal rights, technical and organisational requirements, cross-border data transfer, protection of children’s data, data protection of the Board of India, etc. The following master report has been prepared by research and analysis of the DPDP Act, 2023, draft rules which were notified on 3rd January 2025, as well as the final rules of 2025.

Act vs Rules Gap Analysis

Topic / Obligation	What DPDP Act states	What was unclear originally	How the Rules fill the gap	Practical implication for organizations
Notice to Data Principal	(Sec 5) Before requesting consent, a Data Fiduciary must give the Data Principal a notice informing her of the personal data being collected, the purpose of processing, how to exercise rights, and how to file a complaint.	The Act says notice must be given “in such manner as may be prescribed,” but does not specify format or content beyond the broad points. Practically, organizations did not know how detailed the notice must be or where/how to publish it.	Rule 3 spells out notice requirements in detail. It requires the notice to be standalone and in plain language. At minimum, the notice must itemize the data categories and specific purposes (and what goods/services will be provided by the processing). It must also provide a direct link or means (website/app and other methods) for the Data Principal to withdraw consent, exercise rights, or complain.	Organizations now must prepare detailed notices. For example, a website form collecting data must include a clear list of each data field and why it’s needed, plus links (or contact info) for withdrawing consent or complaining. Notices must be prominent and easy to understand, not buried in terms of service.
Consent Requirements	Consent must be “free, specific, informed, unconditional and unambiguous,” given by a clear affirmative action. It must cover a defined purpose and only necessary data. Withdrawal of consent is allowed anytime, with comparable ease	The Act defines the quality of consent but does not describe the process or documentation. It was unclear what form of action counts as “affirmative,” or how to obtain and record consent.	The Rules do not add a general consent process beyond the Act’s principles, but they clarify special cases. Rules 10–11 define how to obtain “verifiable” consent for children’s or disabled individuals’ data (see next row). Also, Rule 3’s notice requirements (above) help ensure consent is informed. Rule 9 requires providing contact info (e.g. Data Protection Officer) wherever consent is requested	In practice, organizations should ensure consent forms or checkbox procedures clearly label each data point and purpose. For digital consent, it must be documented (e.g. timestamp, IP log) so it can be “verified” later if disputed. Non-children consent is largely unchanged, but companies should adopt record-keeping practices (e.g. audit logs of consents) in case proof is needed.
Data Principal Rights (access, correction, erasure)	DP’s rights to access summary of her data and its processing (Sec. 11) and to correction/completion/updating/erasure of her data processed with consent (Sec. 12). (Requests “in such manner as prescribed.”)	The Act left unspecified how DP requests are made or processed, what identifiers or formats to use, and no response deadlines.	Rule 14 requires each Data Fiduciary (and Consent Manager) to prominently publish on its website/app the means to request rights and any identifiers needed (usernames, IDs). It also allows nomination of representatives (rule 14(4)) and mandates a grievance-response timeframe (≤ 90 days). Rule 9 requires DF to publish DPO or contact info in all DP responses.	Organizations must update privacy notices and websites with clear instructions (webforms, emails, etc.) for DP rights requests, collect only needed IDs, and implement workflows to meet the prescribed timelines. They must track and document DP requests and respond (through DPO) within the rule’s limits.
Lawful Processing	Sec. 4 Processing of personal data is allowed only for a lawful purpose, which is defined as any purpose not forbidden by law. A fiduciary may process data only with the Data Principal’s consent or for certain “legitimate uses”	The Act’s language is broad: it does not detail what counts as a “legitimate use” or how to determine lawfulness. It also does not specify how to document consent or lawfulness.	The Rules elaborate some legitimate-use cases. For example, Rule 5 and its Second Schedule govern when State agencies can process data (e.g. for issuing subsidies or licenses. No rule explicitly changes Sec.4, but these clarifications show how specific uses (subsidies, benefits) fit under “legitimate uses.”	Organizations must ensure any data use falls under consent or a defined legitimate category. For government services, they must follow the standards in the Second Schedule when processing citizen data. Firms should document the lawful basis (consent or specific legitimate purpose) for each processing activity.
Data retention & deletion	DF must erase personal data on DP’s withdrawal of consent or “as soon as reasonable to assume” the purpose has ended (Sec. 8(7)) (unless law requires retention).	No specific retention periods or notice requirements were given. “Reasonable time” is vague; organizations did not know how long to keep data or when to delete it.	Rule 8 sets concrete timelines and procedures. Affected DF classes have fixed retention periods (e.g. 3 years of inactivity for large e‑commerce, gaming, social-media intermediaries, per Third Schedule). Before auto-deletion, DF must notify DP 48 hours in advance. All DFs must retain logs and associated data for ≥1 year for audit purposes.	Organizations must implement retention schedules and deletion workflows. They need to track when a DP last engaged (or exercised rights) and delete data after the prescribed inactivity period, sending advance notices. Systems must also keep processing logs for at least one year for compliance auditing.
Data breach notification	In case of a personal data breach, DF “shall give the Board and each affected DP intimation, in such form and manner as may be prescribed” (Sec. 8(6).	The Act did not specify when or how to notify, or what details to include. There was no timeline for Board notification or content guidance.	Rule 7 spells out detailed obligations. DF must notify each affected DP “without delay” via the DP’s account or registered contact, in concise, clear and plain language, including: the breach description (nature, extent, timing); likely consequences; mitigation measures; safety steps DP can take; and a business contact at the DF. Separately, DF must notify the Board “without delay” of breach summary (with nature, timing, location, impact) and provide a detailed report within 72 hours (extended only by Board’s written permission).	Organizations must establish incident-response protocols to meet these rules. Breach reports must be formatted as required, and sent immediately to affected individuals (DP) and the Board. Systems should track breach timelines (to ensure 72h Board notice). Businesses need ready templates and contacts to fulfil these notification requirements promptly.
Grievance redressal	DP has right to grievance redressal by DF or Consent Manager (Sec. 13(1)), and DF/CM must respond “within such period as may be prescribed”.	The Act did not define how to handle complaints or what the prescribed response period is.	Rule 14(3) fixes that period: every DF and CM must respond to DP grievances within 90 days (unless a shorter period is later prescribed). The grievance mechanism (forms, contact) must be published.	Companies must set up formal complaint-handling processes (e.g. a portal or email). All privacy complaints must be logged, investigated, and answered within 90 days. Compliance teams need to monitor this 90‑day window.
Security safeguards	DF must take “reasonable security safeguards” to protect data (Sec. 8(5)).	What exactly qualifies as “reasonable” was unclear. No baseline controls were listed.	Rule 6 details minimum safeguards: e.g. encryption/ obfuscation of stored data; access controls on systems and DF/processor resources; audit logs and monitoring to detect unauthorized access; data backups for continuity; and requiring processors by contract to also implement these safeguards. (It also requires retaining logs for 1 year.)	Organizations must implement these concrete controls. For example, they should encrypt databases, restrict administrative access, maintain logs with audit trails, deploy backups, and include security clauses in processor contracts. These become the new de facto compliance floor.
Cross-border transfers	The Central Government may “restrict the transfer of personal data… to such countries or territories outside India as may be notified” (Sec. 16(1)).	No criteria or procedure for lawful transfer were provided. It was unclear how and when DF can transfer data abroad.	Rule 15 clarifies that any transfer outside India is permitted only if the DF meets conditions that the Central Government may specify by general order or special order. In effect, transfers are allowed subject to any future government requirements (e.g. adequacy lists, contracts, or exemptions) announced by rule or notification.	Organizations must closely monitor future government orders or guidelines on overseas transfer. Until then, they should assume strict conditions (for example, only transferring to countries deemed safe or under specified contractual terms) and be prepared to implement any required transfer agreements or localization as mandated.
Government data processing standards	The Act’s “certain legitimate uses” include State/instrumentalities processing for services or official functions (Sec. 7(b), Sec. 17(2)). Such processing is permitted “subject to standards being in accordance with policy issued by the CG or any law”.	The Act did not enumerate those “standards”. It just referenced future rules/policies.	Schedule II (Rules) prescribes standards for State and its agencies when processing personal data: processing must be lawful and limited to necessary data; data must be kept accurate; retention only as needed; and reasonable security safeguards (similar to DF obligations) must be in place. When processing under Sec. 7(b), the agency must also give the Data Principal an intimation (notice) and provide contact info and rights-access details.	Government bodies and related projects must comply with these rules (e.g. minimizing data collected for welfare schemes, securing it, and notifying citizens). For example, an edtech platform running a government scholarship program must follow these procedures. In practice, State entities now have clearer compliance checklists akin to DF requirements.
Significant Data Fiduciary obligations	“Significant” Data Fiduciaries (those notified by CG) must appoint a DPO, conduct periodic DPIAs and audits (Sec. 10(2)).	The Act did not define “periodic” or set frequencies; nor did it address algorithmic risk or cross-border restrictions for SDFs.	Rule 13 mandates that each SDF must perform a Data Protection Impact Assessment and a data audit at least once every 12 months after notification as SDF. The SDF must submit the DPIA/audit report (with significant findings) to the Board. The rule also requires SDFs to conduct due diligence on any “technical measures or algorithmic software” they use so that these do not endanger DP rights. Additionally, an SDF must follow Government orders to not transfer specified personal and traffic data outside India (if a CG committee identifies certain categories).	Large organizations (e.g. major tech or online service providers) designated as SDFs must now schedule annual DPIAs and independent audits and document them. They need to review algorithms for bias/privacy risk, and stay alert for any CG list of data classes that must remain in India. These obligations raise the bar for compliance in the largest companies.
Children’s data processing	Special rules apply to child data (Sec. 9): DF must obtain “verifiable consent” of a parent before processing a child’s data; it must not process data “likely to cause any detrimental effect on child” or undertake behavioural tracking/targeted ads at children. (Exceptions may be prescribed.)	The Act left key points undefined: How to ensure parental consent is authentic (“verifiable”); what counts as “detrimental”; and what exceptions exist for e.g. schools, transport, etc.	Rule 10 defines “verifiable consent”: DFs must take technical/organizational measures to confirm the parent is an identifiable adult. This may involve checking identity/age via DF’s records or verifying a government-issued ID or token (e.g. Digi Locker). Rule 11 similarly addresses guardians of disabled persons. The Fourth Schedule (Rules) lists specific exceptions to Sec. 9(1) and (3): for example, schools and child-care providers may track children in their care or during transport for safety, and trivial account functions (like setting up an email-only account) are exempt.	EdTech and other child-focused platforms must implement robust parental-verification (e.g. require parent login or government ID check) before storing a minor’s data. They must disable targeted ads or profiling for users identified as children. The exceptions mean schools can use monitoring systems within the defined safety limits, but otherwise consents can’t be bypassed. These clarifications help edtech companies design child-safe data flows.
Nomination of Representatives	(Sec 14) Data Principals can nominate one or more individuals (e.g. heirs) to exercise their data rights after death or incapacity, in a manner “as may be prescribed”	The Act provided no detail on nomination procedures or proof required. It was unclear how a principal would notify a fiduciary about their nominees.	Rule 14 (see Rights above) states that to nominate, the principal can provide the nominee’s details using the same request channels and identifiers used for other rights. In other words, nomination is just another type of request under the fiduciary’s process.	Practically, organizations should allow an account holder to designate contacts (e.g. via a form or account settings). After the Principal’s death/incapacity, the nominee can use these credentials/IDs to act on data requests. Service agreements or platforms may add a “nominee” field in user profiles.

Draft vs Final Rule comparison

Rule Number / Heading	Draft Rules Summary	Final Rules Summary	Difference (Added / Removed / Revised / Clarified)	Impact Area
Rule 1. Short title and commencement	Provides a simple two-part commencement. Rules 3-15, 21, and 22 would come into force at a future date, and all others on publication.	Establishes a detailed, four-part staggered implementation timeline: • Immediate: Rules 1, 2, 17-21 (Board setup). • 1 Year: Rule 4 (Consent Manager). • 18 Months: Rules 3, 5-16, 22-23 (Core Fiduciary obligations)	Revised (Major). The Final Rules provide a detailed, phased compliance roadmap, which was absent in the Draft. This is a fundamental policy shift.	Timelines
Rule 2. Definitions	Stated that all expressions have the meaning assigned in the Act.	Adds specific definitions for (a) "Act," (b) "techno-legal measures," (c) "user account," and (d) "verifiable consent".	Added. The Final Rules add four crucial definitions. "User account" is moved from Draft Rule 7. "Verifiable consent" is newly defined.	Consent, Children, Rights
Rule 3. Notice given by Data Fiduciary	Notice must contain an "itemised description" of personal data and "the specified purpose of" processing.	Notice must contain an "itemised description" of data and "the specified purpose or purposes of, and specific description of" processing.	Revised (Clarified). Clarifies that a notice can cover multiple purposes, but each requires a specific description, reinforcing the bar against bundling.	Consent, Rights
Rule 4. Registration and obligations of Consent Manager	Outlines the registration process, conditions (in First Schedule), and obligations (in First Schedule) for Consent Managers.	Identical to the Draft. Outlines the registration process, conditions (in First Schedule), and obligations (in First Schedule) for Consent Managers.	No Change. The framework for Consent Managers, including the high bar for registration, is unchanged.	Consent Manager, Consent
Rule 5. Processing... by State	Specifies conditions for State processing of personal data for subsidies, benefits, etc., under Sec 7(b) of the Act. References standards in Second Schedule.	Wording is slightly revised for clarity but the substance is identical. It removes the direct reference to Sec 7(b) from sub-rule (1), as it is implicit. References standards in Second Schedule.	Revised (Minor Clarification). No substantive change.	Government
Rule 6. Reasonable security safeguards	Mandates safeguards including encryption, obfuscation, masking, or virtual tokens. Requires log retention for one year.	Mandates safeguards such as encryption, obfuscation, masking, or virtual tokens. Requires log retention for one year. Also adds "wherever applicable" to access control (1)(b) and processor contracts (1)(f).	Revised (Clarified). The change from "through" to "such as" makes the list of security measures illustrative, not exhaustive.	Breach, SDF
Rule 7. Intimation of personal data breach	Intimation to Data Principal must include "timing and location of its occurrence". Intimation to Board within 72 hours. Defines "user account" in sub-rule (3).	Intimation to Data Principal must include "timing of its occurrence". Intimation to Board within 72 hours. Definition of "user account" is removed.	Revised (Clarified). • Removed: The impractical requirement to state the "location" of the breach in the notice to the Data Principal is removed. • Moved: Definition of "user account" is moved to Rule 2(c).	Breach
Rule 8. Time period for specified purpose...	Governs erasure of data per Third Schedule when purpose is served. Requires 48-hour notice before erasure.	Governs erasure per sub-rules (1) and (2) (identical to Draft). Adds sub-rule (3): Mandates a minimum one-year retention of personal data, traffic data, and logs for purposes in Seventh Schedule, even after purpose is served	Added (Major). The addition of sub-rule 8(3) creates a new, mandatory data retention obligation that conflicts with the erasure obligation in 8(1). This is a fundamental change.	Timelines, Government, Breach
Rule 9. Contact information of person...	Data Fiduciary must publish contact info of DPO or other person to answer questions.	Identical to the Draft	No Change.	Rights
Rule 10 (Draft). Verifiable consent for... child or... person with disability	Bundles consent for children (verifying parent is an "identifiable adult") and persons with disability (verifying guardian is "appointed by a court...") into one rule.	This rule only addresses "verifiable consent for... child". It simplifies the verification method for parents compared to the Draft.	Revised (Major). The rule is split. Draft Rule 10 is bifurcated into Final Rule 10 (Children) and Final Rule 11 (Persons with disability).	Children, Consent
Rule 11 (Final). Verifiable consent for... person with disability	(This was part of Draft Rule 10(2)).	This is a new, standalone rule extracted from the Draft. It details the requirement to verify a lawful guardian is "appointed by a court of law, a designated authority or by a local level committee".	Added (Structural). This new rule gives separate, detailed focus to the high verification bar for guardians of persons with disabilities.	Rights, Consent
Rule 11 (Draft) / Rule 12 (Final). Exemptions... for... child	Draft Rule 11) Provides exemptions from Sec 9(1) and 9(3) of the Act for classes of Fiduciaries and purposes in Fourth Schedule.	(Final Rule 12) Identical in substance to Draft Rule 11.	No Change (Re-numbered). Rule is re-numbered due to the insertion of Final Rule 11.	Children, Consent
Rule 12 (Draft) / Rule 13 (Final). Additional obligations of Significant Data Fiduciary	(Draft Rule 12) Requires annual DPIA and audit. Requires due diligence on "algorithmic software".	(Final Rule 13) Requires annual DPIA and audit. Expands due diligence to "technical measures including algorithmic software". Adds sub-rule (5) defining the "committee" for localization recommendations.	Revised (Clarified/Added). • Scope of diligence is broadened. • Procedural detail is added for the localization committee.	SDF, Government
Rule 13 (Draft) / Rule 14 (Final). Rights of Data Principals	(Draft Rule 13) Requires Fiduciaries to publish a "period" for grievance redressal. Defines "identifier" in sub-rule (5).	(Final Rule 14) Mandates a grievance redressal period "not exceeding ninety days". Expands definition of "identifier" in sub-rule (5) to include "email address, mobile number".	Revised (Major). • Added: A mandatory 90-day SLA for grievance redressal. • Revised: Definition of "identifier" is expanded, making it easier for users to make requests but harder for Fiduciaries to authenticate.	Rights, Timelines
Rule 14 (Draft) / Rule 15 (Final). Processing of personal data outside India	(Draft Rule 14) States cross-border transfers are subject to restrictions specified by the Central Government on making data available to a foreign State or entity.	(Final Rule 15) Title changed to "Transfer... outside... India." Wording is slightly clarified, but the substance is identical to the Draft.	Revised (Minor Clarification). No substantive change. The "negative list" approach is maintained.	Cross-Border
Rule 15 (Draft) / Rule 16 (Final). Exemption for research...	(Draft Rule 15) Exempts processing for research, archiving, or statistical purposes if done per standards in Second Schedule.	(Final Rule 16) Identical to Draft Rule 15.	No Change (Re-numbered).	Government
Rule 16 (Draft) / Rule 17 (Final). Appointment of Chairperson and other Members	(Draft Rule 16) Details the composition of the Search-cum-Selection Committees for the Board.	(Final Rule 17) Identical to Draft Rule 16.	No Change (Re-numbered).	Government
Rule 17 (Draft) / Rule 18 (Final). Salary, allowances...	(Draft Rule 17) Specifies terms and conditions of service for Board members per Fifth Schedule.	(Final Rule 18) Identical to Draft Rule 17.	No Change (Re-numbered).	Government
Rule 18 (Draft) / Rule 19 (Final). Procedure for meetings of Board...	(Draft Rule 18) Details Board procedures (quorum, voting, etc.). Sets a 6-month inquiry timeline (extendable by 3 months).	(Final Rule 19) Identical to Draft Rule 18.	No Change (Re-numbered).	Government, Timeline
Rule 19 (Draft) / Rule 20 (Final). Functioning of Board as digital office	(Draft Rule 19) States Board will function as a digital office and may adopt "techno-legal measures"	(Final Rule 20) Identical to Draft Rule 19	No Change (Re-numbered).	Government
Rule 20 (Draft) / Rule 21 (Final). Terms and conditions... of officers and employees of Board	(Draft Rule 20) Specifies terms for Board staff per Sixth Schedule	(Final Rule 21) Identical to Draft Rule 20, but removes the specific manner of appointment ("in such manner as the Central Government may... specify").	Revised (Minor). Minor simplification of appointment language	Government
Rule 21 (Draft) / Rule 22 (Final). Appeal to Appellate Tribunal	(Draft Rule 21) Details procedure for appeal to TDSAT, including digital filing and fees. States Tribunal will function as a digital office with "techno-legal measures".	(Final Rule 22) Identical to Draft Rule 21, but simplifies digital filing language and removes specification of payment systems ("UPI or such other...").	Revised (Minor Clarification). No substantive change.	Government
Rule 22 (Draft) / Rule 23 (Final). Calling for information...	(Draft Rule 22) Empowers Central Govt to call for info from Fiduciaries/intermediaries for purposes in Seventh Schedule, and to prohibit disclosure of such a request	(Final Rule 23) Splits the Draft rule into two sub-rules for clarity: (1) power to call for info, and (2) power to prohibit disclosure (gag order). Substance is identical. Also adds definition of "intermediary" in sub-rule (3)	Revised (Clarified). Better drafting for clarity. No substantive change to the government's power.	Government
First Schedule. Consent Manager	(Parts A & B) Details conditions for registration (e.g., Rs. 2 Cr net worth) and obligations (e.g., data-blind, fiduciary capacity, conflict of interest).	(Parts A & B) Identical to the Draft.	No Change.	Consent Manager
Second Schedule. Standards for processing... by State	Details standards for State processing (e.g., lawful, purpose limitation, accuracy, retention, security safeguards).	Details standards for State processing. The only change is in point (d): Draft required "reasonable efforts to ensure the accuracy." Final requires "reasonable efforts to ensure the completeness, accuracy and consistency".	Revised (Minor). Adds "completeness" and "consistency" to the data quality standard for State processing, slightly increasing the burden	Government
Third Schedule. Time period for erasure	Lists classes of Fiduciaries (e-comm, gaming, social media) and mandates 3-year erasure period. Defines "social media intermediary" by reference to IT Act, 2000.	Identical table and 3-year period. Note (c) is changed to define "social media intermediary" by reference to the IT (Intermediary Guidelines...) Rules, 2021.	Revised (Clarified). The definition of "social media intermediary" is updated to harmonize with the IT Rules, 2021, providing greater legal certainty.	SDF, Timelines
Fourth Schedule. Exemptions for... child	(Part A) Exempts certain Fiduciaries (e.g., clinical, educational) from parental consent. (Part B) Exempts certain purposes (e.g., state functions, email creation, blocking harmful information).	(Part A) Identical to Draft. (Part B) Adds two new exemptions: 4. "For the determination of real-time location..." and 5. "For ensuring that any information, service or advertisement... is not accessible..."	Added (Major). The Final Rules add significant new exemptions for processing children's data without parental consent, specifically for location tracking and blocking harmful ads/services.	Children, Consent
Fifth Schedule. Terms and conditions... of Board	Details salary (Chairperson Rs. 4.5L, Member Rs. 4L), allowances, leave, etc., for Board members	Identical to the Draft.	No Change.	Government
Sixth Schedule. Terms and conditions... of Board staff	Details terms for Board officers and employees (deputation, gratuity, leave, etc.).	Identical to the Draft	No Change.	Government
Seventh Schedule. Calling for information...	Lists purposes for which Central Govt can call for info under Draft Rule 22 (e.g., security of State, SDF assessment)	Lists identical purposes for Final Rule 23. Adds "and 8(3)" to the Schedule title, explicitly linking these government purposes to the new one-year retention mandate.	Added (Major). The addition of the reference to Rule 8(3) is a critical change, providing the legal basis for the new retention mandate.	Government, Breach, Timelines

Data Principal Rights Requirements

(A). Rights request submission channels

Excreted from rule 3 (c)-(ii-iii) and rule 14 (5)

Channels For Submitting Rights Requests

Website request portal

Mobile app request flow

Consent Manager platform (if using one)

Other communication means, if specified (e.g., email, helpdesk form)

Channel disclosure must include: Exact link or navigation path.

Acceptable Identifiers (Rule 14.5):

Customer identification file number
Customer acquisition form number
Application reference number
Enrolment ID
Email address
Mobile number
Licence number

(B). Identity/authentication requirements

Extracted from Rule 14(1)(b) and general authentication

Data Fiduciary may require: Username, account ID, customer ID, mobile number, email etc. (defined as “identifier”)

DPDP Rules 2025 Final

Login through existing user account
OTP verification to registered email/mobile
Additional particulars as per terms of service

Core principle: Authentication requirements must be published upfront and proportionate only sufficient to verify identity.

(C). Verification process

Data Fiduciaries must verify Data Principal identity using:

Registered identifiers (email, mobile, customer ID)
User account credentials
Particulars specified in terms of service
Cross-referencing against registered Data Principal information

Verification for Nominated Representatives (Rule 14.4):

Data Principals may nominate one or more individuals to exercise rights on their behalf. This requires:

Compliance with Data Fiduciary's terms of service
Adherence to applicable law requirements
Provision of means and particulars specified by the Data Fiduciary

(D). Timelines for responding

Activity	Timeline	Rule Reference
Response to DSR	Maximum 90 days	Rule 14(3)
Personal data retention	Minimum 1 year from processing	Rule 8(3)
Erasure notice	Minimum 48 hours before erasure	Rule 8(2)
Board inquiry	6 months (extendable by 3 months)	Rule 19(9)
Consent Manager records	Minimum 7 years	First Schedule, Part B
Class-specific retention	3 years from last interaction	Third Schedule
Breach notification to Board	Within 72 hours of awareness	Rule 7(2)

(E). When a request may be rejected

DF may reject if:

Identity cannot be verified Rule 14(1)(b).
Request is manifestly unfounded or excessive (Act principle).
Retention is legally required:
- Under Rule 8(3) logs must be retained for one year.
- Any other legal requirement supersedes erasure.
Processing is under exemption (State functions, research, children-related exemptions).
Data not reasonably retrievable or no longer in possession.

DF must still:

Provide reasons in plain language.
Guide the Data Principal on grievance escalation.

(F). Obligatory record-keeping requirements

Taken from Rules 6, 7, 8, 14, First Schedule (Consent Manager).

✔ Data Fiduciary must maintain:

Logs & traffic data for minimum 1 year → Rule 6(1)(e), Rule 8(3)

DPDP Rules 2025 Final

Records of all personal data processing events (minimum 1 year).
Records of breach notifications issued to Data Principals & Board → Rule 7(2)(vi).

DPDP Rules 2025 Final

Record of grievances handled, response times, and actions taken (Rule 14(3) requires a functioning grievance system).
DSR records although not explicitly called “DSR log”, it is implied under accountability + reasonable security safeguards.

Consent Manager (if used) must retain records for 7 years: Rule First Schedule Part B(4)(c)

(G). Escalation process to Data Protection Board

Excreted from Rule 14(3), Rule 3(c)(iii), Rule 19(9), Rule 22(1), Rule 22(3)

If a Data Principal is not satisfied, there is a multi-step escalation path.

Grievance with Fiduciary: The Data Principal should first use the grievance redressal system published by the Data Fiduciary or Consent Manager.
Complaint to the Board: The initial notice from the Data Fiduciary must include information on how a Data Principal can "make a complaint to the Board".
Board Inquiry: The Board conducts an inquiry into the complaint, which must be completed within six months (with a possible three-month extension).
Appeal to Tribunal: If any person is "aggrieved by an order or direction of the Board," they have the right to file an appeal before the Appellate Tribunal

Step-by-Step DSR Workflow

Phase 1: Pre-Request Preparation

Step 1: Data Fiduciary Setup

Prominently publish on website/app:
- Means for submitting rights requests
- Required identifiers/particulars for authentication
- Business contact information (DPO or designated person)
- Grievance redressal system details
- Link/means to make complaint to the Board

Step 2: Data Principal Preparation

Identify the Data Fiduciary to whom consent was given
Gather required identifiers (email, mobile, customer ID, etc.)
Access user account or registered communication mode

Phase 2: Request Submission

Step 3: Data Principal Submits Request

Choose submission channel (user account, registered email/mobile, other published means)
Provide required identifiers/particulars
Specify the right being exercised (access, correction, erasure, grievance redressal, nomination, withdrawal of consent)

Step 4: Request Receipt

Data Fiduciary receives the request
System logs the request with timestamp
Acknowledgment sent to Data Principal (best practice)

Phase 3: Verification & Authentication

Step 5: Identity Verification

Data Fiduciary verifies identity using registered identifiers
Cross-checks against registered Data Principal information

Step 6: Authentication Decision

If verified → Proceed to processing
If not verified → Follow rejection process

Phase 4: Request Processing

Step 7: Request Analysis

Determine nature of request
Check for legal obligations preventing compliance
Verify if minimum retention period applies
Assess conflicts with other legal requirements

Step 8: Data Retrieval/Action

Based on request type:

Access Request: Retrieve all personal data, compile processing information
Correction Request: Identify inaccurate data, implement corrections, update systems
Erasure Request: Verify eligibility, execute erasure if compliant
Grievance: Route to grievance redressal system, investigate
Nomination: Verify nominated individual, update records

Phase 5: Response Preparation

Step 9: Compile Response

Prepare response in clear, concise manner
Include business contact information, actions taken, explanations, escalation options

Step 10: Quality Check

Ensure completeness and accuracy
Confirm compliance with 90-day timeline

Phase 6: Response Delivery

Step 11: Send Response

Deliver through user account or registered communication mode
Include follow-up contact information
Log response with timestamp

Step 12: Record Response

Update internal logs
Document actions taken
Maintain records per retention requirements (minimum 1 year)

Timeline Checkpoint: Within 90 days from request receipt

Phase 7: Rejection Process (if applicable)

Step 13: Grounds Assessment

Identity/authentication failure
Legal obligation requires data retention
Minimum 1-year retention period not elapsed
Retention required for Seventh Schedule purposes

Step 14: Rejection Notice

Provide clear explanation with legal basis
Inform about escalation options
Include DPO/designated person contact information

Phase 8: Escalation (if Data Principal not satisfied)

Step 15: Complaint to Data Protection Board

File complaint using Board-specified means
Provide details of Data Fiduciary, request nature, response, dissatisfaction reason

Step 16: Board Inquiry Process

Timeline: 6 months (extendable by 3-month periods)
Board investigates, summons persons, calls for information
Uses techno-legal measures (digital proceedings)

Step 17: Board Decision

Board issues order/direction
Communicated to both parties
Data Fiduciary must comply

Step 18: Appeal to Appellate Tribunal

Either party may appeal Board decision
File in digital form with applicable fee
Tribunal conducts proceedings and issues final decision

Phase 9: Continuous Monitoring

Step 19: Ongoing Compliance

Monitor grievance redressal effectiveness
Implement technical and organisational measures
Maintain records per retention requirements

Step 20: Periodic Review

Review DSR processes regularly
Update submission channels as needed
Train staff on DSR handling
Audit compliance with 90-day timeline

Technical & Organizational Requirements

A. Security Safeguards (Rule 6)

Legal framework- DPDP Act Section 8(5) and DPDP Rules, Rule 6

Every Data Fiduciary must use "reasonable security safeguards

Technical Requirement	Practical Controls (What to do)	Remark
Data Security Measures	Encryption: Scramble data at rest and in transit. Masking/Obfuscation: Hide parts of the data (like showing only the last 4 digits of a card number).	Must hide the data so unauthorized people cannot read it.
Access Control	Use strong passwords and Multi-Factor Authentication (MFA). Grant access only to employees who need it for their job.	Only the right people should be able to touch the computer systems.
Visibility & Logs	Turn on system logs. Review these logs regularly to see if anyone is accessing data they shouldn't.	Must keep a record of who looked at the data to spot hackers.
Business Continuity	Backups: Keep copies of data in a safe, separate location. Test your backups to make sure they work.	If data is lost or destroyed, you must be able to get it back.
Log Retention	Store access logs and security logs for at least one year.	Must keep security logs for a specific time.

B. Breach notification requirements (structure, timelines)

Legal Framework- DPDP Act Section 8(6) and DPDP Rules Rule 7

If a "personal data breach" happens such as hack or accidental leak, you must follow this strict workflow.

A. Notification Workflow

Step 1: Intimate To Data Principal (The User)

Time limit: "Without delay".
Method: Email, in-app notification, or any other registered communication mode.
What to tell them:
- What happened (nature and timing).
- How it affects them (consequences).
- What you are doing to fix it.
- What they can do to stay safe.
- Contact details of a person they can talk to.

Step 2: Intimate to the Data Protection Board of India.

Initial Report: Send a description "without delay".
Detailed Report: Send full details within 72 hours of knowing about the breach.
- Content: Facts, causes, remedial measures, and proof that you told the users

C. Data retention rules, including deletion after inactivity.

Legal Framework- DPDP Act Section 8(7); DPDP Rules, Rule 8; Third Schedule

The organisation cannot keep data forever. You must delete it when it is no longer needed.

General Rule

You must erase personal data when:

The user withdraws consent.
The purpose for collecting it is finished.

The "Inactivity" Rule (Automatic Deletion)

For specific types of companies (E-commerce, online gaming, social media), if a user does not use their account for a certain time, you must treat the purpose as "finished" and delete the data.

Time Limit: 3 Years of inactivity.
Exceptions: Do not delete if the law requires you to keep it (like banking logs).

Deletion Workflow

Warning: 48 hours before deleting the data, send a message to the user saying, "We are about to delete your data unless you log in".
Log Retention: Even after deleting the user's personal data, you must keep the logs of the deletion process for one year.

D. DPIA requirement and Audit requirements

Legal Framework- DPDP Act Section 10; DPDP Rules, 2025, Rule 13

Significant Data Fiduciary- big and data involvement have extra technical duties.

Requirement	Timeline	Description
Data Protection Impact Assessment (DPIA)	Once every 12 months.	A check to see if your software or processing risks the rights of users. Organization must report findings to the Board
Audit requirements	Once every 12 months.	An outside auditor checks if you are following the law
Algorithmic Verification	Ongoing	You must verify that your software algorithms do not harm user rights

F. Vendor and processor obligations

Legal Framework – DPDP Act Section 8; DPDP Rules Rule 6(1)(f)

If organisation hire another company (a Data Processor) to handle data for you (like a cloud provider or payroll company):

Contract: You must have a valid contract with them.
Security Flow-down: Your contract must force them to use the same security safeguards (encryption, access control) that you use.
Deletion: If you must delete data, you must make sure your processor deletes it too.
Responsibility: If the processor messes up, the Data Fiduciary are responsible.

G. Standards for government processing

Legal Framework- DPDP Rules Rule 5; Second Schedule

When the government processes data for benefits, licenses, or certificates, they must follow strict standards:

Limitation: Only process data that is strictly necessary.
Accuracy: Make reasonable efforts to ensure data is complete and consistent.
Security: Must use the same security safeguards (Rule 6) as private companies.
Central Policy: Must follow any policy issued by the Central Government regarding data governance.

Cross-Border Transfers

A. Transfer mode Permitted by Default

Legal backing Section 16(1) of the DPDP Act and Rule 15 of the DPDP Rules, 2025

The Rule: Organization are generally allowed to transfer personal data to any country. The government does not need to "approve" the country first.
The Restriction: The Central Government has the power to notify (list) specific countries where transfers are restricted. If a country is not on this "restricted list," can send data there.

B. Conditions for transfers

Even though transfers are allowed, Organisation must follow these specific conditions found in the Rules.

Foreign State Access Check Reference: Rule 15 of the Rules
- The Central Government can issue a "general or special order" regarding transfers.
- If organization send data to a country where the Foreign State (their government) or an agency under its control can access that data, you must meet specific requirements set by the Indian Government.
- Practical Meaning: Organisation must check if the foreign government (like the US or China) has laws allowing them to spy on or access the data you send there.
Significant Data Fiduciary (SDF) Localization Reference: Rule 13(4) of the Rules
- If Organisation are a Significant Data Fiduciary (SDF), the government can list specific types of sensitive personal data that must stay in India.
- The "Traffic Data" Rule: For this specific data, organisation generally cannot transfer the data or the "traffic data pertaining to its flow" (the logs and metadata) outside India.

C. Any exceptions (government processing)

Some activities are exempt from these strict transfer rules.

The "Outsourcing" Exception Reference: Section 17(1)(d) of the DPDP Act
- If organization are in India processing data for a client outside India (outsourcing), and the data belongs to people outside India, the transfer restrictions (Section 16) do not apply.
- Example: An Indian BPO handling data for US customers can send that data back to the US freely.
Research and Statistics Exception Reference: Section 17(2)(b) of the DPDP Act; Rule 16 of the Rules 2025
- The Act does not apply to processing necessary for research, archiving, or statistical purposes.
- Condition: The data must not be used to make any specific decision about a Data Principal.

D. Risk considerations for organizations

These are the risks created by the specific language in the Rules.

Risk of Sudden Orders Reference: Rule 15 of the Rules
- The Government can issue a "general or special order" at any time. This means a country that is "safe" today could have new requirements tomorrow if the political situation changes.
The "Traffic Data" Trap for SDFs Reference: Rule 13(4) of the Rules
- For SDFs, the ban extends to "traffic data".
- Technical Risk: Many clouds services route "traffic data" (like server logs) globally for security monitoring. SDFs might violate this rule if they use standard global cloud settings for restricted data.
- Note- Traffic data is not defined under DPDP act as well as DPDP Rules, 2025.

E. Transfer mode Permitted by Default

Legal backing Section 16(1) of the DPDP Act and Rule 15 of the DPDP Rules, 2025

The Rule: Organization are generally allowed to transfer personal data to any country. The government does not need to "approve" the country first.
The Restriction: The Central Government has the power to notify (list) specific countries where transfers are restricted. If a country is not on this "restricted list," can send data there.

F. Conditions for transfers

Even though transfers are allowed, Organisation must follow these specific conditions found in the Rules.

Foreign State Access Check Reference: Rule 15 of the Rules
- The Central Government can issue a "general or special order" regarding transfers.
- If organization send data to a country where the Foreign State (their government) or an agency under its control can access that data, you must meet specific requirements set by the Indian Government.
- Practical Meaning: Organisation must check if the foreign government (like the US or China) has laws allowing them to spy on or access the data you send there.
Significant Data Fiduciary (SDF) Localization Reference: Rule 13(4) of the Rules
- If Organisation are a Significant Data Fiduciary (SDF), the government can list specific types of sensitive personal data that must stay in India.
- The "Traffic Data" Rule: For this specific data, organisation generally cannot transfer the data or the "traffic data pertaining to its flow" (the logs and metadata) outside India.

G. Any exceptions (government processing)

Some activities are exempt from these strict transfer rules.

The "Outsourcing" Exception Reference: Section 17(1)(d) of the DPDP Act
- If organization are in India processing data for a client outside India (outsourcing), and the data belongs to people outside India, the transfer restrictions (Section 16) do not apply.
- Example: An Indian BPO handling data for US customers can send that data back to the US freely.
Research and Statistics Exception Reference: Section 17(2)(b) of the DPDP Act; Rule 16 of the Rules 2025
- The Act does not apply to processing necessary for research, archiving, or statistical purposes.
- Condition: The data must not be used to make any specific decision about a Data Principal.

H. Risk considerations for organizations

These are the risks created by the specific language in the Rules.

Risk of Sudden Orders Reference: Rule 15 of the Rules
- The Government can issue a "general or special order" at any time. This means a country that is "safe" today could have new requirements tomorrow if the political situation changes.
The "Traffic Data" Trap for SDFs Reference: Rule 13(4) of the Rules
- For SDFs, the ban extends to "traffic data".
- Technical Risk: Many clouds services route "traffic data" (like server logs) globally for security monitoring. SDFs might violate this rule if they use standard global cloud settings for restricted data.
- Note- Traffic data is not defined under DPDP act as well as DPDP Rules, 2025.

Children’s Data & Parental Consent Requirements

1. Age Definition- Section 2(f) of the DPDP Act

A "child" is any individual who is under 18 years old.

2. Verification Method Requirements -Rule 10 of the Rules

Companies/Data Fiduciaries must use technology to prove that the person giving consent is actually the parent.

Companies must verify that the person claiming to be the parent is an adult.

How to Verify:
- Existing Data: If the parent is already a user on your platform, you can use the ID details you already have.
- Voluntary ID: If they are not a user, they can voluntarily provide ID proof.
- Digital Tokens: Companies can use a "virtual token" (a secure digital code) from a government-authorized service like Digi Locker to verify their age and identity without seeing their actual ID card.

3. Parental Consent Standards- Section 9(1) of the DPDP Act

Requirement: Before companies process any data of a child, companies must get "verifiable consent" from the parent or lawful guardian.
Standard: This consent follows the same strict rules as regular consent (free, specific, informed, and unconditional). The key difference is strict verification that it is truly the parent acting.

4. Special Responsibilities of Companies- Section 9(2)-(3) of the DPDP Act, Rule 12 & Fourth Schedule of the DPDP Rules, 2025.

If you process children's data, you have strict prohibitions (things Companies cannot do):

No Detrimental Effect: You cannot use data in any way that might hurt the child's well-being.
No Tracking: You cannot track a child's behaviour or monitor them.
No Targeted Ads: You cannot show advertisements targeted specifically at children.

When you CAN track: Some organizations are allowed to track children for safety or specific duties, the following are exceptions

Schools: For education and safety.
Hospitals/Doctors: For health treatments.
Transport: To track the location of school buses for safety.

5. Deletion Rules- Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules, 2025

Withdrawal: If the parent withdraws consent, companies must delete the child's data immediately.
Inactivity Rule (social media/Gaming): If a child uses a social media or Gaming platform but stops using it for 3 years, the company must automatically delete their data.

Data Protection Board of India

The Chapter V is dedicated to Data protection board of India, from section 18-26 under the DPDP Act, 2023 and Rule 17 to 21 and 5th and 6th Schedule of DPDP Rules, 2025.

Statutory basis- The Board is established by the Central Government under Section 18 of the Act. It is a "body corporate," meaning it can own property, sign contracts, and sue (or be sued) in its own name.
Composition and appointment

The section 19 of DPDP Act, 2023

Members: The Board consists of a chairperson and other Members.

Qualification: They must be experts in fields like data governance, law, and digital economy. At least one member must be a legal expert.

Appointment Process: The Central Government appoints them based on recommendations from a "Search-cum-Selection Committee". This committee is led by the Cabinet Secretary (for the Chairperson) or the IT Secretary (for Members).

Term: They hold office for two years and can be re-appointed.

Powers and function

The Section 27 & 28 of the DPDP Act,2023 and rule 20 of DPDP Rules, 2025, the Board is an independent body that functions mostly as a digital office. Its core jobs are:

Directing Remedies: If a data breach happens, it can order the company to take urgent steps to fix it or reduce the harm.
Inquiring into Breaches: It investigates complaints from Data Principals regarding privacy breaches.
Consent Managers: It oversees Consent Managers and can investigate them if they break the rules.
Civil Court Powers: For investigations, the Board has the power of a Civil Court. It can summon people, demand documents, and inspect data or books.

Inquiry process
Legal concept under Section 28 of the DPDP Act, 2023 and Rule 19, DPDP rules, 2025

Start: The process starts when the Board receives a complaint, a government reference, or a breach report.

Screening: The Board decides if there are "sufficient grounds" (enough evidence) to proceed. If not, it closes the case.

Inquiry: If they proceed, they conduct an inquiry following the "principles of natural justice" (fairness).

Digital Proceedings: The Board uses "techno-legal measures" so people do not have to physically appear for hearings.

Timeline: The inquiry must be finished within 6 months. This can be extended by another 3 months if necessary.

Conclusion: After hearing the person concerned, the Board issues an order to either close the case or impose a penalty.

Penalty powers
The Section 33 & Schedule of the DPDP Act, 2023, the Board lack the jurisdiction to impose a sentence of imprisonment. It can only impose money penalties.

Maximum Penalty: Up to 250 Crore Rupees for a data breach.

Other Penalties: Up to 200 Crore Rupees for failing to notify the Board about a breach.

Factors: When deciding the amount, the Board looks at how bad the breach was, if it was repetitive, and if the company gained money from it

Appeal procedure

The Section 29 of the DPDP Act and Rule 22 of DPDP Rules, 2025.

Where to Appeal: If you are unhappy with the Board's decision, you can appeal to the Appellate Tribunal (TDSAT).
Time Limit: You must file the appeal within 60 days.
Digital Filing: The appeal must be filed in a digital form.

How organisations will interact with the Board
Breach Reporting: Section 8(6) of the Act; Rule 7(2) of the Rules, the companies must report data breaches to the Board "without delay" and send a detailed report within 72 hours.

Voluntary Undertaking: Under section 32 of DPDP Act, 2023, If company make a mistake, they can offer a "voluntary undertaking" (a formal promise) to fix it. If the Board accepts this, they might stop further legal action against you.

Audits (SDFs): Rule 13(2) of the Rules, Significant Data Fiduciaries must submit audit reports to the Board.

Scenarios where the Board can suspend/cancel registrations

Rule 4(5) of the DPDP Rules, 2025, the Board has the specific power to suspend or cancel the registration of a Consent Manager.

Scenario: If a Consent Manager fails to meet the conditions of registration mentioned in the Rule 4 of DPDP, rules 2025.
Process:
1. The Board informs the Consent Manager of the failure.
2. It gives them a chance to be heard (explain themselves).
3. If not satisfied, the Board can suspend or cancel the registration to protect the interests of the users.
Blocking Websites: For other companies (Data Fiduciaries), the Board cannot "cancel" them directly, but it can advise the Central Government to block public access to their website/app if they are penalized repeatedly.

Data Protection Officer and Significant Data Fiduciary Requirement.

A. When a company become SDF, it mentioned under Section 10(1) of the DPDP Act, 2023 additional obligations of Significant Data Fiduciary.

A company does not automatically become an SDF based on a simple number of users. Instead, the Central Government will notify specific companies or classes of companies as SDFs based on an assessment of:

Volume and sensitivity of personal data processed.
Risk to the rights of Data Principals.
Potential impact on the sovereignty and integrity of India.
Risk to electoral democracy.
Security of the State and public order.

B. Obligation imposes on SDFs, under section 10(2) of the DPDP Act and Rule 13 of the DPDP Rules, 2025.

Once notified as an SDF, your organization must fulfil these specific "Additional Obligations"

1. Appoint a Data Protection Officer (DPO): A specific individual to handle compliance and grievances.

2. Appoint an Independent Data Auditor: To evaluate compliance.

3. Conduct Periodic DPIA: Undertake a Data Protection Impact Assessment.

4. Conduct Periodic Audits: Perform regular audits.

5. Algorithmic Due Diligence: Verify that your software/algorithms do not pose a risk to user rights.

6. Data Localization (Conditional): If the government specifies certain data, you must ensure that data (and its traffic logs) stays in India.

C. The Data Protection Officer (DPO): Section 10(2)(a) of the Act

Who Can Be Appointed- The following are some details regarding DPO.

The DPO must be based in India.

Role: They must be an employee or individual capable of representing the SDF.

Reporting: They must be "responsible to the Board of Directors or similar governing body".

Qualifications- The Act does not list specific degrees

Responsibilities- Act as the primary representative of the SDF for all provisions of the Act.

Point of Contact: Serve as the contact point for the Data Protection Board and for Data Principals regarding grievances.

Grievance Redressal: They are accountable for the grievance redressal mechanism.

D. Reporting Structure & Documentation

Reporting hierarchy -The DPO cannot report to middle management. They must have a direct line to the Board of Directors or the highest governing body.

Documentation Requirements:

DPIA Reports: Rule 13(2) Must be documented and findings reported to the Board.

Audit Reports: Findings must be furnished to the Board.

Algorithmic Verification Logs: Proof that you exercised "due diligence" on your software algorithms.

Contact Info: The DPO’s business contact information must be prominently published.

Implementation Timeline

Phase 1 (Effective Immediately: November 2025)

These rules are primarily administrative, focused on setting up the Data Protection Board (DPB).

Rule 1: Short Title and Commencement (The name of the rules)
Rule 2: Definitions
Rule 17: Appointment of Chairperson and Members of the Board
Rule 18: Salary, allowances, and conditions of service
Rule 19: Procedure for meetings of the Board
Rule 20: Functioning of the Board as a digital office
Rule 21: Terms and conditions for officers and employees of the Board

Phase 2 (Effective in 12 Months: by November 2026)

This phase is focused on creating the technical infrastructure for consent.

Rule 4: Registration of Consent Managers

Phase 3 (Effective in 18 Months: by May 2027)

This phase includes all the core data protection duties and user rights.

Rule 3: Notice and Consent
Rule 5: Processing data for state functions (subsidies, benefits, etc.)
Rule 6: Security Safeguards (To prevent breaches)
Rule 7: Data Breach Reporting (To the Board and to users)
Rule 8: Data Retention Limits (How long data can be kept)
Rule 9: Publishing contact information for the Data Protection Officer
Rule 10: Processing data of Children
Rule 11: Processing data of Persons with Disabilities
Rule 12: Exemptions related to children's data
Rule 13: Additional duties for Significant Data Fiduciaries (Large companies)
Rule 14: Data Subject Rights (Correction, Erasure, Grievance)
Rule 15: Transferring personal data outside of India
Rule 16: Exemptions for research, archiving, and statistics
Rule 22: Procedure for appealing to the Tribunal
Rule 23: Board's power to require information

By Naukhaiz Aftab

in Digital Personal Data Act, 2023

Share this post

Our blogs

Final Rules Vs Act