G.S.R. 02(E)
The draft published for consultation in January 2025. Kept for reference — the final Rules replaced it.
This text has been superseded. It is kept for reference only — do not rely on it for compliance. The rules in force are the DPDP Rules 2025, notified on 13 November 2025.
The Ministry of Electronics and Information Technology (MeitY) published the draft Digital Personal Data Protection Rules, 2025 on 3 January 2025 for public consultation. The draft contained 22 rules and 7 schedules to operationalise the Digital Personal Data Protection Act, 2023.
Key highlights from the draft:
Notice requirements: Data Fiduciaries must provide notices in a "clear and plain language" that are self-contained and understandable independently. The notice must include an itemised description of personal data collected and the specific purpose.
Consent withdrawal: Must be as easy as giving consent. Data Fiduciaries must provide specific links/mechanisms for withdrawal.
Consent Manager registration: Rs. 150 crore minimum net worth requirement for registration. Consent Managers act as intermediaries enabling Data Principals to manage all consents from one platform.
Age verification: Data Fiduciaries must obtain verifiable parental consent before processing children's data. This requires robust age-gating mechanisms.
Behavioral monitoring ban: Prohibited for all Data Fiduciaries processing children's data.
Exemptions: Certain categories (healthcare, educational institutions) may be exempted by Central Government notification.
Data Principals can exercise rights (access, correction, erasure, nomination) through the Data Fiduciary's platform or through a registered Consent Manager. Grievances must be resolved within a period to be prescribed (draft suggested 48-hour acknowledgment, 30-day resolution).
The draft prescribed detailed procedures for Board operations as a "digital office" — all proceedings (intimation, inquiry, appeals) conducted online.
Board composition: Chairperson + Members appointed by Central Government; 2-year terms, eligible for reappointment.
Inquiry procedure: On receipt of a personal data breach intimation or Data Principal complaint, Board determines if grounds exist to proceed; issues notices; can impose penalties per the Schedule.
Draft prescribed specific technical requirements: - Encryption of data at rest and in transit - Access controls and authentication - Regular security audits - Incident response procedures - Backup and recovery mechanisms
SDFs (notified by Central Government) must: - Appoint a Data Protection Officer (India-based) - Appoint an independent data auditor - Conduct annual Data Protection Impact Assessments - Publish DPO contact details
The draft Rules did not specify restricted countries; the Central Government retains power to notify restricted territories. Data transfers to non-restricted countries are permitted.
| Schedule | Subject |
|---|---|
| First | Consent Manager: registration conditions (Part A) + obligations (Part B) |
| Second | Standards for State processing of personal data |
| Third | Security safeguards for Data Fiduciaries |
| Fourth | DPIA framework for Significant Data Fiduciaries |
| Fifth | Forms/procedures for Data Principal rights exercise |
| Sixth | Breach notification format |
| Seventh | Criteria for Significant Data Fiduciary classification |
The final Rules (G.S.R. 846(E), November 2025) made several modifications from this draft:
1. Commencement phasing: Final Rules split into three phases (immediate/1-year/18-month) versus draft's more unified approach 2. Techno-legal measures: New defined term introduced in final Rules 3. Consent Manager timeline: Deferred to 1 year post-notification 4. Security safeguards: Rule 22 retained with 18-month implementation window 5. Board rules: Rules 17–21 brought into immediate effect
MeitY received thousands of responses from industry bodies, civil society, academia, and individuals during the 45-day consultation period. Key concerns raised:
- Compliance burden on SMBs: Consent Manager net worth requirements seen as too high - Children's data age verification: Technical feasibility concerns - Cross-border transfers: Industry sought clarity on permitted countries - Grievance timelines: Requests for more realistic resolution windows - Startup exemptions: Requests to operationalise Section 17(3) startup carve-outs
*Note: This document is based on the PIB press release and consultation documents. For the final notified Rules, refer to DPDP_Rules_2025.md.*