DPDP Rules 2025: The Operational Compliance Guide for Indian Enterprises

The Rules That Operationalise the Act

The Digital Personal Data Protection Rules 2025 were notified by the Ministry of Electronics and Information Technology on 13 November 2025, 26 months after the parent Act received Presidential assent. They transform the DPDP Act 2023's principles into specific operational requirements — prescribing formats, timelines, technical safeguards, and procedures that every Data Fiduciary must implement.

The distinction matters practically: the Act defines what must be done. The Rules define how it must be done, and by when. For Indian enterprises — especially BFSI organisations already navigating RBI, SEBI, IRDAI, and CERT-In mandates — the Rules represent a concrete compliance workload that cannot be deferred to the enforcement deadline.

The Five Operational Obligation Areas

1. Breach Notification — 72-Hour Requirement

The Rules prescribe a specific format and a hard 72-hour notification window. The clock starts from the moment the enterprise becomes aware of the breach — not when internal investigation concludes, not when root cause is confirmed. For regulated BFSI entities already managing CERT-In's 6-hour reporting obligation, DPDP adds a second, parallel reporting track to the Data Protection Board.

The notification to the Board must include the nature of the breach, categories of personal data affected, approximate number of Data Principals affected, likely consequences, and measures taken or proposed. The 72-hour window is hard — no grace period, no extensions for ongoing investigations.

After 72 hours, affected Data Principals must also be notified in plain language they can understand. For large-scale breaches, public notice may substitute individual notification.

2. Notice Requirements — Plain Language, 22 Languages

Before or at the point of collecting personal data, Data Fiduciaries must provide a notice containing: the personal data proposed to be collected, the purpose of processing, how Data Principals may exercise their rights, how complaints may be made to the Board, and contact details of the Grievance Officer.

The Rules require notice in English as mandatory. Optionally, it may also be provided in any of the 22 Scheduled languages under the Eighth Schedule of the Constitution. For BFSI organisations with rural or non-metro customer bases — co-operative banks, rural NBFCs, regional insurance intermediaries — this creates an operational obligation to maintain multi-language notice infrastructure.

Critically, the notice must be available before consent is obtained, not buried in terms and conditions. This requires reviewing every customer onboarding flow, mobile app, website form, and branch process.

3. Consent Manager Framework

The Rules establish a Consent Manager registration process with the Data Protection Board, with the framework becoming operational by November 13, 2026 (12 months from notification). Consent Managers are registered intermediaries that maintain verifiable consent records on behalf of Data Principals.

Enterprises that process data through Consent Managers must: integrate with DPB-registered Consent Managers, maintain verifiable consent artefacts for every processing activity, and produce consent evidence on demand for Board investigations. Enterprises maintaining equivalent internal consent record systems must implement the same standard of auditability.

For BFSI, this is significant. Many banks and NBFCs currently maintain consent via physical forms, e-NACH mandates, or click-wrap agreements. These must be mapped to the Consent Manager framework or an equivalent auditable system before November 2026.

4. Significant Data Fiduciary (SDF) Obligations

Entities designated as Significant Data Fiduciaries by MeitY face additional obligations. While the designation criteria are pending publication, the Rules prescribe what SDFs must do once designated:

• Annual DPIA — Data Protection Impact Assessment completed and submitted to the Board every year
• Independent Data Audit — by an independent auditor, annually
• DPO Appointment — registered with the Board, India-resident
• Algorithmic Impact Assessments — for automated processing systems that profile Data Principals

5. Children's Data Processing

The Rules operationalise the Act's children's data provisions with operational specificity. Verifiable parental consent must be obtained before processing any child's (under 18) personal data. "Verifiable" means the method must reliably confirm the consent-giver is the parent or guardian — not merely a checkbox.

Additionally: no targeted advertising to children, no tracking or behavioural monitoring of children, no processing that could harm a child's well-being. For financial services offering student loans, children's savings accounts, or family products, this requires a complete review of data flows for minor account holders.

Penalty Framework — What's at Stake

The DPDP Act's penalty schedule under the First Schedule sets out maximum penalties by violation category. These are ceiling figures — the Data Protection Board determines actual penalties considering factors including severity, number of individuals affected, the fiduciary's compliance history, and remediation efforts.

Compliance Timeline — Full Obligation Schedule

What Enterprises Should Be Doing Right Now

Typical enterprise DPDP compliance programmes require 9–12 months to complete gap assessment, implement controls, and achieve audit readiness. With the May 2027 enforcement deadline firm, organisations beginning compliance work in late 2026 will face execution risk. The work to be done in 2026 specifically is the planning, design, and procurement phase that enables May 2027 compliance.