Digital Personal Data Protection Rules, 2025. Notified 13 November 2025. Verify against the notified Gazette text before external use.
Rule 5 and the Second Schedule: standards for State processing under Act s.7(b), covering
lawful and transparent use, purpose limitation, accuracy, security, retention, accountability and
a grievance mechanism.
Rule 9: publish the business contact information of the DPO where applicable, or of the
person who can answer questions about processing, on the website or app and in every response
to a communication from a Data Principal exercising her rights. This is the Act s.8(9) duty made
concrete, and it applies to non-SDFs too.
Rule 16: the Act does not apply to processing necessary for research, archiving or
statistical purposes if carried on in accordance with the standards in the Second Schedule.
Rules 17 to 21: Board constitution, search-cum-selection process, service terms, meetings, and
digital-office functioning. Live since 14 November 2025.
Rule 22: appeals to TDSAT, filed digitally, with the Tribunal regulating its own procedure.
Rule 23 and the Seventh Schedule: the Central Government may require a Data Fiduciary or
intermediary to furnish information for a specified purpose, through an authorised person, with a
confidentiality restriction where disclosure would prejudice India's sovereignty and integrity or
security of the State.