# DPDP Rules 2025: Rules 5, 9, 16 and 17 to 23 in brief

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/other-rules-in-brief/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Other rules in brief

- **Rule 5 and the Second Schedule:** standards for State processing under Act s.7(b), covering
  lawful and transparent use, purpose limitation, accuracy, security, retention, accountability and
  a grievance mechanism.
- **Rule 9:** publish the **business contact information** of the DPO where applicable, or of the
  person who can answer questions about processing, **on the website or app and in every response**
  to a communication from a Data Principal exercising her rights. This is the Act s.8(9) duty made
  concrete, and it applies to **non-SDFs too**.
- **Rule 16:** the Act does not apply to processing **necessary for research, archiving or
  statistical purposes** if carried on in accordance with the **standards in the Second Schedule**.
- **Rules 17 to 21:** Board constitution, search-cum-selection process, service terms, meetings, and
  digital-office functioning. Live since 14 November 2025.
- **Rule 22:** appeals to TDSAT, filed **digitally**, with the Tribunal regulating its own procedure.
- **Rule 23 and the Seventh Schedule:** the Central Government may require a Data Fiduciary or
  intermediary to furnish information for a specified purpose, through an authorised person, with a
  confidentiality restriction where disclosure would prejudice India's sovereignty and integrity or
  security of the State.