Digital Personal Data Protection Rules, 2025. Notified 13 November 2025. Verify against the notified Gazette text before external use.
No SDF has been notified by class or by name under Act s.10(1) as at the last verification.
Until that notification exists, no company is legally an SDF, and Rule 13 binds nobody.
No country has been notified as restricted under Act s.16(1).
No State instrumentality exempted under Act s.17(2)(a) by public notification.
No s.9(5) verifiably-safe age notified for any Data Fiduciary.
The Rule 13(4) committee and its list of localised data categories.
"Significant" in s.33(1) remains undefined, and there is no Board jurisprudence, so penalty
exposure cannot be modelled from precedent.
Always state which of these are still open when giving a client a risk picture. The honest answer
to "what is my exposure" in the current posture is that the ceilings are known, the triggers are
known, and the enforcement practice is entirely unknown.