# DPDP Rules 2025: what is still not notified

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/what-is-still-missing-even-with-the-rules/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## What is still missing even with the Rules

- **No SDF has been notified** by class or by name under Act s.10(1) as at the last verification.
  Until that notification exists, no company is legally an SDF, and Rule 13 binds nobody.
- **No country has been notified** as restricted under Act s.16(1).
- **No startup relief** notified under Act s.17(3).
- **No State instrumentality** exempted under Act s.17(2)(a) by public notification.
- **No s.9(5) verifiably-safe age** notified for any Data Fiduciary.
- The **Rule 13(4) committee** and its list of localised data categories.
- **"Significant" in s.33(1) remains undefined**, and there is no Board jurisprudence, so penalty
  exposure cannot be modelled from precedent.

Always state which of these are still open when giving a client a risk picture. The honest answer
to "what is my exposure" in the current posture is that the ceilings are known, the triggers are
known, and the enforcement practice is entirely unknown.