IndiaDigital Personal Data Protection Rules, 2025
G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified
In force since , under challenge in court.
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Filed with regulator
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- The Digital Personal Data Protection Rules, 2025 are only partly in force: today, only the Data Protection Board's own administrative machinery rules apply. Once fully in force (Rule 4 on , and the remaining app-facing rules, including consent-notice form, breach notification, and Significant Data Fiduciary duties, on ), an app processing Indian personal data, including a biometric identifier, must follow the notified consent-notice, security-safeguard, and breach-notification detail these Rules set.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Under challenge
- Yes
- Open questions
- Does 'any law for the time being in force' in Rule 8(1) include the one-year minimum retention that Rule 8(3) itself requires for the purposes in the Seventh Schedule, so that erasure under Rule 8(1) must wait until that year has run?
- How is the count of 'registered users' measured under the Third Schedule thresholds (for example 'not less than two crore registered users in India'), and are accounts that are held but no longer used counted?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Access record
Log retention
One year from the date of the processing under Rule 8(3), and one year under Rule 6(1)(e), unless another law requires longer. A Consent Manager's record of consents, notices and sharing is kept for at least seven years under Part B of the First Schedule.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 1
Logging duty
Rule 6(1)(c) requires reasonable security safeguards that include visibility on access to personal data through appropriate logs, monitoring and review, and Rule 6(1)(e) requires the Data Fiduciary to retain those logs and the personal data for one year, unless another law requires otherwise. Rule 8(3) requires it to retain personal data, associated traffic data and other logs of the processing for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule, and then to erase them unless another law requires further retention. Part B of the First Schedule (obligations of a Consent Manager) separately requires a Consent Manager to keep a record of consents, notices and sharing for at least seven years. The Rules carry no territorial clause of their own.
- Kind
- Explicit
- As of
- Provision
- Rules 6(1)(c) and 6(1)(e), and Rule 8(3)
- Trigger
- personal_data_processing
What this law does
The Rules implement the DPDPA's app-facing detail: consent-notice form, security safeguards, breach notification (Rule 7), children's-data verification, and Significant Data Fiduciary duties including an annual Data Protection Impact Assessment and algorithmic-fairness assessment (Rule 13).
As notified, only Rules 1, 2, and 17 to 21, the Data Protection Board's own administrative machinery (member recruitment, meeting procedure, digital-office functioning, staff appointment), are currently in force. Rule 4 (Consent Manager registration) commences ; the app-facing bulk (Rules 3, 5 to 16, 22, and 23) commences .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .