The DPDP Rules (”the Rules”) were notified on 13.11.2025 to operationalize several provisions of the DPDPA 2023. The Central Government has opted for a staggered, three-stage approach to implement the Act and the Rules over a period of 18 months.

Stage 1: Provisions for establishing and governing the Data Protection Board of India (”DPB” or “the Board”), the main enforcement body, and rules for appointing its members came into effect immediately on November 14, 2025.

Stage 2: Rules for the registration and functioning of Consent Managers will be effective after 12 months, allowing time for infrastructure development.

Stage 3: The majority of compliance requirements for Data Fiduciaries, including privacy notices, consent, data security, processing children's data, data retention, deletion policies, and cross-border data transfers (except to restricted countries), will be fully enforceable after 18 months.

Legislative Context (Rule 1)

The DPDP Act, 2023 lays down substantive obligations for Data Fiduciaries, Data Principals, Consent Managers, and the Data Protection Board of India. The DPDP Rules, 2025 operationalize the Act by clarifying:

• how notices must be issued,
• how consent is verified,
• how breaches are handled,
• how data retention is managed,
• what systems must be published for grievance resolution,
• obligations of Significant Data Fiduciaries,
• the functioning of the Board, and
• procedural requirements for appeals and enforcement.

The Rules focus heavily on standardisation, verification, traceability, and ensuring minimal friction for the Data Principal.