DPDP Rules 2025: What Changed and What Indian Businesses Must Do Now

The DPDP Act 2023 set the framework; the Digital Personal Data Protection Rules 2025 make it operational. The Rules add the procedural detail that compliance teams have been waiting for.

Clearer consent-notice expectations

The Rules expand on what a Section 5 notice must contain and how it should be presented — itemised, plain-language, and accessible. Generic privacy policies will not satisfy the standard.

Breach notification mechanics

The Rules detail how and when a Data Fiduciary must notify the Data Protection Board and affected Data Principals of a personal data breach, including the information the notification must contain. Speed and completeness matter.

Verifiable parental consent for children

Processing the data of anyone under 18 requires verifiable parental consent, and behavioural tracking or targeted advertising directed at children is restricted. The Rules describe acceptable verification approaches.

Significant Data Fiduciary obligations

Entities notified as SDFs face heightened duties — appointing a Data Protection Officer based in India, conducting periodic Data Protection Impact Assessments and independent audits, and additional due diligence.

Data Protection Board procedures

The Rules flesh out how the Board operates — complaint handling, inquiry procedures and the framework for imposing penalties of up to ₹250 crore.

What to do now

1. Re-draft your consent notices against the itemised standard.
2. Stand up a breach response runbook with defined notification timelines.
3. Add age-assurance and parental-consent flows if you serve minors.
4. Assess whether you may be designated an SDF and pre-build those controls.

A DPDPA readiness assessment is the fastest way to translate the Rules into a prioritised action plan.