DPDP Rules - Operationalisation

The DPDP Rules provide the procedural and substantive framework for implementing the Digital Personal Data Protection Act, 2023. Explore each Rule in detail.

3 min read
Overview of DPDP Rules, 2025
Notification, structure, phased commencement, and correlation with the parent Act.
Privacy Notice Requirements (R.3)
Independent, itemised notices with consent withdrawal links.
Consent Manager Registration (R.4-5)
Registration framework, seven obligations, and interoperability requirements.
Security Safeguards (R.6)
Encryption, masking, tokenisation, access controls, and 1-year log retention.
Breach Notification (R.7)
Two-tier framework - preliminary notice and 72-hour detailed report.
Data Retention Thresholds (R.8)
3-year inactivity threshold for platforms, 48-hour erasure notice.
Children's Data Processing (R.9-12)
Parental consent verification, age gates, and five exempt categories.
SDF Obligations (R.13)
DPO appointment, DPIA, independent audit, and algorithmic monitoring.
Grievance Redressal (R.14)
Web-based mechanism, 90-day resolution timeline, and Board escalation.
Cross-Border Transfer (R.15)
Committee mechanism, evaluation factors, and scope covering processors.
Research Exemption (R.16)
Conditions for research, archival, and statistical processing.
Board Procedures (R.17-21)
Composition, powers, inquiry procedures, and appeal mechanisms.

Explore More

Disclaimer: The information on this page is for educational purposes only and does not constitute legal advice or solicitation.