DPDPA Academy · Rules guide
DPDP Rules 2025: a practical learning guide
Learn what the final DPDP Rules cover, how their phased commencement works, and what to prepare for notices, security, breaches, children's data and individual rights.
Who this guide is for
Privacy owners, developers, legal teams and students who already know the basic DPDP roles and want to connect the Act to operational requirements. This is a reading guide; it has no separate certificate or assessment.
New to DPDP? Start with the fundamentals courseUnderstand the phased timeline
- 13 November 2025: the initial institutional provisions and Rules 1, 2 and 17–21 commence.
- 13 November 2026: the one-year phase covers Consent Manager registration provisions and Rule 4.
- 13 May 2027: the eighteen-month phase brings the main processing obligations, individual rights and remaining operational Rules into effect.
Read the Act commencement notification together with Rule 1 and the December 2025 corrigendum. The timeline is not permission to ignore laws or sector requirements already in force.
1. Clear notices and usable choices
Rule 3 describes standalone, understandable notices with itemised data and purposes and routes for withdrawal, rights and complaints. Review collection screens alongside the processing they actually initiate.
Privacy notices2. Security and retention
Rule 6 addresses reasonable safeguards, including protection of data, access controls, monitoring, continuity and processor arrangements. Rule 8 contains erasure and retention requirements whose application depends on the relevant data and circumstances.
Security safeguards3. Breach communication
Under Rule 7, initial information goes to affected individuals and the Board without delay. Additional Board details are due within 72 hours of awareness unless an extension is permitted. The independent CERT-In reporting regime must also be assessed.
Dual-clock incident response4. Children and parental verification
Rule 10 addresses verification of an identifiable adult parent through reliable information or permitted tokens. Rules 11 and 12 address other representative and exemption situations. Do not assume a universal Aadhaar requirement or a blanket education-sector exemption.
Parental consent5. SDF governance
Rule 13 adds requirements for notified Significant Data Fiduciaries, including a twelve-month DPIA and audit cycle, algorithmic due diligence and specified transfer restrictions. Confirm designation before describing these as duties for your organisation.
Significant Data Fiduciaries6. Rights and grievances
Rule 14 covers processes for exercising rights. The published grievance-response period must not exceed 90 days; this is not a universal deadline for every access, correction or erasure request.
Request and grievance timelinesPut the reading into practice
Pick one customer journey. Identify its data, purpose, processing ground, suppliers, retention, notice and rights route. Assign owners to any gaps, then test a withdrawal or correction request through all connected systems.
Continue to the practitioner courseOfficial sources and editorial review
Prepared by DPDPA Shield. Explanations are plain-language summaries; the cited legislation controls. Last reviewed .