We got tired of scrolling the Gazette every time a client asked "which section covers cross-border" or "what's the cap for a missed breach notice." So this hub exists. The Act, the 22 Rules, the four penalty caps, sector notes, and a few working calculators. Every claim links back to the primary source. Published by the same team that runs dcomply.
DPDP Rules 2025 are now law.
MeitY notified the final Digital Personal Data Protection Rules, 2025 on 13 November 2025 via Gazette Notification G.S.R. 846(E). The Rules operationalise the DPDP Act 2023 in three phases. Rules 1, 2 and 17 to 21 took effect immediately on 13 November 2025. Rule 4, which sets up Consent Manager registration, takes effect on 14 November 2026. The substantive core (Rules 3, 5 to 16, 22 and 23) takes effect on 14 May 2027, giving Data Fiduciaries 18 months to build.
MeitY has floated a proposal to shorten the 18-month clock to 12 months, which would move the last date to 13 November 2026. The proposal has not been notified. Watch the Updates feed for confirmation.
The Data Protection Board is still being constituted.
On 6 May 2026, MeitY invited applications for the Chairperson and four Members of the Data Protection Board of India. A follow-up notification issued on 6 June 2026. The Cabinet Secretary heads the search-cum-selection committee. As of August 2026, no appointments had been announced. Enforcement will begin in earnest once the Board is seated.
All 44 sections of the Digital Personal Data Protection Act 2023, enacted 11 August 2023. Cross-linked to the Rules where a section is operationalised.
Rules 2025All 22 Rules notified on 13 November 2025. Consent notice format, breach reporting, verifiable parental consent, data retention, cross-border transfer.
ScheduleThe four penalty caps set by the Schedule to the DPDP Act. Which breach triggers what fine, up to Rs. 250 crore per instance.
RegulatorComposition, powers, adjudication procedure, appeal route. Live status of Chairperson and Member appointments.
ReferenceData Fiduciary, Significant Data Fiduciary, Consent Manager, Data Principal, verifiable parental consent, defined in plain English.
TimelineFrom the Justice A.P. Shah report to Puttaswamy to the DPDP Act to Rules 2025 to full enforcement in May 2027.
The six factors the Central Government uses to designate an SDF. Who has been notified so far. What extra obligations kick in.
Sec. 9Age of consent under DPDP, verifiable parental consent, the ban on behavioural monitoring and targeted advertising to children.
Sec. 12 to 14Access, correction, erasure, grievance and nomination. Service levels. The complaint route to the Board.
Sec. 16The negative-list model. As of Sept 2026 no country has been restricted. Sectoral rules still apply on top.
Sec. 8Accuracy, security safeguards, breach notification to the Board and to affected Data Principals, retention limits.
Sec. 6Free, specific, informed, unconditional and unambiguous. Withdrawal must be as easy as giving consent. Consent Manager route under Section 2(g).
A hospital and a bank both process personal data but the risk they carry, the regulator they answer to, and the retention obligations they're already stuck with are different. So the sector page for each reads DPDP through that lens rather than restating the Act.
Banks, NBFCs, insurers. RBI overlap with Sec. 8 security safeguards.
SectorHospitals, diagnostics, telemedicine. Consent for treatment vs consent under DPDP.
SectorMarketplaces, D2C brands, quick commerce. Consent for marketing and personalisation.
SectorSmall businesses under 20 employees. What Rule 3 asks of you and where the Rules give relief.
More sectors: EdTech, SaaS, AdTech, HR & Payroll, Real Estate, Hotels & QSR, NGO, Logistics.
Estimate your penalty exposure against the four DPDP caps. Section-referenced. Save the report as PDF.
Free12 questions across consent, DSR, breach, retention and DPB reporting. Get a graded readiness scorecard.
FreeGenerates a Rule 3 compliant consent notice from your processing purposes. Bilingual output.
When were the DPDP Rules 2025 notified?
MeitY notified the final DPDP Rules 2025 via Gazette Notification G.S.R. 846(E) dated 13 November 2025, ten months after the draft was published on 3 January 2025.
When does DPDP enforcement actually begin?
Rules 1, 2 and 17 to 21 have been in force since 13 November 2025. Rule 4 (Consent Manager registration) takes effect on 14 November 2026. The substantive core (Rules 3, 5 to 16, 22 and 23) takes effect on 14 May 2027, 18 months after notification.
Is the Data Protection Board of India up and running?
Not yet. MeitY invited applications for the Chairperson and four Members on 6 May 2026. As of August 2026 no appointments had been announced. Track the current position on the Updates feed.
How high can penalties go under DPDP?
The Schedule to the DPDP Act sets four caps per breach. Rs. 250 crore for a failure to implement reasonable security safeguards. Rs. 200 crore for a failure to notify a personal data breach or for a breach of children's data obligations. Rs. 150 crore for a breach of Significant Data Fiduciary obligations. Rs. 50 crore for any other violation. A Data Principal breaching a statutory duty faces up to Rs. 10,000.
Can I transfer personal data outside India?
Yes, by default. Section 16 uses a negative-list model. The Central Government may restrict transfers to a specific country by notification. As of September 2026 no country has been so restricted. Sectoral rules (RBI, IRDAI, SEBI) still apply on top of DPDP.
See all 100 questions and answers →
