Current development ·
Digital Personal Data Protection Rules, 2025
MeitY notified the DPDP Rules on 13 November 2025, operationalising the 2023 Act in three phases over 18 months and constituting the Data Protection Board of India.
What changed
On 13 November 2025 the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 under the DPDP Act, 2023, together with commencement notifications and the constitution of the Data Protection Board of India.
Implementation is phased. Provisions on definitions and the Board took effect immediately, along with the Act's amendment to the RTI Act's exemption for personal information. Registration of consent managers follows after one year. The core obligations of data fiduciaries, such as notice, consent, breach reporting and children's data, apply after 18 months.
Foundation connections
See prevention, coordination and safeguards for data protection as part of cyber governance, and right to information for the debate on the RTI amendment.
Exam use and limits
- Prelims: Data principal, data fiduciary, consent manager and the Data Protection Board are defined terms.
- Mains: Balance privacy (Puttaswamy, 2017) with transparency under RTI and the compliance burden on small entities.
Source: AZB & Partners, summary of the 13 November 2025 notifications