What are the DPDP Rules, 2025?

The Act sets out principles; the Rules supply the operational detail. The Digital Personal Data Protection Rules were notified on 13 November 2025 and cover matters the Act left to be prescribed, including the form and content of the notice given to individuals, how Consent Managers must be registered and operate, security safeguards expected of organisations, breach notification procedure, retention limits for certain classes of business, and the functioning of the Data Protection Board. In practice, an organisation needs to read the Act and the Rules together.