- Policy, consent & trust
- Practitioner
- Compliance
- Business owners
DPDP Rules 2025
Also called: DPDP Rules · Digital Personal Data Protection Rules, 2025 · DPDP Rules notification
India's DPDP Rules, 2025, which set out notices, consent-manager registration, breach reporting and retention, and phase most duties in by 2027.
Reviewed
What is the DPDP Rules 2025?
The Digital Personal Data Protection Rules, 2025 (DPDP Rules 2025) are the rules the Ministry of Electronics and Information Technology made under the DPDP Act, 2023. Notified on 13 November 2025 as G.S.R. 846(E), they turn the Act's principles into procedure: what a consent notice must say, how consent managers register, what reasonable security safeguards include, how a personal-data breach is reported, when data must be erased and how the Data Protection Board of India works.
Their most important feature for planning is phased commencement. The rules that set up the Board took effect on notification. The consent-manager rules take effect after 12 months, on 13 November 2026. The bulk of the obligations on data fiduciaries (notices, security safeguards, breach intimation, retention and erasure, children's data and the rights process) take effect after 18 months, on 13 May 2027. A proposal reported in early 2026 to shorten the timeline for some fiduciaries had not been confirmed as notified when this page was reviewed, so plan on most obligations phasing in by 2027 and check the gazette for amendments.
For a business on WhatsApp the Rules answer questions the Act leaves open. The notice must make sense on its own, itemise the personal data and the specific purposes, and give a way to withdraw consent and to complain to the Board. Security safeguards cover encryption, masking or tokenisation, access control, logging and monitoring (with logs kept for at least a year), backups and contracts that bind processors such as a BSP. A breach is intimated to every affected person and to the Board, describing what happened, the likely consequences and what is being done.
The Rules are not the Act. The DPDP Act sets the duties, rights and penalty caps; the Rules supply the mechanics and the dates. Read them together: a duty in the Act generally becomes enforceable when the matching rule commences.
Key takeaways
- The DPDP Rules 2025 are the operational rules under India's DPDP Act, notified on 13 November 2025 as G.S.R. 846(E).
- They phase in: Board rules at once, consent-manager rules after 12 months and most fiduciary duties after 18 months, on 13 May 2027.
- They set what a consent notice must contain, how breaches are reported, what security safeguards look like and when data must be erased.
- Listed large e-commerce, gaming and social media platforms must erase data after three years of inactivity, warning users 48 hours first.
Interactive stop
How long until the DPDP duties apply?
Time since it opened
655.2d
655.2d in: window closed. Most data-fiduciary duties in force.
The DPDP Rules 2025: key facts and limits
- Notified
- 13 November 2025, G.S.R. 846(E)
- Board rules
- In force on notification
- Consent-manager rules
- From 13 November 2026 (12 months)
- Most fiduciary duties
- From 13 May 2027 (18 months)
- Inactive-user erasure
- 3 years for listed large platforms, 48 hours' warning
- Security logs
- Kept for at least one year
- Grievances
- Answered within 90 days at most
How does the DPDP Rules 2025 work?
Inventory what you collect on WhatsApp
List numbers, names, chat logs, media, consent records and campaign data, where each copy lives (BSP, servers, CRM, backups) and the purpose each serves.
Rewrite the notice for Rule 3
Make it standalone and plain, itemise the data and purposes, and add links to withdraw consent and to complain to the Board. Show it in the opt-in flow itself, not only in a privacy policy.
Put Rule 6 safeguards in place
Encrypt or mask stored chats and contacts, restrict access, keep logs to detect unauthorised access for at least a year, and bind your BSP and other processors by contract.
Rehearse breach intimation under Rule 7
Decide who tells affected customers and who reports to the Board, what each message contains, and how your processors alert you. Run the drill before you need it.
Set erasure timers under Rule 8
Erase data once its purpose is served. If you are a listed large platform, erase after three years of inactivity and warn the user 48 hours before.
Prepare for consent managers (Rule 4)
From 13 November 2026, people may give and withdraw consent through consent managers registered with the Board. Make sure a withdrawal arriving that way stops your WhatsApp sends too.
Why does the DPDP Rules 2025 matter?
The Rules are where the DPDP Act stops being a principle and becomes a project with deadlines. Notices have to be rewritten, opt-in flows rebuilt, breach drills rehearsed, retention timers coded and processor contracts updated, and for a business with lakhs of WhatsApp contacts each of those takes months. Knowing which rule bites when lets a team sequence the work instead of discovering in April 2027 that its consent records cannot prove anything.
Example: A Hyderabad test-prep company's 18-month plan
A Hyderabad test-prep company with lakhs of WhatsApp-subscribed students splits its DPDP work by rule. In the first quarter it rewrites the opt-in notice and moves it into the WhatsApp welcome message, with separate consent for course offers. Next it adds verifiable parental consent for learners under 18, because the children's rules apply to most of its audience. Then come a nightly job that erases cold leads once their purpose has ended and a quarterly breach drill in which the security lead drafts the Board intimation while support prepares the customer message. By March 2027 every item is tested, two months before most duties apply.
Common mistakes with the DPDP Rules 2025
Treating 13 May 2027 as the start date
It is the date duties become enforceable, not the date to begin. Notices, consent capture and erasure jobs take months to build and test; start with the notice and consent record.
Burying the notice in the privacy policy
The Rules want a notice a person can understand on its own, at the point of asking. Put a short, itemised notice in the form or WhatsApp opt-in message and link to the full policy.
Deleting logs along with the data
Erasing everything once a purpose ends can break the Rules' log-retention minimum and other laws on invoices and KYC. Write separate periods for each category in a retention schedule.
Leaving processors out of the breach plan
Your BSP or CRM may be the first to see a breach. Require them by contract to tell you quickly enough for you to inform customers and the Board.
Best practices for the DPDP Rules 2025
- Track each obligation against the rule and commencement date that brings it into force.
- Version every notice and store the version with each consent.
- Make withdrawals from any channel (STOP reply, button, consent manager) update one record.
- Re-read the gazette before each deadline; amendments can move dates.
DPDP Rules 2025 FAQs
When do the DPDP Rules come into force?+
What do the DPDP Rules say about breach reporting?+
Do the DPDP Rules set a data retention period?+
Do I need to use a consent manager?+
Talk to InfiQ
From definition to your first message
InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.