The Act set the duties. The Rules say how, and from when.

Read the Act closely and a pattern appears. It tells a Data Fiduciary (the business that decides why and how personal data is used) to give notice, report breaches and erase data, but it often stops short of saying in what form, within how long, or for whom. Section 40 lets the Central Government fill those gaps by rules. The draft was published for comment on 3 January 2025; the final text followed in November 2025 as G.S.R. 846(E).

Form and content

What a notice must contain and what a breach intimation must say.

Periods

When unused data counts as no longer needed, how long logs are kept, and the ceiling on grievance replies.

Gatekeeping

Who may register as a consent manager, and how a parent's identity is checked.

Extra duties

The yearly assessment and audit for significant data fiduciaries.

Machinery

How the Data Protection Board of India (the Board) meets, decides and hears appeals.

Rule 1 counts every stage from the date the Rules were published in the Gazette. The notification is dated 13 November 2025. Only that first date is printed in the text; the later two are periods, so the calendar dates below are our own arithmetic and are marked as such.

The Act has its own commencement notifications under section 1(2), separate from the Rules. Check which sections of the Act are in force on the day you rely on them, not only which rules.

Rule 3: the notice

• Readable on its own. It cannot lean on a privacy policy or terms elsewhere to make sense.
• Itemised. It lists the personal data item by item, not as broad categories.
• Purpose tied to a service. Each purpose is named with the goods, service or use it enables.
• A way out. It gives the link or means to withdraw consent as easily as it was given.
• Rights and complaint. It explains how to exercise rights and how to complain to the Board.

Rule 4: consent managers

A consent manager is a platform through which a person gives, reviews and withdraws consent across many businesses. The First Schedule sets the bar to register: a company incorporated in India, net worth of at least two crore rupees, sound management, and an independent certification that its platform meets standards the Board will publish. Once registered, it must not be able to read the data it routes, must keep a record of consents for at least seven years, may not subcontract its duties, and must manage conflicts of interest with the businesses on its platform.

• Rule 6 lists minimum security safeguards, including keeping logs for one year. The safeguards page maps them to controls.
• Rule 8 names three classes (large e-commerce, online gaming and social media platforms) whose dormant users' data must be erased after three years without contact, with a 48-hour warning first.
• Rule 8(3) sets a floor: data, traffic data and logs of processing are kept for at least one year for listed state purposes, then erased unless another law says otherwise.
• Rule 9 makes the contact for privacy questions prominent on the website or app, and in every reply to a rights request.

Rule 10 · Verifiable parental consent

Before touching a child's data, check the person consenting is an identifiable adult (18 or over), using identity details already held or a virtual token from an authorised issuer, such as one available through a digital locker.

Rule 11 · Lawful guardians

For a person with disability, confirm the guardian was appointed by a court, designated authority or local level committee.

Rule 12 · Exemptions

The Fourth Schedule lifts the consent and tracking limits for named cases: health care, schools, crèches and school transport, plus purposes such as real-time location for safety and blocking harmful content.

Rule 13 · Significant data fiduciaries

Once every twelve months: a data protection impact assessment and an audit, with significant observations reported to the Board; due diligence on algorithmic software; and localisation of any data a government committee specifies.

1. 1SizeA Chairperson and four other Members, per MeitY's 2026 call for applications.
2. 2Quorum and votesOne-third of members make a quorum; majority decides; the chair holds a casting vote.
3. 3Urgent actionThe chair may act alone in an emergency, telling members within seven days and seeking ratification.
4. 4Inquiry clockAn inquiry should finish within six months, extendable by up to three months at a time, with reasons recorded.
5. 5Digital officeProceedings may run without anyone attending in person.
6. 6AppealsTo the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), filed digitally, within sixty days under the Act.

• Which businesses are significant data fiduciaries. Section 10 needs a notification naming them or their class.
• Any transfer restrictions under rule 15, which applies only to whatever the government specifies by order.
• The list of data that must stay in India under rule 13(4), which depends on a committee's recommendation.
• The standards and assurance framework a consent manager must be certified against, which the Board is to publish.
• Any notified age above which a verifiably safe service is freed from child-specific limits, under section 9(5).

Sources: the Digital Personal Data Protection Act, 2023 (sections 1, 5, 6, 8, 9, 10, 13, 29 and 40); the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), rules 1 to 23 and the First, Third, Fourth and Seventh Schedules; the MeitY notice inviting applications for the Board, 2026; the PIB backgrounder on the Rules, November 2025.