Published: 14 November 2025MeitYGeneral
Government Notifies Digital Personal Data Protection (DPDP) Rules 2025
The Ministry of Electronics and Information Technology (MeitY) officially notified the Digital Personal Data Protection (DPDP) Rules 2025 on November 13, 2025, implementing the DPDP Act 2023. The rules mandate data breach notification within 72 hours and data erasure notice 48 hours prior.
The rules are phased: Rules 1, 2, 17-21 take effect immediately; Rule 4 from November 2026; and Rules 3, 5-16, 22-23 from May 2027. A Data Protection Board with a Chairperson and 3 members will be constituted. The rules establish operational procedures for personal data processing, consent mechanisms, safeguards, and compliance timelines, marking a landmark step in India's data governance.
0Mains angle
Q: Evaluate the operational framework and phased rollout introduced by the Digital Personal Data Protection Rules 2025 for India's data governance.
Answer (50 words):
MeitY notified the Digital Personal Data Protection Rules 2025 on November 13, 2025, operationalising the DPDP Act 2023. The rules mandate breach notification within 72 hours and erasure notice 48 hours prior, and are phased: Rules 1, 2, 17-21 immediately; Rule 4 from November 2026; Rules 3, 5-16, 22-23 from May 2027.
6-axis classification
CoverageNationalSubjectScience & TechnologyExamBasic Computer Instructor · CET Graduation · CET Senior Secondary · EO/RO · LDC · Mahila Supervisor · Patwar · PTI · RAS · REET · RPSC SI · School Lecturer · Senior Computer Instructor · Senior Teacher · UPSC · Vanpal · BothSourceMeitY
Practice MCQ from this story
SolveTap an option below. Correct or incorrect feedback appears instantly.
Linked questionMedium
The DPDP Rules 2025 establish a Data Protection Board consisting of a Chairperson and how many members?
Explanation · Correct answer AMeitY's 2026 notice for filling statutory offices in the Data Protection Board states that the Board consists of a Chairperson and four other Members. Therefore, the correct answer is 4 members.
Frequently asked questions
Which ministry notified the DPDP Rules 2025 and on what date?
The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection (DPDP) Rules 2025 on November 13, 2025, implementing the DPDP Act 2023.
What notification timelines do the DPDP Rules 2025 mandate?
The rules mandate data breach notification within 72 hours and data erasure notice 48 hours prior.
How are the DPDP Rules 2025 phased for implementation?
Rules 1, 2, and 17-21 take effect immediately; Rule 4 applies from November 2026; and Rules 3, 5-16, and 22-23 apply from May 2027.
What institutional and procedural changes do the rules provide for?
A Data Protection Board with a Chairperson and 3 members will be constituted. The rules establish operational procedures for personal data processing, consent mechanisms, safeguards, and compliance timelines.
