Ministry of Electronics &
Information Technology
C-DAC

Resources

The rules

Explore the key requirements of the DPDP framework in one place, with the provisions relevant to data protection and compliance.

All resources

Rule 1

Short Title & Commencement

Establishes the official citation as the Digital Personal Data Protection Rules and establishes the statutory phased commencement framework.

  • Official Title: Legally designated as the DPDP Rules across all Indian Union territories.
  • Phased Staggering: Provides distinct enforcement notification windows across 3 phases.
  • Institutional Priority: DPBI formation rules take force on Day 1; enterprise rules stagger up to 18 months.

Rule 2

Definitions & Interpretations

Sets formal operational and technical definitions for terms governing cross-platform consent, identity assurance, and electronic proceedings.

  • Interoperability Rails: Technical standards governing machine-readable consent exchanges.
  • Verifiable Guardian: Legally recognized parental or court-appointed guardian credentials.
  • Digital Office: Techno-legal framework for virtual filings, electronic hearings, and digital orders.

Rule 3

Itemized Notice Requirements

Prescribes mandatory structural standards for standalone, itemized privacy notices provided to Data Principals prior to consent capture.

  • Granular Itemization: Explicitly list exact data fields collected matched to specific processing purposes.
  • Multilingual Access: Available in English and all 22 languages specified in the Eighth Schedule.
  • Mandatory Channels: Direct embedded links for consent withdrawal and DPBI complaint escalation.

Rule 4

Consent Manager Registration & Duties

Governs the technical accreditation, registration criteria, and fiduciary obligations of interoperable Consent Managers under Schedule I.

  • Registration Criteria: Stringent net-worth thresholds, robust infrastructure, and clean promoter track record.
  • Data Firewall: Strictly prohibited from storing, accessing, or monetizing transaction data payloads.
  • Interoperability Rails: Must support open APIs for unified cross-platform consent revocation.

Rule 5

State Processing for Subsidies & Benefits

Regulates personal data processing by government instrumentalities for delivering state subsidies, welfare benefits, licenses, and certificates.

  • Targeted Delivery: Processing restricted strictly to verifying statutory welfare eligibility.
  • Database Isolation: Prohibits unapproved secondary pooling across non-related state departments.
  • Audit Governance: Enforces mandatory access logging and departmental data protection reviews.

Rule 6

Reasonable Security Safeguards

Mandates baseline technical, physical, and operational security controls to proactively safeguard personal data against unauthorized exposure.

  • Cryptographic Controls: Enforces AES-256 encryption at rest, TLS 1.3 in transit, and tokenization.
  • Access Governance: Role-Based Access Control (RBAC), multi-factor authentication, and zero trust.
  • Log Preservation: Mandatory retention of immutable processing and access logs for minimum 1 year.

Rule 7

Intimation of Personal Data Breach

Prescribes dual-track notification protocols, mandatory timelines, and content schemas under Schedule III upon discovering a security breach.

  • User Notification: Direct notification to affected users detailing breach scope and safety measures.
  • 72-Hour DPBI Report: Comprehensive technical dossier submitted to the Board within 72 hours.
  • RCA Submission: Detailed root-cause analysis, blast radius metrics, and remediation posture.

Rule 8

Storage Limitation & Purpose Expiry

Defines the exact operational conditions under which processing purposes are deemed expired, mandating hard data erasure.

  • 3-Year Inactivity Trigger: Commercial platforms must hard-purge data after 3 years of continuous user dormancy.
  • 48-Hour Pre-Notice: Mandatory advance notification to the user 48 hours prior to automated hard deletion.
  • Downstream Erasure: Fiduciaries must push cascading cryptographic deletion webhooks to processors.

Rule 9

Grievance Redressal Mechanism

Establishes transparent contact access, publishing standards, and strict resolution SLAs for Fiduciary Grievance Redressal Officers.

  • Published Credentials: Prominently display name, designation, email, and physical office address.
  • 90-Day Maximum SLA: Mandatory resolution of all consumer complaints within a strict 90-day window.
  • Statutory Prerequisite: Users must exhaust internal grievance redressal before escalating to DPBI.

Rule 10

Verifiable Parental Consent (Children)

Mandates reliable age verification mechanisms and verifiable parental consent before onboarding or processing data of minors (<18 years).

  • Age Assurance: Technical verification using DigiLocker, government ID tokens, or facial age estimation.
  • Guardian Verification: Verifiable electronic token linking minor identity with authorized parent/guardian.
  • Strict Bans: Zero behavioural tracking, targeted advertisements, or harm-inducing profiling of minors.

Rule 11

Consent for Persons with Disabilities

Prescribes mechanisms for obtaining verifiable consent from lawful legal guardians for persons with disabilities under applicable guardianship statutes.

  • Legal Guardianship: Verification of guardianship certificates issued under Rights of Persons with Disabilities Act.
  • Accessible Interfaces: Notice and consent interfaces complying with WCAG 2.1 AA accessibility standards.
  • Fiduciary Duty: Ensure data processing strictly upholds the welfare and autonomy of the individual.

Rule 12

Exemptions for Children's Data Processing

Defines specific operational sectors and institutional classes exempt from standard parental consent mandates under Schedule IV.

  • Healthcare Services: Pediatric healthcare, emergency medical intervention, and patient records.
  • Educational Institutions: School admissions, academic tracking, and certified examination boards.
  • Safety Infrastructure: Child transport tracking, school bus GPS systems, and emergency safety apps.

Rule 13

Significant Data Fiduciary (SDF) Mandates

Imposes heightened corporate governance duties, executive appointments, and mandatory risk assessments on entities designated as SDFs.

  • Resident DPO: Appoint India-based DPO reporting directly to the Board of Directors.
  • Periodic DPIAs: Formal Data Protection Impact Assessments prior to deploying high-risk tech.
  • Independent Data Audits: Mandatory annual third-party audits evaluating statutory compliance.

Rule 14

Exercise of Data Principal Rights (DSR)

Establishes standardized self-service workflows, authentication standards, and response turnaround SLAs for handling statutory user rights.

  • Right to Access: Provide comprehensive summary of personal data and list of third-party processors.
  • Correction & Erasure: Seamless workflows to update inaccurate records or execute data deletion.
  • Digital Nomination: Enable users to designate a nominee in the event of death or incapacity.

Rule 15

Cross-Border Data Transfers

Operationalizes the cross-border transfer regime, governing data flows to foreign jurisdictions subject to negative lists and sectoral mandates.

  • Negative List Model: Transfers permissible globally unless foreign nation is explicitly blacklisted.
  • Government Restriction Power: MeitY retains authority to ban transfers to hostile foreign territories.
  • Sectoral Precedence: Stricter sectoral localization norms (e.g., RBI payment storage) prevail.

Rule 16

Research, Archiving & Statistical Processing

Prescribes technical safeguards and exemption conditions for personal data processed exclusively for research, archiving, and statistical analysis.

  • No Individual Decisions: Data must never be used to make individual decisions or profiling.
  • Pseudonymization Mandate: Enforces data de-identification, anonymization, and statistical aggregation.
  • Security Baselines: Research databases remain subject to Rule 6 baseline encryption and audit logs.

Rule 17

Search-cum-Selection Committee (DPBI)

Establishes the high-level statutory selection committee responsible for recommending appointments of the DPBI Chairperson and Members.

  • Committee Composition: Cabinet Secretary (Chair), MeitY Secretary, Law Secretary, and domain experts.
  • Eligibility Standards: Minimum 10+ years expertise in data privacy, cybersecurity, law, or tech.
  • Integrity Screening: Rigorous conflict of interest vetting before finalizing government panel nominations.

Rule 18

Terms, Conditions & Salaries of Members

Prescribes the tenure, remuneration, allowances, and statutory conditions of service for the Board's Chairperson and Members under Schedule V.

  • Tenure & Reappointment: Fixed 3-year term with statutory eligibility for one reappointment.
  • Salary Benchmarking: Remuneration aligned with Secretary / Additional Secretary to Govt of India.
  • Post-Tenure Restriction: Cooling-off period restricting employment with commercial Data Fiduciaries.

Rule 19

Procedure for Transaction of Business

Governs the internal quorum requirements, decision-making protocols, and formal authentication of DPBI directions, summons, and orders.

  • Quorum & Benches: Defines minimum quorum requirements for Benches and plenary Board sessions.
  • Majority Voting: Decisions determined by majority vote; Chairperson holds casting vote in ties.
  • Order Authentication: Orders authenticated via cryptographic digital signatures of authorized officers.

Rule 20

"Digital Office" Architecture & Operations

Mandates the DPBI to operate exclusively as a paperless, virtual techno-legal regulatory authority using automated digital systems.

  • End-to-End e-Filing: Online portal for submitting breach intimations, complaints, and evidence.
  • Virtual Hearings: Standardized audio-visual hearings eliminating geographic barriers for litigants.
  • Digital Order Portal: Cryptographically signed orders, summons, and directions published directly online.

Rule 21

Officers & Employees of the Board

Governs the organizational cadre structure, technical staffing, and service conditions for administrative and techno-legal officers of DPBI.

  • Techno-Legal Staffing: Direct recruitment of data analysts, cybersecurity experts, and legal counsels.
  • Deputation Cadres: Officers on deputation from central ministries, CERT-In, and regulatory bodies.
  • Code of Conduct: Strict confidentiality agreements and conflict of interest disclosures for all personnel.

Rule 22

Procedure for Filing Appeals (TDSAT)

Regulates the statutory appellate procedures, filing fees, and procedural rules for challenging DPBI orders before the Appellate Tribunal (TDSAT).

  • 60-Day Limitation: Appeals must be lodged within 60 days from the receipt of the Board's final order.
  • Digital Appellate Filing: Electronic memo of appeal, certified digital orders, and evidentiary annexures.
  • Appellate Powers: Power to confirm, modify, reduce penalties, or set aside Board determinations.

Rule 23

Power to Call for Information

Empowers the Central Government and Board to compel Data Fiduciaries to furnish information, processing logs, and governance records.

  • Statutory Inquiries: Mandatory submission of compliance manuals, DPIA reports, and audit certificates.
  • Intermediary Demands: Intermediaries must furnish requested logs within stipulated deadlines.
  • Non-Compliance Penalty: Obstructing or failing to furnish information triggers independent penalty action.

Schedules

Statutory Schedules Framework

Six operational schedules establishing standardized templates, technical standards, and institutional frameworks across the DPDP Rules.

  • Schedule I & II: Consent Manager Registration criteria & Itemized Notice format.
  • Schedule III & IV: 72-Hour Breach Notification schema & Minor processing exemptions.
  • Schedule V & VI: DPBI Search Committee/Service Terms & Digital Office security standards.