India's Digital Personal Data Protection (DPDP) Rules, 2025, notified in November 2025, bring the DPDP Act, 2023, into full operation, creating a detailed framework for data protection focused on citizen rights (Data Principals) and responsible data use by companies (Data Fiduciaries). Key aspects include clear consent mechanisms, mandatory parental consent for children's data, robust breach reporting, penalties for non-compliance (up to ₹250 crore), and the establishment of a Data Protection Board, with phased implementation rolling out key rules until May 2027.

Key Highlights of the DPDP Rules, 2025:

• Operationalizes the Act: The Rules provide practical guidance for the Act's implementation, defining how data fiduciaries must handle personal data.
• Citizen-Centric: Puts citizens (Data Principals) in control, giving them rights over their data, with the goal of building trust.
• Consent Management: Mandates clear, verifiable consent for data processing, with specific rules for children, requiring parental consent.
• Data Protection Board (DPB): Establishes a body to oversee compliance, with specific timelines for its functioning.
• Breach Reporting: Requires timely notification to the DPB and affected individuals for data breaches.
• Significant Data Fiduciaries (SDFs): Imposes stricter obligations on large entities.
• Penalties: Significant fines for violations, including up to ₹250 crore for security safeguard failures and up to ₹200 crore for issues with children's data or breach notices.
• Phased Compliance: Full enforcement, including most obligations for fiduciaries, is expected by May 2027.
   

Click the icon for more details-