The Ministry of Electronics and Information Technology on Thursday (November 13) formally issued the Digital Personal Data Protection Rules, 2025, under the Digital Personal Data Protection Act, 2023, marking a major advancement in India’s privacy and data governance framework.

The notification follows the public consultation held in January 2025, where stakeholders submitted feedback on the draft rules.

Under the Rules, Data Fiduciaries are required to implement suitable technical and organisational safeguards to ensure that verifiable parental consent is obtained before processing the personal data of any child. A Data Fiduciary, as defined in the Act, is any entity or individual that determines the purpose and means of processing personal data, either independently or jointly.

The Rules further provide that Significant Data Fiduciaries must conduct an annual Data Protection Impact Assessment (DPIA) and undergo an annual independent audit to verify compliance with the Act and Rules. The Central Government may designate a Data Fiduciary as ‘Significant’ depending on factors such as the volume and sensitivity of data handled and potential risks to the rights of the Data Principal—the individual to whom the data relates.

In the event of a personal data breach, Data Fiduciaries must promptly notify both the affected individuals and the Data Protection Board of India, furnishing details regarding the scale of the breach, the time of occurrence, possible implications, and recommended protective steps.

The Rules provide that the Data Protection Board of India will be established through a Search-cum-Selection Committee chaired by the Cabinet Secretary. The Board will operate as a digital-only office, and decisions at Board meetings will be taken by a majority vote of members present and voting.

The Rules also clarify that personal data processed under the Act may be transferred outside India, but such transfers shall remain subject to any restrictions or conditions imposed by the Central Government.