The Ministry of Electronics and Information Technology has officially notified the Digital Personal Data Protection Rules, 2025, marking a significant step toward strengthening India’s data governance and privacy framework under the Digital Personal Data Protection Act, 2023. The notification, issued on November 13, follows extensive public consultation held earlier in January, reflecting the government’s intent to create a harmonised and transparent personal data protection regime.

Also Read: Thyagaraja Bhagavathar's Grandson Moves Chennai Court Against Dulquer Salman's “Kaantha” Movie, Says It Portrays Grandfather In Bad Light

The Rules introduce a comprehensive framework requiring Data Fiduciaries to implement appropriate technical and organisational measures to ensure lawful processing of personal data, with particular emphasis on personal data belonging to children. Before processing any data relating to a child, a Data Fiduciary must obtain verifiable parental consent. A Data Fiduciary, as defined under the Act, refers to any person who, either alone or in collaboration with others, determines the purpose and means of processing personal data.

Further, the Rules impose additional compliance obligations on Significant Data Fiduciaries, a category to be notified by the Central Government based on factors such as the volume and sensitivity of data processed and the potential risk posed to the rights of Data Principals. Significant Data Fiduciaries must undertake an annual Data Protection Impact Assessment and conduct independent audits to ensure sustained compliance with statutory requirements. The Rules reiterate the central role of the Data Principal, the individual to whom the personal data relates, in maintaining accountability and transparency in the data ecosystem.

Also Read: Delhi Court Restores Complaint, Orders Prosecution Of Congress Leader Bhanwar Jitendra Singh For Criminal Breach Of Trust Over Unreturned MF Husain Painting Worth Over ₹1 Crore

A major obligation under the Rules concerns data breach reporting. In the event of a personal data breach, the Data Fiduciary must immediately notify both the affected individuals and the Data Protection Board of India, providing details of the breach, including its extent, timing, potential consequences, and recommended safety measures. This mechanism is intended to ensure timely mitigation and safeguard the rights of Data Principals in the event of unauthorised access or misuse.

The Rules further prescribe the constitution of the Data Protection Board of India, which shall be appointed through a Search-cum-Selection Committee chaired by the Cabinet Secretary. The Board is designed to function as a digital office, ensuring paperless processing of complaints, adjudication, and regulatory oversight. Decisions before the Board will be taken by a majority vote of the members present and voting, ensuring institutional uniformity and fairness.

An important aspect addressed by the Rules relates to the cross-border transfer of personal data. The Rules provide that personal data processed under the Act may be transferred outside India, subject to restrictions that the Central Government may impose from time to time. This provision recognises the need for global data flows while retaining regulatory oversight over sensitive data processing activities beyond India’s borders.

Also Read: Sessions Court Quashes Magistrate’s Order Directing Probe Into Minister Kapil Mishra’s Alleged Role In 2020 Delhi Riots

The notification of the Digital Personal Data Protection Rules, 2025, represents a pivotal development in India’s data protection landscape. By laying down clear obligations for Data Fiduciaries, instituting a digital-first regulatory body, and safeguarding rights of Data Principals, the Rules aim to create a robust, accountable, and modern data governance regime in the country.