23 rules, notified 13 November 2025 — 22 explained so far, in plain language, each one cross-linked to the Act section it implements. The rest are being finished and reviewed.
Three separate start dates hiding inside one short rule — and the gap between them is exactly why "the DPDP Rules are in force" is the wrong question to ask.
Four terms, not twenty-eight — Rule 2 only adds what the Rules need on top of the Act's own glossary, and doesn't re-define anything Section 2 already covers.
Three sub-clauses, three separate tests — and a notice that passes on length can still fail on all three.
Not a self-certification. A Consent Manager is filtered before it exists, watched while it operates, and can lose its registration for reasons that have nothing to do with a breach.
Consent isn't removed here — it's replaced. And the replacement comes with its own conditions attached.
Seven minimums, not a list of suggested tools — and having a security stack isn't the same as meeting any one of them.
Not a single 72-hour deadline — a two-step process, with an immediate obligation the "72 hours" framing usually leaves out entirely.
For the platforms it names, the Third Schedule doesn't ask you to judge when a purpose is over — it already timed it, down to the day.
One rule, one sentence, and it quietly rules out the two most common ways organisations currently handle rights requests.
Rule 10 verifies that a parent is an identifiable adult. Rule 11 verifies something different — that the guardian's appointment itself is real.
Rules 10 and 11 tell you how to obtain verifiable parental or guardian consent. Rule 12 tells you the narrow set of situations where you don't have to — and what never gets relieved regardless.
Being notified as a Significant Data Fiduciary isn't a one-time compliance milestone. Rule 13 turns it into a recurring cycle of assessment, audit, algorithmic due diligence and localisation that runs every twelve months, indefinitely.
The Act gives Data Principals rights. Rule 14 is what makes those rights operational — a published channel, a defined identifier, a capped grievance timeline, and support for someone acting on her behalf.
No blanket data localisation, and no unrestricted export either. Rule 15 gives the Central Government a conditional lever over one specific kind of cross-border flow — personal data reaching a foreign State or an entity under its control.
Calling something "research" doesn't exempt it. Rule 16's exemption depends entirely on whether the processing actually meets the Second Schedule's eight standards — a much narrower gate than product teams tend to assume.
Two different Search-cum-Selection Committees, run by two different sets of civil servants, feed recommendations to the Central Government — one for the Chairperson, one for every other Member of the Data Protection Board.
One sentence in the Rules, pointing to a nine-paragraph Fifth Schedule that fixes exactly what the Board's Chairperson and Members are paid — and just as precisely, what they're not entitled to.
Nine sub-rules covering how the Board actually convenes, decides and signs off on its own orders — plus a six-month clock on how long an inquiry into your organisation can run before it needs a written justification to continue.
A single-sentence rule with an important carve-out: the Board can run proceedings without anyone needing to show up in person, but that doesn't touch its power to summon someone and examine her on oath.
The Board doesn't build its own permanent civil service from scratch — it largely draws on deputation from government and one specific institution named directly in the Rules.
Section 29 of the Act gives you 60 days to appeal a Board order. Rule 22 is about what happens once you actually file — the digital form, the fee, and the procedure the Tribunal runs on.
The final rule in the set, and one of the most consequential — a statutory duty to furnish information to the government on demand, paired with a power to legally require you say nothing about it.
30 minutes with us usually gets further than another hour searching the Rules text on your own.
Book a Consultation