DPDP Rules 2025: Empowering Users, Challenging Organizations, Redefining Privacy

On November 14, 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection (DPDP) Rules under the DPDP Act 2023. This comprehensive regulatory regime details how personal information must be handled and protected.

The new rules introduce clear obligations for data fiduciaries (entities processing data), including obtaining informed consent, providing transparent notices, allowing easy withdrawal of consent, and implementing security measures such as encryption and audits. Significant Data Fiduciaries (SDFs), including large tech firms, face enhanced duties like annual audits, data protection impact assessments, and algorithmic fairness requirements.

The rules also include strict timelines for breach reporting to both affected individuals and the Data Protection Board of India (DPBI), which has regulatory authority including penalty imposition up to ₹250 crore. Additional safeguards focus on children’s data, requiring verifiable parental consent and restricting behavioural tracking.

However, the framework grants broad exemptions to government agencies citing sovereignty and security, generating criticism over potential privacy trade-offs. Delayed implementation of some citizen-centric measures and concerns over the amendment to the Right to Information Act have raised transparency issues.

The DPDP Rules 2025 mark a milestone in India’s digital ecosystem, aiming to balance innovation, privacy, security, and national interests while empowering users and ensuring stronger data governance.

Key Highlights

DPDP Rules 2025 notify India’s first comprehensive digital privacy law under DPDP Act 2023.

Data fiduciaries must secure informed consent, provide transparent data notices, and allow consent withdrawal.

Significant Data Fiduciaries face strict compliance: annual audits, impact assessments, and fairness checks.

Mandatory breach reporting within defined timelines to users and the Data Protection Board of India (DPBI).

Enhanced protections for children’s data, including parental consent and monitoring restrictions.

Broad government exemptions on grounds of sovereignty and security spark privacy concerns.

Amendments to Right to Information Act limit disclosure of personal information, raising transparency debates.

DPDP Rules aim to foster data privacy, security, user empowerment, and innovation-friendly governance.

Source: The News Minute, The New Indian Express, Economic Times, EY India