Context: The Digital Personal Data Protection (DPDP) Rules, 2025 were notified on 14 November 2025, completing a long regulatory journey that began after the Supreme Court in K.S. Puttaswamy (2017) upheld privacy as a fundamental right under Article 21. The new rules operationalise the DPDP Act, 2023 through phased compliance mechanisms and define obligations for data fiduciaries, rights of data principals, and regulatory structures.
Key Features of the DPDP Rules 2025
1. Phased Compliance Timeline
The Rules provide an extended rollout period:
- Full compliance by May 2027 (18 months from notification).
- Data Protection Board (DPB) provisions become effective immediately.
- Consent Manager framework operational from November 2026.
This phase-wise approach aims to help government bodies, firms, and startups transition without service disruption.
2. Consent and Notice Framework
- Processing requires clear, informed, specific consent.
- Notices must be plain-language, purpose-specific, and accessible.
- Children’s data requires verifiable parental consent, and tracking, behavioural monitoring, or targeted advertising for minors is strictly prohibited.
3. Rights of Data Principals (Users)
The Rules operationalise key user rights:
- Right to access, correction, and erasure
- Right to withdraw consent
- Right to grievance redress
Implementation timelines are staggered, with full enforcement expected in 2027.
4. Obligations on Data Fiduciaries
- Purpose limitation: Data may be used only for the stated objective.
- Data minimisation: Only necessary data may be collected.
- Retention limits: Data must be deleted once the purpose is completed.
- Audit readiness: Fiduciaries must maintain accurate records for regulatory scrutiny.
5. Data Breach and Incident Reporting
All data breaches, unauthorised disclosures, or security incidents must be reported to the Data Protection Board of India (DPBI) within stipulated timelines.
6. RTI Amendment – A Major Shift
The Rules operationalise Section 44(3) of the DPDP Act, which amends Section 8(1)(j) of the RTI Act.
Under the new regime:
- Personal information is exempt from disclosure,
- The earlier “larger public interest” override has been removed.
This marks one of the most significant changes to India's transparency framework since 2005.
Concerns and Criticisms
- Delayed Protection: Citizen rights are fully enforceable only by 2027, despite years of deliberation.
- RTI Dilution: Removal of the public-interest test may weaken accountability.
- Regulator’s Independence: DPBI is housed under MeitY, raising conflict-of-interest concerns.
- Weak Oversight: No mandatory data protection impact assessments, independent audits, or proactive disclosures.
- Cross-Border Ambiguity: A “negative-list” approach permits transfers by default, raising data sovereignty issues.
- Consultation Gaps: Final rules reflect limited incorporation of public comments.
Foundational Judgments Supporting Digital Rights
- Maneka Gandhi (1978): Expanded Article 21 to include fairness and reasonableness.
- Faheema Shirin (2019): Declared internet access part of the right to education and life.
- Anuradha Bhasin (2020): Affirmed internet access as essential for freedom of speech and occupation.
- Puttaswamy (2017): Recognised privacy as a fundamental right, prompting data protection legislation.




