India’s DPDP Rules 2025: Your Data Rights Explained
What the notified Digital Personal Data Protection Rules mean for people in India.
By Siddharth ShankarUpdated October 24, 2026India notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025, according to the Press Information Bureau. They give individuals rights to consent, access, correct, update, erase and nominate. Data fiduciaries must address requests within a maximum of 90 days. Compliance is phased over 18 months. Children’s data needs verifiable parental consent, with exceptions, and a digital Data Protection Board will hear complaints, with appeals to TDSAT. Penalties under the Act reach up to ₹250 crore.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
India’s data protection framework has taken shape in stages. The Digital Personal Data Protection Act, 2023 set out the principles, and the Rules fill in the detail. This guide follows the Press Information Bureau’s (PIB) release on the notified Rules and the penalties laid out in the Act. It does not cover points the release leaves out.
What was notified
The PIB reports that the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025. The Rules put the Act into operation in phases.
Your rights
The PIB lists these rights for individuals (data principals):
- to give or withdraw consent;
- to access information about their personal data;
- to correct and update it;
- to erase it;
- to nominate another person to exercise their rights.
Response times
Data fiduciaries, the organisations that decide how and why personal data is processed, must address requests within a maximum of 90 days.
Phased compliance
The Rules give organisations 18 months to comply in phases. The PIB release does not say when the 18-month period starts for each obligation, so check the official text for dates relevant to a particular service.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Consent managers
The Rules provide for consent managers, who help individuals give, manage, review and withdraw consent through a single interface.
Children’s data
Processing the data of children requires verifiable consent from a parent or guardian, with exceptions set out in the Rules. See the parents’ guide to children’s digital footprints for practical steps.
The Data Protection Board
The Rules set up a digital Data Protection Board with four members. Individuals can complain to the Board, and appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The PIB release does not give a portal address or the deadline for notifying the Board, so we do not state them.
Penalties
Under the Act, penalties can reach:
- up to ₹250 crore for failing to maintain reasonable security safeguards;
- up to ₹200 crore for failing to notify a breach, or for breaches of obligations involving children;
- up to ₹50 crore for other violations.
How to use your rights
- Find the privacy notice of the service and see how to make a request.
- Write clearly, naming the right you are using (access, correction, erasure or nomination).
- Keep a record of the date, the method and the reply.
- Allow for the 90-day maximum, but note some requests may be answered sooner.
- Escalate to the Board if the response is unsatisfactory, once the process is available.
- Protect your identifiers. Read how to check Aadhaar authentication history and how to lock Aadhaar biometrics.
Related protections in India
Other tools help with fraud and spam: Sanchar Saathi, TRAI’s Do Not Disturb and the 1930 helpline. For a comparison with Canada’s law, see PIPEDA. To understand what counts as personal data, see what PII is.
Sources
- Press Information Bureau: Digital Personal Data Protection Rules, 2025 notified (November 17, 2025) (rights, timelines, Board, consent managers)
Frequently asked questions
When were the DPDP Rules notified?
On 14 November 2025, according to the Press Information Bureau.
What rights do individuals have?
Consent, access, correction, updating, erasure and nomination.
How long do organisations have to respond?
A maximum of 90 days.
Who hears complaints?
A digital Data Protection Board, with appeals to TDSAT.
What are the maximum penalties?
Under the Act, up to ₹250 crore for failing to keep reasonable security safeguards, ₹200 crore for some breach and child-related failures and ₹50 crore for others.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.