Cybersecurity Policy Report, Indian Ministry Publishes Rules Implementing Data Protection Law, (Nov 14, 2025)

By Tony Foley

The Indian Ministry of Electronics and Information Technology (MeitY) has published new rules to implement the provisions of the country’s Digital Personal Data Protection Act (DPDPA).

The rules, which were originally published in January, are designed to strengthen the legal framework for the protection of personal data by providing necessary details about various implementation issues, including required elements of notices to data principals, registration requirements, and the establishment of reasonable security safeguards, among other topics (CPR, Jan. 6).

Data breach notification requirements are set forth in the rules, mandating that data fiduciaries notify data principals and the newly created Data Protection Board within 72 hours of a breach and specifying the components of the notification. The rules also establish the appropriate technical and organizational measures necessary to obtain verifiable parental consent when processing the personal data of a child, as well verifiable consent from a legal guardian when processing the personal data of a person with a disability.

Finally, the rules spell out additional duties applicable to “significant data fiduciaries,” which are defined under the DPDPA as organizations with a large scale or high-risk impact. Such fiduciaries must appoint an independent auditor and conduct data protection impact assessments under certain circumstances. Schedules attached to the rules outline the conditions for registration with the board as a consent manager and the obligations applicable to such managers, among other topics.

The rules will take effect on a staggered schedule as specified in the rule, with consent manager requirements effective one year after publication of the rules in The Gazette of India and most other substantive requirements taking effect 18 months after publication.

In addition to the rules MeitY published notifications establishing the Data Protection Board and specifying that the board will have four members.

News: InternationalLegislation DataPrivacy DataSecurity DataBreach