They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
DPDP RULES 2025 · 23 RULES + 7 SCHEDULES
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineThe Digital Personal Data Protection Rules, 2025 provide the operational framework for implementing the DPDP Act 2023. With 23 rules and 7 schedules, these rules detail compliance requirements for all organizations.
Notified on 13 November 2025 as G.S.R. 846(E), after a draft published on 3 January 2025, the Rules convert the Act's principles into operational obligations — from consent notices and security safeguards to breach reporting and cross-border transfer. Rules 1, 2 and 17 to 21 applied on publication, Rule 4 on consent managers applies from 13 November 2026, and the rest from 13 May 2027.
23Rules
7Schedules
Nov 2025Notified
MeitY · 23 Rules + 7 Schedules · Last reviewed October 2026
Rule by Rule
All 23 Rules Explained
Preliminary (Rules 1-3)
Rule 1
Short title and commencement
Rules 1, 2 and 17 to 21 apply from publication on 13 Nov 2025, Rule 4 from 13 Nov 2026, and the rest from 13 May 2027
Rule 2
Definitions
Defines four terms: Act, techno-legal measures, user account and verifiable consent. Every other term, Consent Manager included, takes its meaning from the Act
Rule 3
Notice by Data Fiduciary
Requirements for notice to Data Principals with itemised description of personal data
Obligations of Data Fiduciary (Rules 4-5)
Rule 4
Consent Manager Registration
Registration requirements, conditions, and obligations for Consent Managers
Rule 5
State Processing Standards
Standards for processing by State and instrumentalities for subsidies, benefits, services
Rights and Duties (Rules 6-8)
Rule 6
Security Safeguards
Reasonable security safeguards including encryption, access controls, monitoring
Rule 7
Breach Notification
Intimation of personal data breach to Board and affected Data Principals
Rule 8
Data Retention Period
Time periods after which purpose is deemed no longer served
Special Provisions (Rules 9-12)
Rule 9
Contact Information
Person designated to answer questions about processing
Rule 10
Child Consent
Verifiable consent requirements for processing children's data
Rule 11
Guardian Consent
Verifiable consent for persons with disability having lawful guardian
Rule 12
Child Data Exemptions
Classes of Data Fiduciaries exempt from certain child data obligations
Significant Data Fiduciaries, Rights and Transfers (Rules 13-16)
Rule 13
Significant Data Fiduciary
A yearly DPIA and audit reported to the Board, checks on algorithmic software, and keeping specified data in India
Rule 14
Data Principal Rights
Procedures for exercising rights of access, correction, erasure
Rule 15
Cross-Border Transfer
Requirements for transfer of personal data outside India
Rule 16
Research and Statistics
Exemption for research, archiving or statistical purposes that follow the Second Schedule standards
Data Protection Board and Appeals (Rules 17-23)
Rule 17
Board Appointments
Search-cum-Selection Committees that recommend the Chairperson and Members
Rule 18
Board Service Terms
Salary, allowances and service conditions of the Chairperson and Members (Fifth Schedule)
Rule 19
Board Meetings and Orders
How the Board meets, decides and authenticates its orders and directions
Rule 20
Board as a Digital Office
The Board works digitally, without prejudice to summoning a person in person
Rule 21
Board Staff
Appointment and service terms of the Board's officers and employees (Sixth Schedule)
Rule 22
Appeal to Appellate Tribunal
How an appeal against a Board order or direction is filed
Rule 23
Calling for Information
When the Government can call for information from a Data Fiduciary or intermediary (Seventh Schedule)
The Annexures
7 Schedules
Schedule I
Consent Manager
Part A: Conditions of registration | Part B: Obligations
Schedule II
State Processing Standards
Standards for processing under Section 7 and Section 17(2)(b)
Schedule III
Data Retention
Class of Data Fiduciaries, Purposes, and Time periods
Schedule IV
Child Data Exemptions
Part A: Classes exempt | Part B: Purposes exempt from Section 9(1) and 9(3)
Schedule V
Board Terms
Terms and conditions of service of Chairperson and Members
Schedule VI
Board Staff
Terms of appointment and service of officers and employees
Schedule VII
Authorized Persons
Purpose and Authorised person table for information requests
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
DPDP Penalties & Enforcement
Penalty tiers up to ₹250 Cr and the Data Protection Board process.
Read morePrivacy
Significant Data Fiduciary
Enhanced obligations for large-scale data processors under the DPDP Act.
Read morePrivacy
DPDP Implementation Roadmap
Phased roadmap from gap assessment to full compliance.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read moreProof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
DPDP course · Module 1 of 8
You finished Module 1. You can now explain in two minutes what the DPDP Act is, who it covers, which data it protects and which parts apply today.
Previous1.6 Where DPDP sits among India's privacy lawsCourse map8 modules · 79 lessons · 24 readyModule 2: Lawful processing: principles, grounds, notice and consent2.3 Consent under the DPDP Act
Next in the course: 2.1 The seven principles behind the Act. Saundhi Chauhan is writing it.