DPDP Rules 2025 & MeitY Orders Tracker

Overview: MeitY Statutory Orders & Subordinate Legislation

The Digital Personal Data Protection Act, 2023 provides the statutory framework, while the Ministry of Electronics and Information Technology (MeitY) operationalizes the law through executive rules, gazette notifications, and removal of difficulties orders.

This live tracker documents every executive update, formal amendment, and operational timeline issued by MeitY.

DPDP Announcements Log

Every official step under the DPDP Act so far, newest first.

Coming Up

• November 13, 2026: Consent Manager registration opens (Rule 4).
• May 13, 2027: All remaining obligations and penalties apply.
• November 13, 2028: The Section 43 power to issue removal of difficulties orders ends, three years after commencement.

1. The Removal of Difficulties Order, 2026 (S.O. 5458(E))

MeitY issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026, numbered S.O. 5458(E), under Section 43(1) of the Act. It is dated October 5, 2026 and came into force on its publication in the Gazette (reported as October 6 or 7, 2026). Section 43(2) allows such orders only within three years of the Act coming into force.

The order makes two small wording corrections. It does not add new duties, and it does not change when Sections 9 and 10 come into force. Both are still expected to apply from May 13, 2027.

A. Section 9(1): Children and Persons With Disability

• Statutory Change: The words “child or a person with disability” were replaced with “child or of a person with disability”, inserting the word “of”. The rest of the sentence, including “who has a lawful guardian”, was already in the original Act.
• Practical Meaning: The sentence now reads more clearly as two separate cases. A parent gives verifiable consent for a child, and a lawful guardian gives it for a person with disability. That was always the intended rule; Rules 10 and 11 set out how each is verified.

B. Section 10(2)(c)(ii): “Periodic Audit” Becomes “Periodic Data Audit”

• Statutory Change: In the list of Significant Data Fiduciary duties, “periodic audit” now reads “periodic data audit”.
• Practical Meaning: Section 10 uses “audit” in more than one place, which left room for different readings. The change makes clear that the periodic audit is a data audit, like the one by the independent data auditor in Section 10(2)(b), not a financial or general IT audit.

2. Core Provisions of the DPDP Rules, 2025

MeitY notified the DPDP Rules, 2025 as G.S.R. 846(E) on November 13, 2025. Rules 1, 2 and 17 to 21 took effect that day, Rule 4 takes effect one year later, and all other rules take effect 18 months later, on May 13, 2027. The key rules for businesses:

Rule 3: Notice to Users

• The notice must be presented and understandable on its own, separate from any other information such as terms of service or a privacy policy.
• In clear and plain language, it must give at least an itemised description of the personal data and the specified purpose, with a description of the goods, services or uses the processing enables.
• It must give a direct link to your website or app, and describe any other means, for withdrawing consent as easily as it was given, exercising rights, and complaining to the Board.
• The language option comes from Section 5(3) and Section 6(3) of the Act: English or any Eighth Schedule language, at the user’s choice.

Rule 4 and the First Schedule: Consent Managers (from November 13, 2026)

• Only a company incorporated in India with a net worth of at least ₹2 crore and sound finances and management can register.
• Its platform must be independently certified against data protection standards the Board publishes.
• It must not be able to read the personal data it routes, must keep consent records for at least seven years, must not sub-contract its obligations, must avoid conflicts of interest with Data Fiduciaries, and needs Board approval for any change of control.

Rule 6: Reasonable Security Safeguards

• At minimum: encryption, obfuscation, masking or virtual tokens; access controls; logs, monitoring and review to detect unauthorised access; backups for continuity; security clauses in processor contracts; and organisational measures.
• Logs and personal data must be kept for one year for detection and investigation, unless another law requires otherwise.
• No specific technical standard (such as a particular cipher) is named.

Rule 7: Breach Reporting

• Tell each affected user without delay: what happened, likely consequences, what you are doing, what they can do, and a contact person.
• Tell the Board without delay with a description of the breach, then send a detailed report within 72 hours of becoming aware, or longer if the Board allows on written request.

Rule 8 and the Third Schedule: Erasure After Inactivity

• E-commerce and social media platforms with at least 2 crore registered users in India, and online gaming platforms with at least 50 lakh, must erase data after three years without the user coming back or using their rights.
• Users must be warned at least 48 hours before erasure.
• Every Data Fiduciary must keep personal data, traffic data and processing logs for at least one year from processing.

Rule 9: Contact Details

• Publish the DPO’s or a responsible person’s business contact details prominently on your website or app, and include them in every reply to a rights request.

Rules 10 to 12: Children and Persons With Disability

• Rule 10: Check that the person giving consent for a child is an identifiable adult, using identity and age details you already hold or a virtual token from an authorised entity such as a DigiLocker provider.
• Rule 11: Check that a guardian of a person with disability was appointed by a court, designated authority or local level committee.
• Rule 12 and the Fourth Schedule: Narrow exemptions for healthcare, education, creches, school transport, government functions, email-only accounts, real-time location for safety, blocking harmful content, and age checks.

Rule 13: Significant Data Fiduciaries

• A DPIA and audit every 12 months, with significant findings reported to the Board; due diligence on algorithmic software; and possible localisation of personal data the government specifies.

Rule 14: Rights and Grievances

• Publish how users can make rights requests and what identifiers you need.
• Publish a grievance response period of no more than 90 days.
• Let users nominate one or more people.

Rule 15: Transfers Abroad

• Data may go abroad, subject to any requirements the government sets on making it available to a foreign State or entities it controls.

Rules 17 to 21: The Board

• Selection committees for the Chairperson and Members, salaries, meeting procedure, a six-month limit on inquiries (extendable three months at a time), and the Board working as a digital office.

The December 2025 Corrigendum (G.S.R. 892(E))

On December 10, 2025, MeitY published a corrigendum to the DPDP Rules, 2025 that fixed typographical and grammatical errors, including wording in the commencement rule. It does not change the substance of any obligation.

3. The Startup Exemption Myth vs. Reality (Section 17(3))

There is widespread confusion among Indian tech founders about whether early-stage companies are exempt from DPDP Act compliance.

Here is the exact legal position:

• The Myth: “Our company is DPIIT-recognized, so we don’t need to worry about consent banners or penalties.”
• The Statutory Reality: Section 17(3) of the Act gives the Central Government the power to notify exemptions for certain classes of startups in the future. However, MeitY has NOT issued any blanket startup exemption notification.
• What this means for your business: Unless your specific company or micro-sector is expressly notified in an official Gazette order, every startup, D2C store, and web agency is legally bound by the DPDP Act. You must obtain valid consent, block unauthorized cookies, honor data deletion requests, and protect user data from day one.

4. Official Phased Enforcement Timeline

MeitY structured the rollout across three milestones to give Indian businesses time to deploy compliance technology:

Note: In early 2026 there were reports of a proposal to shorten the 18-month window to 12 months, at least for Significant Data Fiduciaries. As of October 2026 no such change has been notified in the Gazette, so May 13, 2027 remains the legal deadline.

Practical Engineering Action Items

1. Verify Consent Log Retention: Ensure your consent management system retains cryptographic consent receipts and withdrawal events for at least 365 days.
2. Audit Breach Incident Timelines: Set up automated alerting in your security monitoring stack capable of generating a 72-hour regulatory incident brief.
3. Prepare for Consent Manager APIs: Design your identity and consent backend to interface with interoperable consent managers ahead of the November 2026 registration rollout.