The Digital Personal Data Protection Rules 2025 ("the Rules") have been notified, consequentially finalising the much-awaited implementation timeline of the Digital Personal Data Protection Act 2023 ("the Act"). Stakeholders have reacted differently, with some hailing this as a watershed moment in India's digital personal data protection landscape, and others holding more cautionary opinions, suggesting that while the Rules have indeed addressed some important concerns that emerged from the Draft Digital Personal Data Protection Rules 2025 ("Draft Rules"), there still are concerns that continue to exist and require some clarity. Refer here for a brief explainer on the Rules themselves.
With respect to the implementation of the Rules itself, the Central Government has opted for a staggered, three-stage approach to implement the Act and the Rules over a period of 18 months.
-
Stage 1: Provisions for establishing and governing the Data Protection Board of India ("DPB" or "the Board"), the main enforcement body, and rules for appointing its members came into effect immediately on November 14, 2025. See Rules 1, 2 and 17-21.
-
Stage 2: Rules for the registration and functioning of Consent Managers will be effective after 12 months, allowing time for infrastructure development. See Rule 4.
-
Stage 3: The majority of compliance requirements for Data Fiduciaries, including privacy notices, consent, data security, processing children's data, data retention, deletion policies, and cross-border data transfers (except to restricted countries), will be fully enforceable after 18 months.
This piece analyses in some depth, what works, and what some foreseeable challenges are, specifically pertaining to compliance, constitutionality and enforcement. Before we begin, we must be cautious not to let the best be the enemy of the good. Excessive criticism of what is undoubtedly a landmark privacy legislation, tailored to Indian considerations, and expecting prescription of standards will strip away the room granted for innovation through it.
What the Framework Does Well
The first thing the DPDP regime in India ensures is the simplicity of language to ensure that smaller organisations and the general public are able to understand and access the framework. The Rules build on this by standardising notices, creating predictable breach-reporting processes, and giving users simple digital tools to exercise their rights.
The DPDP framework a standard, clear set of breach-notification duties. S.8(6), read with Rule 7, requires Data Fiduciaries to inform both the Data Principal and the Board as soon as practicable, with specified details. The two-stage model, which involves an initial intimation followed by a 72-hour report, is broadly consistent with global practice.
Supplementing this, S.13 and Rule 14 establish a structured and time-bound grievance process. They require Data Fiduciaries and Consent Managers to publish contact points and timelines, and to provide clear digital pathways for exercising rights. For many individuals who struggle with opaque customer-service systems, this creates a direct and accessible route for raising privacy concerns, which did not exist under earlier laws.
Now, although not as wide-ranging as the GDPR, and requiring some fine-tuning, the Act takes a pragmatic approach to purpose limitation and retention. The rule that data must be erased once the purpose is fulfilled, supported by Rule 8 and the Third Schedule, clarifies the storage limitation framework in India, albeit with some defined exemptions. The timelines so formed are on the basis of (i) withdrawal of consent; (ii) expiry of purpose; both of which are clearly defined under the Act. Abstract standards of "proportionality," and "necessity" are condensed into clear, actionable requirements.
Although implementation challenges remain, the Act takes a clear position on the special protection owed to children. Section 9(3) prohibits tracking, behavioural monitoring, and targeted advertising directed at minors. Furthermore, in what has been hailed as an improvement from the existing regime, the Rules mandate Verifiable Parental Consent, i.e., consent of an individual who can be verified as an adult parent in compliance through laws in force, to allow processing of minors' personal data.
The DPDP framework also fits well with the needs of India's fast-growing digital economy. The focus on digital governance—online notices, online grievance systems, online appeals, and a fully digital Data Protection Board—recognises the country's administrative limits and avoids creating a regulator that gets overwhelmed. Furthermore, the Act is designed to operate within India's existing digital public infrastructure, such as DigiLocker, Aadhaar-based token systems, and account aggregators. This allows interoperability and more secure data flows within systems that citizens already use. Few privacy laws globally have been drafted with a live digital infrastructure in mind, which makes the DPDP framework distinctive in its approach.
Challenge 1: Broad State Exemptions
S.17(2)(a) of the Act gives the Central Government the broad power to exempt processing carried out by notified state bodies in the interests of sovereignty, security of the state, friendly relations with foreign states, public order, or preventing incitement to cognizable offences. Concerns regarding the broadness of these exemptions and the lack of any oversight mechanisms were raised upon the introduction of the DPDP Bill, to no avail. Grounds like "public order" and "friendly relations with foreign states" are elastic, enabling expansive interpretation, and the manner of phrasing gives no room for the checks and balances introduced by the Supreme Court in Justice K.S. Puttuswamy (Retd.) v. Union of India ("Puttuswamy"), which specifically states:
". ... an invasion of life or personal liberty must meet the three-fold requirement of (i) legality, which postulates the existence of law; (ii) need, defined in terms of a legitimate state aim; and (iii) proportionality which ensures a rational nexus between the objects and the means adopted to achieve them"
The fundamental issue is the vagueness of justifications used. Grounds such as "security of the state," "national sovereignty," etc., enable the Government to exercise a wide ambit of powers with little to no oversight. Furthermore, these exemptions may not apply to specific activities, but to entire classes of processing, and all with the absence of a clear oversight mechanism. The broadness is not limited to the range of activities, either. S.17(2)(a) allows entire instrumentalities to be exempted forever, with no sunset clause, which would likely enable impunity of the state ad infinitum—appearing to be an extension of the Government of India's tendency to normalise emergency laws.
From the Foreign Intelligence Surveillance Act in the USA, as disclosed in the Snowden Files, which enabled the US Government to collect data on entire populations (including friendly foreign citizens and heads of state) rather than being limited to specific, targeted suspects, to the Social Credit System of China, which uses public interest exemptions under the Personal Information Protection Law for mass data collection, to rate the "trustworthiness" of citizens and entities, we see potential for surveillance, censorship, profiling, etc. arising from broad exemptions on state activities vis-à-vis processing of personal data.
The problem is further exacerbated by Rule 23, which provides the Central Government with the right to seek information from "any data fiduciary or intermediary," for certain purposes as specified under Schedule VII. Further, in a situation where the government deems that publication or disclosure of such information (read: personal data) is a threat to public order, the fiduciary shall be barred from informing the principal about such disclosure. Essentially, not only does the Rule enable the Government to access essentially any personal data at will, it also ensures that data principals are unaware of such access, thereby preventing them from accessing any legal recourse.
That is, S.17(2)(a) creates an exemption without statutory safeguards, without procedural constraints, and without independent oversight. It appears to be a textbook violation of both necessity and proportionality under Puttuswamy because the provision enables bulk exemptions that are not limited, foreseeable, or reviewable.
The broadness of the categories of the data that may be accessed invite abuse, and, in combination with the absence of any meaningful checks and balances, is antithetical to the language of the Court in Puttuswamy.
Another relevant issue that emerges is Rule 8(3), which requires data fiduciaries to store data for a period of one-year post-processing, even if the data principal deletes their account (subject to laws in force). This "data" includes personal data, associated traffic data and logs of processing. For significant data fiduciaries, When read with the Third Schedule, Rule 8(1) mandates maintenance of SDF processing logs for three years. This is violative of the principles of data minimisation and storage limitation—internationally accepted best practices which require that only the minimum necessary amount of data must be collected, and only for the time period required to carry out the processing that the data principal has consented to.
This also weakens the data principal's right to erasure, because even if a user deletes their account, the fiduciary is legally required to keep their data, and further increases compliance costs and operational burdens, especially for smaller entities, since long-term secure storage of logs and traffic data is technically and financially demanding. Finally, the definition of "traffic data," has not been adequately addressed by the Rules, creating compliance challenges with storage, and potentially broadening the scope of the data being stored under this Rule.
Challenge 2: Independence of the Data Protection Board of India
International standards, from the EU-GDPR to the World Bank recognise the status of the state as a major data processor, and establish the necessity of an independent oversight authority to effectively protect data principal rights. The concept of genuine independence is aimed at avoiding centralised power, and enabling objective decision making, and is determined on the basis of a variety of structural factors, such as method of appointment and allocation of resources. Put simply, independence ensures that the regulator can:
-
Make decisions objectively, based solely on data protection law, free from political or commercial pressure.
-
Conduct inquiries and impose sanctions on public authorities, which are some of the largest data fiduciaries.
However, the appointment procedure of Data Protection Board of India ("the Board") as under Rule 17 states that it shall consist of a chairperson and members, each of whom shall be appointed by a distinct search-cum-selection committee ("committee"), which recommend individuals for the corresponding posts. Both selection committees shall be headed by members of the executive, and the Central Government will review the recommendations, and, if satisfied, appoint the recommended individuals in the Board.
Rule 21 empowers the Board to employ officers and employees for efficient functioning subject to prior permission from the Central Govt, the Sixth Schedule forms the basis of the Terms and Conditions of Service of both employees and members of the Board.
Furthermore, S.21 of the Act empowers the Central Government to remove Chairperson/Members of the Board (subject to a hearing), and requires resignations of Chairperson/Members to be approved by the Central Government.
It is evident that the Board lacks the independence outlined under international norms, given the prevalence of executive discretion in its functioning given that the Board:
-
Is established by the Central Government,
-
Members are appointed by Government,
-
Service conditions set by Government,
-
Is removable by Government,
-
Is dependent on Government for staffing and finances.
Furthermore, the Board also lacks the suo motu powers to initiate inquiry. S.27 of the Act states that Board may begin an inquiry upon receiving any of the following:
-
Breach notification from a Data Fiduciary (S.8(6)) - which is also communicated to the Principal
-
Complaint by a Data Principal (breach of Fiduciary obligations or Principal rights)
-
Complaint against a Consent Manager
-
Intimation of breach of CM registration conditions
S.28(3) provides that the power of the Board with respect to the initiation of an inquiry is limited to determining whether the aforementioned triggers contain a prima facie case or not. Proactive enforcement by Data Protection Authorities ("DPAs") have been instrumental in enforcement of the GDPR across the European Union, such as in the Google Analytics case, or the Interactive Advertising Bureau case in Belgium. Further exacerbating the issue is the absence of sufficient investigative powers. Since the Board cannot conduct raids, seize equipment, order forensic imaging or enter premises, it relies entirely on executive cooperation and police support—another hindrance to genuine independence.
In sum, it may even be argued that the absence of independence, and executive involvement in the appointment and functioning of the Board is not merely an enforcement gap; it is a deliberate structural choice that ensures the Board cannot autonomously scrutinise the State, which is the single largest data processor in the country.
Challenge 3: Verifiable Parental Consent
[For a detailed critique of India's children's data protection framework, please see this.]
Interestingly, most commentators on the Rules praise the introduction of the Verifiable Parental Consent model—a perspective I disagree with. The DPDP Act and Rules adopt a rigid and technologically narrow model of verifiable parental consent that fails to account for the developmental diversity of children and the economic and digital realities of Indian families.
S.9 and Rule 10 establish parental consent as a blanket requirement for all minors under eighteen, effectively replacing the child's own agency rather than complementing it. This uniform standard does not recognise that adolescents possess significantly greater capacity for privacy decision-making than younger children, nor does it support the gradual development of data autonomy. As a result, the regime entrenches what may be termed "data immaturity": children are excluded from privacy choices throughout their formative years, only to be thrust into full digital responsibility upon turning eighteen without any preparation/enabling mechanisms.
The verification mechanisms themselves suffer from serious shortcomings. Rule 10 restricts verification to two pathways: reuse of identity information already held by the Data Fiduciary or the use of virtual tokens issued by authorised entities. Both approaches are deeply exclusionary in the Indian context, and presume existing digital access and literacy. Virtual tokens rely on a digital ecosystem that many parents may not possess: access to DigiLocker, reliable internet, and sufficient digital literacy. By providing only digital-first verification options, the Rules may create barriers for low-income and rural families, threatening to restrict children's participation in online spaces.
Moreover, the consent framework rests on unrealistic behavioural assumptions—specifically that children will truthfully disclose their age, and that parents will have the capacity and willingness to understand the implications of, and effectively use complex verification tools. Unlike global models such as COPPA, which permit diverse verification methods (video calls, postal forms, call-based confirmations), the DPDP regime provides no flexibility or low-tech alternatives.
Conclusion
Taken together, the DPDP Act and Rules mark a massive leap toward a functional, nationwide privacy framework, but the picture remains mixed. Their accessible design, digital-first architecture, and tiered compliance model show a clear commitment to building a system that can operate at India's scale. At the same time, the Rules introduce gaps and tensions that risk diluting core principles like purpose limitation and placing unnecessary burdens on smaller entities. The core architecture is sound; the shortcomings lie in oversight design, retention standards, and a few rigid compliance burdens. These issues are fixable. With targeted amendments, from narrower state exemptions, and stronger Board independence, to clearer limits on retention, and more flexible consent mechanisms, the system can evolve into a balanced, rights-driven regime that protects users while remaining workable for organisations.