Centre Notifies New Data Protection Rules 2025: Key Highlights Explained

CT Team 2 min read November 14, 2025 at 5:30 pm

The Central Government has officially notified the Digital Personal Data Protection Rules, 2025, under the Digital Personal Data Protection Act, 2023. The notification was issued by the Ministry of Electronics and Information Technology on November 13, marking an important step towards strengthening data privacy in the country.

Earlier this year, the Centre had invited public feedback on the draft version of these Rules.

Key Provisions of the 2025 Rules

The Rules require Data Fiduciaries to put proper organisational and technical safeguards in place to ensure that a parent’s consent is obtained before processing any personal data of a child.

Under the law, a Data Fiduciary is any individual, company, or entity that decides how and why personal data will be processed.

Certain entities may also be designated as Significant Data Fiduciaries based on factors such as the volume and sensitivity of data handled, and the risk posed to the rights of the Data Principal. These entities must carry out an annual Data Protection Impact Assessment and undergo yearly audits to check compliance with the Act and Rules.

A Data Principal refers to the individual whose personal data is being processed.

Reporting Data Breaches

In the event of a personal data breach, the Rules make it mandatory for the Data Fiduciary to immediately inform both the affected individuals and the Data Protection Board of India. The intimation must include details such as:

Extent of the breach
When it occurred
Possible consequences
Recommended safety steps for affected persons

Data Protection Board of India

The Data Protection Board of India will be set up by a Search-cum-Selection Committee chaired by the Cabinet Secretary.

The Board will operate fully in a digital format, and any matter placed before it will be decided based on a majority vote of the members present.

Cross-Border Transfer of Personal Data

The Rules allow the transfer of personal data to countries outside India. However, such transfers will be subject to restrictions or conditions that the Central Government may specify from time to time.