Question 1

What are the data retention and erasure rules for large platforms under the DPDP Rules, 2025?

Accepted Answer

The Third Schedule requires certain large Data Fiduciaries to erase personal data after three years from the last activity of the Data Principal (or from commencement of the rule), unless retention is required by law. This applies to e-commerce entities and social media intermediaries with at least 2 crore registered users, and online gaming intermediaries with at least 50 lakh registered users. The platform must give the user at least 48 hours notice before erasure.

Question 2

How does the Data Protection Board of India function under the 2025 Rules?

Accepted Answer

The Data Protection Board of India is established as a digital-by-design body. Citizens can file complaints and track them online through a dedicated portal and mobile app. The Board functions as an independent adjudicating body that inquires into breaches and imposes penalties. Appeals against its orders lie with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Question 3

What are the requirements for a Consent Manager under the DPDP Rules, 2025?

Accepted Answer

A Consent Manager must be a company registered with the Data Protection Board, with a minimum net worth of Rs 2 crore. It must provide a secure, interoperable and platform-neutral way for individuals to give, manage, review and withdraw consent, act in a fiduciary capacity to the Data Principal, avoid conflicts of interest, and maintain auditable records of consents for at least seven years.

Question 4

What must a Data Fiduciary do when a personal data breach occurs under the DPDP Rules 2025?

Accepted Answer

On becoming aware of a personal data breach, the Data Fiduciary must intimate each affected Data Principal without delay in clear language - describing the breach, the data involved, possible consequences, mitigation measures taken, safety steps the individual can take, and contact details. It must also notify the Data Protection Board without delay, and provide the Board with detailed particulars (facts, mitigation, findings) within 72 hours, or such longer period as the Board may allow on request.

Question 5

What are the rules on transferring personal data outside India?

Accepted Answer

Under the DPDP Act, a Data Fiduciary may transfer personal data outside India, except to any country or territory that the Central Government restricts by notification. Significant Data Fiduciaries may also face additional restrictions on transferring certain categories of personal data and traffic data as specified by the Government.

Question 6

What must a privacy notice contain under the DPDP Rules, 2025?

Accepted Answer

A notice given to obtain consent must be standalone, in clear and plain language, and must give an itemised list of the personal data being collected and the specific purpose of processing. It must also tell the Data Principal how to withdraw consent (as easily as it was given), how to exercise their rights, and how to make a complaint to the Data Protection Board, along with a link or means to do so.

Question 7

Does a Data Fiduciary have to appoint a Data Protection Officer (DPO)?

Accepted Answer

A Significant Data Fiduciary must appoint a Data Protection Officer who is based in India and is responsible to the board of directors or similar governing body. The DPO is the point of contact for grievance redressal. Other Data Fiduciaries must at least publish the contact details of a person able to answer questions about the processing of personal data.

Question 8

When were the DPDP Rules, 2025 notified?

Accepted Answer

The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology (MeitY) on 14 November 2025. They operationalise the Digital Personal Data Protection Act, 2023, which was passed in August 2023.

Question 9

What grievance redressal must a Data Fiduciary provide?

Accepted Answer

Every Data Fiduciary and Consent Manager must publish an effective grievance redressal mechanism and the contact details of a person who can answer data principals' questions. They must respond to grievances within the period they publish. A Data Principal must exhaust this mechanism before approaching the Data Protection Board with a complaint.

Question 10

How can a Data Fiduciary obtain verifiable parental consent for a child?

Accepted Answer

The Data Fiduciary must adopt appropriate technical and organisational measures to ensure the person giving consent is the parent or lawful guardian and is an identifiable adult. This can be done by checking reliable identity and age details already available with the fiduciary, or details voluntarily provided, or a virtual token mapped to such details issued by an authorised entity such as a Digital Locker service provider.

Question 11

What rights does a Data Principal have under the DPDP Act and Rules?

Accepted Answer

A Data Principal has the right to access a summary of their personal data and processing activities, the right to correction, completion, updating and erasure, the right to grievance redressal from the Data Fiduciary or Consent Manager, and the right to nominate another person to exercise these rights in case of death or incapacity. Fiduciaries must publish the means and timelines for exercising these rights.

Question 12

What is the compliance timeline under the DPDP Rules, 2025?

Accepted Answer

The Rules provide for phased implementation. Some provisions took effect on notification, while the core operational obligations - notice standards, security safeguards, breach notification, data retention and erasure, verifiable consent for children, Significant Data Fiduciary duties, data principal rights and cross-border transfer rules - commence eighteen months after publication, giving organisations time to comply.

Question 13

What extra obligations apply to a Significant Data Fiduciary (SDF)?

Accepted Answer

Significant Data Fiduciaries - notified by the Government based on volume and sensitivity of data, risk to data principals and to sovereignty, security and public order - must appoint a Data Protection Officer based in India, conduct an annual Data Protection Impact Assessment and independent audit, undertake due diligence to verify that algorithmic software does not pose risks to data principals, and observe any restrictions on transferring specified personal data outside India.

Question 14

How must consent withdrawal work under the DPDP framework?

Accepted Answer

Withdrawing consent must be as easy as giving it. When a Data Principal withdraws consent, the Data Fiduciary (and any processor acting on its behalf) must stop processing that personal data within a reasonable time and erase it, unless retention is required by law. Withdrawal does not affect the lawfulness of processing done before it.

Question 15

What exemptions exist under the DPDP Act and Rules?

Accepted Answer

Certain processing is exempt from many obligations - for example, processing necessary for research, archiving or statistical purposes (subject to prescribed standards), processing by the State for subsidies, benefits, services, certificates, licences or permits, and processing for legal rights, court functions, prevention or investigation of offences, and certain start-up or notified classes of Data Fiduciaries. The Act still requires data security and purpose limitation in many of these cases.

Question 16

Which law now governs personal data protection in India?

Accepted Answer

Personal data protection in India is governed by the Digital Personal Data Protection Act, 2023, read with the Digital Personal Data Protection Rules, 2025 (notified 14 November 2025). Together they regulate how organisations collect, use, store and share the personal data of individuals (Data Principals) located in India, and establish the Data Protection Board of India to enforce the law.

Question 17

How is a child's personal data protected under the DPDP Rules, 2025?

Accepted Answer

Before processing a child's personal data (a child is anyone under 18), a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian, and confirm the adult is identifiable using reliable identity and age details or a virtual token. The Act prohibits tracking, behavioural monitoring of children and targeted advertising directed at them. Certain classes such as healthcare and educational institutions may be exempted for specified purposes.

Question 18

What is the maximum penalty under the DPDP Act?

Accepted Answer

The DPDP Act provides financial penalties of up to Rs 250 crore for failure to take reasonable security safeguards to prevent a personal data breach. Other listed defaults include up to Rs 200 crore for failing to notify a breach or to fulfil obligations relating to children, and up to Rs 50 crore for other breaches. Penalties are imposed by the Data Protection Board after inquiry.

Question 19

What are the reasonable security safeguards required under the DPDP Rules, 2025?

Accepted Answer

Every Data Fiduciary must protect personal data through measures such as encryption, obfuscation or masking, virtual tokens, access controls, monitoring and logging to detect unauthorised access, retention of logs for at least one year, secure backups for recovery, and appropriate contractual safeguards with Data Processors. These obligations apply regardless of any contract with a processor.

Question 20

What are the DPDP duties of a Software Engineer?

Accepted Answer

A Software Engineer must ensure their specific department complies with Privacy Notice and Security rules.

DPDP Act 2025 Knowledge Base

Latest Updates