DPDP Rules 2025: what India’s data-protection rules mean for you

What a DPDP notice is meant to tell you

Under the notified framework, a consent request should not force you to hunt through a long privacy policy to understand the basics. The Act says a notice accompanying or preceding a consent request should identify the personal data and purpose of processing, explain how to exercise rights and say how a complaint can be made to the Board. It also provides for access to the notice in English or a language listed in the Constitution’s Eighth Schedule. [3]

Rule 3 adds detail for the future commencement phase. It says the notice should stand on its own, use clear and plain language, give an itemised description of personal data, and identify the specific goods, services or uses connected to the processing. It should also offer a way to withdraw consent, exercise rights and complain to the Board. [1]

### A useful way to read an app prompt

Imagine a grocery-delivery app requesting your name, delivery address, phone number and live location. A useful notice would help you distinguish data needed to deliver an order from a separate request, such as access to contacts or the microphone. The point is not that every optional permission is automatically unlawful. It is that a person should be able to see what is requested, why it is requested and what route exists to change a consent-based choice when the relevant provisions begin.

A consent screen may still have service consequences. The Act’s own example says that if a person withdraws consent connected with an online order already paid for, the service may continue processing data needed to supply that order. Withdrawal does not rewrite the past, and it does not override processing required or authorised by another law. [3]

Consent is not meant to be a blank cheque

The Act describes valid consent as free, specific, informed, unconditional and unambiguous, given through clear affirmative action. It is limited to personal data necessary for the stated purpose. [3]

In plain language, this points away from a vague “accept everything forever” approach. If a telemedicine service needs certain details to arrange a consultation, its request for unrelated access—such as a full contact list—should be distinguishable from what is necessary for that service. That is an illustration from the Act, not a verdict on any particular health app. [3]

The law also says withdrawal should be as easy as giving consent. When that framework is in force, look for a visible account, privacy or support route. Keep a record of an important request and response. This is sensible documentation, not a substitute for professional advice in a dispute.

What rights are expected in the May 2027 phase?

The official commencement notification places sections 11–14 of the Act in the 18-month phase. Subject to that schedule and any later official updates, the published framework gives people several important routes. [2] [3]

### Ask what data is being processed

A person who previously gave consent may request a summary of personal data being processed and the activities performed with it. The Act also provides for information about other Data Fiduciaries and Data Processors with whom the data has been shared, plus a description of what was shared, subject to stated exceptions. [3]

This is more useful than asking a support agent a broad question such as “What do you know about me?” A focused request might ask a service to explain the profile data tied to your account, the purposes for which it is processing it and the categories of recipients identified under the Act.

### Correct, complete, update or erase data

The framework provides for correction of inaccurate or misleading data, completion of incomplete data and updates to data. It also provides a route to request erasure. Erasure is not an unconditional “delete everything” button: an organisation may retain data when it is necessary for the specified purpose or to comply with another applicable law. [3]

For example, a wrong delivery address can be a correction issue. Closing a service account could lead to an erasure request, but records may need to be kept for legal, tax, fraud-prevention or other lawful reasons. The precise result depends on the service and the applicable law; this article cannot determine an individual outcome.

### Raise a grievance, then use the Board route when available

Section 13 says a Data Fiduciary or Consent Manager must provide readily available grievance redressal, and a person must first use that opportunity before approaching the Board. The Government’s November 2025 release said requests should receive a response within a maximum of 90 days, while the commencement schedule still matters for when this individual-rights mechanism takes effect. [3] [5]

A practical future sequence is: use the organisation’s documented privacy or grievance channel, describe the issue clearly, include relevant account details only through a trusted official channel, and preserve the response. If the relevant DPDP route is live and the grievance remains unresolved, the Board is the statutory body identified by the framework. The Board was established in November 2025 and is to have four members. [4] [6]

Important limitation: A public Board complaint website or mobile-app filing link was not verified in the official material reviewed for this article. Do not rely on a search advert, a lookalike site or a social-media link claiming to be the DPDP complaint portal. Check MeitY or the Board’s official communications first.

Children, guardians and accessibility

The published Act gives additional protection to children and to persons with disabilities who have a lawful guardian. It calls for verifiable parental or lawful-guardian consent before certain processing, restricts certain tracking, behavioural monitoring and targeted advertising directed at children, and includes stated exceptions and possible notifications. These provisions are also in the 18-month phase. [2] [3]

For families, the immediate lesson is not to assume that every age-check or parent-consent screen has already been redesigned under DPDP. Instead, read the service’s own terms, avoid sharing identity documents in response to unsolicited messages, and use a verified support channel if a child’s account data needs correction. For people who prefer a language other than English, the Act’s notice-language provision is significant: accessibility is part of understandable consent, not merely a design preference. [3]

DPDP privacy rights and cybersecurity are related—but different

A clear notice does not stop phishing. A strong phone lock does not by itself explain what a service does with data it collected legitimately. DPDP is primarily a framework for processing digital personal data and the associated responsibilities and rights; device security is a complementary, practical layer.

For simple actions that protect a handset, accounts and recovery options, read TechDuoPulse’s Smartphone Security Guide. For the broader technical context, see the site’s Cybersecurity Technology Guides. Those articles do not replace a service’s DPDP notice or decide an individual legal question.

India’s public digital systems also make these distinctions tangible. An account portability change, such as the OneTag FASTag issuer-bank portability service, can involve multiple organisations and records. It is a different topic from DPDP rights, but it illustrates why a person may need clear information about the organisation handling a particular part of a digital service.

What to do now—and what not to assume

You do not need to wait for May 2027 to make careful choices. Review the permissions and privacy controls offered by services you use, read notices before supplying sensitive information and use official support channels if account information is wrong. Treat unexpected links that request identity data or one-time codes as suspicious.

At the same time, do not assume that an app’s current design proves compliance or non-compliance with a provision that has not yet commenced. Do not assume a withdrawal will erase records that another law requires a company to retain. And do not assume a national framework means every interface, language option or complaint route is already available in identical form across every service in India.

The most durable takeaway is simple: DPDP Rules 2025 are designed to make the data relationship more legible—what is collected, why, what choice you have and where to raise a problem. The details of the live consumer journey should be checked again as the staged commencement dates arrive.

FAQs