Centre Notifies DPDP Rules 2025, RTI Amendment 2025 Comes Into Force

The Centre, on Friday, notified the Digital Personal Data Protection (DPDP) Act, 2025, bringing some of the rules into effect immediately. The notification comes nearly 10 months after the DPDP Rules, 2025, a draft of the bill was circulated in January. Among the rules that come into effect now is the Right to Information (RTI) Act, 2005, amendment. The rules entrust Data Fiduciaries with several key responsibilities, including adopting technical and organisational measures to ensure that a parent can give their consent before a minor's data can be processed.

Centre Notifies DPDP Act, 2025 Rules After Two Years

In a notification published by the Ministry of Electronics and Information Technology (MeitY), the government shared the rules under the Act, as well as the roadmap towards its enforcement. Interestingly, instead of bringing the entire act into force immediately, the Centre has taken a staggered approach, rolling out the rules in several phases over a period of 18 months.

One of the rules that comes into effect immediately aims to protect the privacy of public officials, enforcing the recent amendment to the RTI Act, 2025. The DPDP Act also establishes the Data Protection Board of India and finalises the number of members in the board.

Coming to the key features of the DPDP Act, the government's newly created position of a Data Fiduciary, who is a person who, alone or in conjunction with other persons, determines the purpose and the right way to process personal data. The Data Fiduciary has several responsibilities, including sending independent and plainly-worded notices to the Data Principal. The Data Fiduciary shall also undertake annual Data Protection Impact Assessment and audits to ensure that the provisions of the Act and the rules made under it remain effective.

The Act also mentions registration of Consent Managers by the Data Protection Board (DPB). The Board is also given the power to, if it is satisfied that it is necessary so to do in the interests of Data Principals, suspend or cancel the registration of such Consent Manager.

Apart from this, the DPDP Act, 2025, also highlights rules about Government's data processing standards, security safeguards, data retention limits, verifiable consent for children, exemptions for child-data processing, and a user rights framework.