While the DPDP Act 2023 sets out broad statutory principles, the DPDP Rules 2025 operationalize the law with specific compliance mechanisms, notice templates, registration criteria, and strict timelines.
Rule 3 establishes the exact legal parameters for the statutory notice required under Section 5(1). Notice cannot be buried inside general terms and conditions. Key requirements include:
Itemized Purpose Specification: Each purpose of personal data processing must be stated individually and concisely.
Multilingual Availability: The Data Principal must be provided the option to view the notice in English or any of the 22 languages specified in the Eighth Schedule to the Constitution.
Grievance Redressal Direct Contact: Direct email and postal address of the designated Grievance Officer / DPO must be displayed prominently within the notice.
Rule 10: Appointment & Criteria of Data Protection Officer
Under Rule 10, Significant Data Fiduciaries designated under Section 10 are governed by explicit DPO operational criteria:
The DPO must be an individual resident in India.
The DPO must report directly to the Board of Directors or highest governing organ of the Data Fiduciary.
The DPO must be provided with adequate independence and resources to carry out statutory duties without conflicts of interest.
Breach Notification Procedure under DPDP Rules
The Rules prescribe the exact contents of the personal data breach report required under Section 8(6):
Nature, date, time, and circumstances of the personal data breach.
Estimated categories and numbers of Data Principals affected.
Likely operational and personal harm consequences.
Mitigating actions taken or proposed by the Data Fiduciary.
Contact details of the DPO handling inquiries from the Data Protection Board.
Audit Your Systems Against DPDP Rules 2025
LLM Advocates provides end-to-end audits benchmarking your notice formats, consent toggles, and DPO workflows against the latest procedural rules.