Why you can trust this course

1. (1) These rules may be called the Digital Personal Data Protection Rules, 2025. (2) They shall come into force as follows: (a) rules 1, 2 and 17 to 21 on the date of their publication in the Official Gazette; (b) rule 4 on the expiry of one year from the date of publication; (c) rules 3, 5 to 16, 22 and 23 on the expiry of eighteen months from the date of publication.

10. (1) A Data Fiduciary shall, before processing personal data of a child, adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained. (2) The verifiable consent shall be that the person identifying herself as the parent is an adult, either (a) by reference to reliable details of identity and age already available with the Data Fiduciary, or (b) by reference to identity and age details voluntarily provided by the parent, or by a virtual token mapped to such details, which is issued by an entity entrusted by law with maintaining such details, including a Digital Locker Service Provider.

12. The provisions of sub-sections (1) and (3) of section 9 shall not apply to the classes of Data Fiduciaries specified in the Fourth Schedule and to the extent of the purposes specified therein.

13. (1) A Significant Data Fiduciary shall (a) undertake, at least once in a period of twelve months from the date of its notification as such, (i) a Data Protection Impact Assessment; and (ii) an audit; and (b) publish and submit to the Board a report containing significant observations arising from such Data Protection Impact Assessment and audit. (2) A Significant Data Fiduciary shall exercise due diligence to verify that algorithmic software deployed by it for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data managed or processed by it is not likely to pose a risk to the rights of Data Principals. (3) A Significant Data Fiduciary shall undertake such measures as the Central Government may specify from time to time to ensure that personal data and traffic data pertaining to its flow, as may be specified, is not transferred outside India.

3. The notice given by a Data Fiduciary to a Data Principal under section 5 shall (a) be presented and be understandable independently of any other information that may be made available by such Data Fiduciary; (b) give in clear and plain language a fair account of the following details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, namely: (i) an itemised description of such personal data; and (ii) the specified purpose of and an itemised description of the goods or services to be provided or uses to be enabled by such processing; (c) provide the communication link for accessing the website or app or both of the Data Fiduciary; and (d) the manner in which the Data Principal may withdraw her consent, exercise her rights and make a complaint to the Board.

4. (1) A person seeking to be registered as a Consent Manager shall make an application to the Board fulfilling the conditions specified in Part A of the First Schedule. (2) A Consent Manager shall comply with the obligations specified in Part B of the First Schedule. (3) The Board may register a Consent Manager fulfilling the conditions and may cancel or suspend registration for non-compliance.

6. (1) A Data Fiduciary shall protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach, which shall include, at the minimum: (a) appropriate data security measures, including securing personal data through its encryption, obfuscation or masking or the use of virtual tokens mapped to personal data; (b) appropriate measures to control access to the computer resources used by the Data Fiduciary or the Data Processor; (c) visibility on access to such personal data, through appropriate logs, monitoring and review; (d) reasonable measures for detection of unauthorised access and its mitigation, including through appropriate measures for continued processing in the event of confidentiality, integrity or availability of personal data being compromised; (e) reasonable measures for continued processing in the event of a personal data breach and enabling the investigation, including through appropriate retention of logs and personal data for a period of one year unless a longer period is required by law; (f) appropriate provisions in the contract entered into between the Data Fiduciary and Data Processor for taking such reasonable security safeguards; and (g) appropriate technical and organisational measures to ensure that the reasonable security safeguards are effectively implemented.

DPDP Rules 2025 Rule 7. On becoming aware of any personal data breach, the Data Fiduciary shall intimate each affected Data Principal in a concise, clear and plain manner and without delay; and shall intimate the Data Protection Board without delay of the initial description, followed by an updated and detailed report within seventy-two hours of becoming aware (extendable on written request to the Board).

8. (1) The Data Fiduciaries and purposes as specified in the Third Schedule shall be deemed to no longer be serving the specified purpose if the Data Principal has, for the time period specified therein, neither approached the Data Fiduciary for the performance of the specified purpose, nor exercised any of her rights in relation to such processing, and the Data Fiduciary shall erase such personal data unless retention is required for compliance with any law for the time being in force. (2) The Data Fiduciary shall, at least forty-eight hours before the time period specified in the Third Schedule expires, inform the Data Principal that unless she takes an action indicating continued use of the specified purpose or exercise of rights, her personal data will be erased. (3) Retention of personal data, traffic data and logs by the Government or its instrumentalities may be for a period as prescribed under the Seventh Schedule for purposes related to sovereignty and integrity of India, security of the State, public order or similar functions.

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Article 5. Summary of prohibited practices (consult the Regulation for verbatim text): (a) AI systems that deploy subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques, with the objective or effect of materially distorting the behaviour of a person or a group of persons in a manner that causes or is reasonably likely to cause significant harm. (b) AI systems that exploit vulnerabilities of a natural person or a specific group of persons due to age, disability or a specific social or economic situation, with the objective or the effect of materially distorting behaviour and causing or reasonably likely to cause significant harm. (c) AI systems for the evaluation or classification of natural persons or groups over a certain period based on their social behaviour or known, inferred or predicted personal or personality characteristics, where the social score leads to detrimental or unfavourable treatment (social scoring by public and private actors, with limited exceptions). (d) AI systems for making risk assessments of natural persons in order to assess or predict the risk of a natural person committing a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics (predictive policing based solely on profiling). (e) AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage. (f) AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use is for medical or safety reasons. (g) Biometric categorisation systems that categorise individual natural persons based on their biometric data to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (with certain law-enforcement exceptions). (h) The use of real-time remote biometric identification systems in publicly accessible spaces for the purposes of law enforcement (with narrow, court-authorised exceptions). The Article 5 prohibitions apply from 2 February 2025, six months after the Regulation entered into force on 1 August 2024. Non-compliance is subject to the highest tier of administrative fines under Article 99: up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 percent of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Regulation (EU) 2024/1689, Article 50. Summary of transparency duties (consult the Regulation for verbatim text): (1) Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, or unless the use is authorised by law to detect, prevent, investigate or prosecute criminal offences. (2) Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content shall ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Solutions shall be effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of different types of content, the costs of implementation, and the generally acknowledged state of the art. (3) Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system and shall process the personal data in compliance with the applicable Union data protection law. (4) Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake shall disclose that the content has been artificially generated or manipulated (with narrow artistic, satirical, and law-enforcement exceptions). Where the content is part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosing the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work. (5) The information referred to in paragraphs (1) to (4) shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. Article 50 applies from 2 August 2026.

Regulation (EU) 2024/1689, Article 6 read with Annexes I and III. Summary of the classification rule (consult the Regulation and Annexes for verbatim text): An AI system is high-risk if either: (a) it is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I, and is required to undergo third-party conformity assessment under that legislation (for example, machinery, toys, radio equipment, medical devices, in vitro diagnostic medical devices, civil aviation security, marine equipment, and other listed sectoral legislation); or (b) it is an AI system referred to in Annex III (the standalone high-risk list). Annex III lists the following categories as high-risk: 1. Biometrics (remote biometric identification, biometric categorisation according to sensitive attributes, and emotion recognition systems, except those prohibited under Article 5). 2. Critical infrastructure (AI systems intended to be used as safety components in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating and electricity). 3. Education and vocational training (AI systems for determining access, admission, evaluation of learning outcomes, assessing appropriate level of education, and monitoring/detecting prohibited behaviour during tests). 4. Employment, workers management and access to self-employment (AI systems for recruitment or selection, decisions affecting terms of relationships, promotion and termination, task allocation based on behaviour or characteristics, and monitoring and evaluating performance and behaviour). 5. Access to essential private services and essential public services and benefits (AI systems used by public authorities to evaluate eligibility for benefits and services, credit scoring for natural persons (with limited exceptions), risk assessment and pricing for life and health insurance, and emergency call classification and dispatching). 6. Law enforcement (with a range of specific systems including risk assessments, polygraphs, evidence evaluation, profiling of persons, crime analytics). 7. Migration, asylum and border control management (risk assessments, examination of applications, and detection/recognition/identification systems in these contexts). 8. Administration of justice and democratic processes (AI systems to assist judicial authorities in research and interpretation of facts and law, and AI systems influencing the outcome of elections or referenda, or the voting behaviour of natural persons). High-risk systems carry the Chapter III obligations, including: risk management (Article 9); data and data governance (Article 10); technical documentation (Article 11); record-keeping (Article 12); transparency and provision of information to deployers (Article 13); human oversight (Article 14); accuracy, robustness and cybersecurity (Article 15); and conformity assessment before market placement (Article 43). The high-risk regime applies from 2 August 2026, twenty-four months after entry into force.

ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system. Published December 2023 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Summary (consult the standard for full text): ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) within the context of the organisation. It is designed to help organisations responsibly develop and use AI systems. Structure follows the ISO harmonised management-system structure, with clauses on: (4) Context of the organisation, including AI-specific considerations of the internal and external environment. (5) Leadership, including AI policy and roles. (6) Planning, including AI risk assessment and AI risk treatment, and objectives. (7) Support, including resources, competence, awareness, communication and documented information. (8) Operation, covering operational planning and control, AI system impact assessment, and management of AI system life cycle. (9) Performance evaluation, including monitoring, measurement, analysis and evaluation, internal audit, and management review. (10) Improvement, including nonconformity, corrective action and continual improvement. Annex A lists reference controls for AI system life cycle stages, AI use, third-party relationships, and AI system data. ISO/IEC 42001 is certifiable. An organisation can be audited to the standard by a certification body and receive a certificate similar to ISO 27001 certification for information security. Certification does not by itself satisfy any statutory AI obligation but provides a defensible, internationally recognised governance framework that overlaps significantly with the diligence expected under DPDPA Rule 12(2) for Significant Data Fiduciaries deploying algorithmic systems.

NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1, published January 2023 by the U.S. National Institute of Standards and Technology. Summary (consult the Framework for full text): The AI RMF is a voluntary framework that helps organisations and individuals design, develop, deploy and use AI systems in ways that are trustworthy. It is organised around four functions: (1) Govern. Culture, policies, processes and structures for AI risk management across the organisation. Includes accountability, roles, and integration with existing risk-management practices. (2) Map. Establishing the context in which the AI system operates: purpose, capabilities, benefits, risks, and the categories of persons potentially affected. Requires identifying interested parties and the specific tasks the system will perform. (3) Measure. Assessing, analysing and tracking AI risks and impacts using quantitative, qualitative or mixed-method tools. Covers dimensions such as accuracy, reliability, robustness, safety, security, resilience, accountability, transparency, explainability, interpretability, privacy, and fairness (managing harmful bias). (4) Manage. Prioritising and acting on risks. Allocating resources to risks based on impact and likelihood, applying mitigations, planning responses, and communicating with interested parties. The Framework is technology-neutral and sector-agnostic. It was developed through open consultation and is widely cited as a common vocabulary for AI risk in the enterprise. A Generative AI Profile (NIST AI 600-1) was released in July 2024, extending the framework to generative and dual-use foundation models. AI RMF is not law. It is a reference practice document. Adopting the Framework does not by itself satisfy any statutory obligation, but it provides a defensible baseline that regulators, auditors, and courts recognise.

Reserve Bank of India, Draft Guidance on Regulatory Expectations for Data Governance, released July 2026 on the RBI Connect 2 Regulate portal for stakeholder comments until 17 August 2026. Summary of key provisions (consult the draft for verbatim text): Applicability. Commercial banks (including small finance banks, payments banks, regional rural banks), primary (urban) cooperative banks, state and district central cooperative banks, all-layer non-banking financial companies, all-India financial institutions, asset reconstruction companies, and credit information companies. Data Governance Framework. Every Regulated Entity shall put in place a comprehensive, board-approved Data Governance Framework aligned with its enterprise risk management framework and shall ensure compliance with the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. The Framework covers scope, data architecture, data risk management, ownership and RACI across the data lifecycle, data quality management, data classification, and third-party arrangements. Governance structure. A Board-level Data Governance Committee (either standalone or a delegated existing board committee) is responsible for approving the Framework and receiving periodic data quality and risk reports. An Executive Data Governance Committee implements the policy operationally and coordinates escalation and consent dispute resolution. Data Function. A dedicated Data Function is required, headed by an officer not below the rank of Chief General Manager or equivalent, coordinating across business, risk and technology. Organisational roles. Data Owner (defines and classifies data within a domain, designates the Single Source of Truth, approves sharing and usage rules, owns data quality outcomes, approves exceptions). Data Steward (day-to-day implementation, maintains data definitions and documentation, monitors flows, reports material issues). Data Custodian (technical enforcement of access controls, encryption, metadata and lineage systems, retention and disposal). Single Source of Truth. One authoritative source for each data element, with reconciliation controls. No parallel or competing SSOTs. Metadata and lineage. Foundational attributes (ownership, classification, usage intent, consent status) are stamped at the point of data origination and travel through downstream transformations. Reclassification is required when aggregation or enrichment changes the sensitivity or category of the data (for example, inferred health data derived from payment data). Data quality management. The Framework must address accuracy, consistency, confidentiality, integrity and traceability, with metrics reported to the Board Data Governance Committee. Third-party data sharing. Accountability remains with the Regulated Entity. Third-party access is on a need-to-know basis, subject to non-disclosure obligations, encryption, authentication, auto-deletion and de-duplication where applicable, CERT-In empanelled third-party audits, and full traceability back to the SSOT. The Regulated Entity retains cascading accountability across sub-processors. DPDP alignment. The Guidance is explicitly framed to operationalise the DPDP Act 2023 and the DPDP Rules 2025 for the financial sector, supporting obligations related to Significant Data Fiduciary designation under Section 10, Data Protection Impact Assessment under Rule 12, consent status tracking under Sections 5 and 6, personal data breach notification, and processor obligations under Sections 8(5) and 8(6). Status. Draft for comment. Comments are invited on the RBI Connect 2 Regulate portal until 17 August 2026. The final Guidance is expected to be notified as a Master Direction or a Notification. Regulated Entities are advised not to wait for the final Guidance but to undertake a comprehensive gap assessment covering governance structures, DPDPA compliance, data architecture, third-party arrangements, AI governance and operational resilience.