DPDP Rules 2025 Explained for HR and Admin Teams

Published on 10/18/2026 • Updated on 10/22/2026

Banner illustration for the article: DPDP Rules 2025 Explained for HR and Admin Teams

An HR manager opens a folder of employee files, an admin head looks at a visitor register and a courier log, and both wonder the same thing: what exactly does the new data protection law expect of us, and by when? The Act has been on the books since 2023, and the detailed Rules arrived in November 2025.

This guide explains the Digital Personal Data Protection Rules, 2025 in plain language for people who run HR and administration, not law. It sets out what the Rules are, who they apply to, the duties that matter most for an office or plant, and a first list of tasks. It is not legal advice, so confirm the details with your own legal adviser.

On this page

The Act and the Rules in brief

Parliament enacted the Digital Personal Data Protection Act on 11 August 2023, according to a Press Information Bureau release dated 17 November 2025. The Government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025. The Act sets the principles and the penalties. The Rules fill in how the duties work in practice.

The Act uses three terms you will see often. A Data Fiduciary is the organisation that decides why and how personal data is processed. A Data Principal is the person the data is about. A Data Processor handles data on a fiduciary's behalf. An employer is a fiduciary for staff data, and a facility is one for visitor data.

Key idea: If your organisation decides why personal data is collected, the duties in the Rules fall on you, even when a vendor stores the data.

What counts as personal data for HR and admin

  • HR: employee files, attendance, payroll details, medical forms, CVs and interview notes.
  • Admin: visitor registers, courier and mailroom logs, CCTV footage, ID card copies and parking records.
  • Security: access logs, biometric attendance templates and incident reports that name people.

The Act applies to digital personal data and to personal data collected in non-digital form that is later digitised. A paper register that is scanned or typed into a spreadsheet falls within the Act. Ask your legal adviser how it applies to your records.

The duties that matter most

Rule What it asks Where it shows up
Rule 3: Notice Give a clear notice listing the personal data and the purpose, with how to withdraw consent, exercise rights and complain to the Board Visitor form, HR joining forms, CCTV signs
Rule 6: Security safeguards Use measures such as encryption, masking, access control, logs and backups, and keep logs for one year Registers, HR files, attendance systems
Rule 7: Breach intimation Tell affected people without delay, and tell the Board without delay with detailed information within 72 hours Lost files, misdirected emails, hacked systems
Rule 8: Retention and erasure Keep certain data and logs for a minimum of one year, then erase unless other law requires retention Visitor logs, access logs, HR records
Rule 9: Contact Publish contact details of a person who answers questions Website, notices
Rule 14: Rights Publish how people can exercise rights and respond to grievances within a period not exceeding 90 days Website, HR portal

Each row is a task for someone. Rule 3 is a drafting task. Rule 6 is a mix of IT and process. Rule 7 needs a named decision maker. Rule 8 needs a schedule and an owner.

The Rules also say the notice must be understandable on its own, independent of other information the organisation makes available. In practice that means a short, plain page at the point of collection, not a link to a long privacy policy. A visitor at a gate has seconds, so the notice has to be readable at a glance: what you collect, why, and who to ask.

Rule 6 is the broadest duty. It asks for appropriate security measures such as encryption, masking or virtual tokens, controls on access, logs that show who accessed data, backups and contract terms with processors. For a visitor register, masking phone numbers and limiting who can search the log are the first practical steps.

Children and persons with disability

Rule 10 requires verifiable consent from a parent or lawful guardian before processing a child's personal data, with exemptions listed in Rule 12. Rule 11 sets a similar approach for a person with a disability who has a lawful guardian. Schools, hospitals and some workplaces with minors on site, such as apprentices, must check how these rules apply to them.

Fix the visitor gate first

VisitorFlow keeps visitor data in one searchable log with role-based access.

Explore Visitor Management Software

When the Rules apply

Rule 1 sets the commencement. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4, on consent managers, comes into force one year after publication. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. That falls around mid-May 2027.

⚠️ Compliance note: Confirm the exact date with your legal adviser, because it depends on the gazette date of publication. Treat mid-May 2027 as the planning date and begin earlier.

What the penalties look like

The Schedule to the Act sets maximum penalties. A failure to take reasonable security safeguards can attract a penalty of up to two hundred and fifty crore rupees. Failure to notify a breach, or to meet the extra duties for children, can each reach up to two hundred crore rupees. Other breaches can reach up to fifty crore rupees. These are maximums set by the Schedule, and the Data Protection Board decides each case.

A first task list for HR and admin

Step 01

List where personal data sits

Walk through HR, security, mailroom and reception and list every register, form, camera and system that holds personal data.

Step 02

Write the purpose and the retention for each

For each item, write why you hold it, who sees it and how long you keep it.

Step 03

Draft the notices and the contact

Draft a short notice for each collection point and name the person who answers questions.

Step 04

Agree a breach and erasure routine

Name who decides on a breach and who handles requests. Test the routine once.

Start with the gate and the HR joining form, because they collect data from many people every week.

Mistakes to avoid

Leaving it to IT

Most personal data sits in paper files, registers and cameras that IT does not own.

Over-collecting

Fields with no stated purpose are the first to remove.

Start with the busiest collection point

The gate and the joining form touch the most people.

Another mistake is waiting for the date. The routines in the Rules take months to build, and the first breach will not wait for May 2027.

A 30-day starter plan

Use the next month to get from no plan to a first plan.

Step 01

Week 1: inventory

List every place HR, admin and security collect personal data. Include paper and cameras.

Step 02

Week 2: purpose and retention

For each item, write the purpose, who sees it and how long it stays.

Step 03

Weeks 3 and 4: notices and routines

Draft the notices, name the contact person and write one-page breach and erasure routines.

Share the plan with the legal adviser and the management team at the end of the month.

Five-minute self-check

Check where you stand against these points.

Answer yes or no

  • ☐ Do you know every place personal data is collected?
  • ☐ Is there a notice at the gate and on HR forms?
  • ☐ Is someone named to decide on a breach?
  • ☐ Is there a written retention period for visitor and HR records?
  • ☐ Is there a published way to ask for data to be corrected or erased?

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

What are the DPDP Rules, 2025?

They are the rules notified on 14 November 2025 that explain how the Digital Personal Data Protection Act, 2023 works in practice, including notice, security, breach reporting, erasure and rights.

Do the Rules apply to employee data?

Yes. An employer that decides why and how staff data is processed is a Data Fiduciary for that data. Ask your legal adviser about any exemptions that may apply.

When do the main duties start?

Rule 1 sets eighteen months from publication for Rules 3 and 5 to 16 among others. That falls around mid-May 2027. Confirm the exact date with your adviser.

How fast must a breach be reported?

Rule 7 requires intimation to affected people without delay and to the Board without delay, with detailed information within seventy-two hours.

Does a visitor register count?

Visitor names and phone numbers are personal data. The Act covers digital data and data later digitised. Ask your adviser how it applies to your register.

Is this legal advice?

No. It is a plain-language summary of the Rules. Confirm the details with your own legal adviser.

Bottom line

The Rules turn a broad law into a short list of duties: notice, safeguards, breach reporting, erasure, rights and special care for children. For HR and admin teams, the work starts with a list of where personal data sits.

Start with the busiest collection points, write the notices and name the owners. The date will arrive sooner than it seems.

Bring the gate in line with the Rules

VisitorFlow runs visitor, material gate pass, courier, maintenance and incident workflows on one cloud platform.

Explore Visitor Management Software See Material Gate Pass Software Book a Free Demo
Author of the Blog Post
Aadeshwar Modi
Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.

Recent Post