DPDP Rules 2025: what applies when, and what to do before May 2027

The Digital Personal Data Protection Act, 2023 sets out the duties. The Digital Personal Data Protection Rules, 2025 fill in the detail. The Rules were notified on 13 November 2025 as G.S.R. 846(E), and they do not all apply at once. Rule 1 sets three starting points, and most of what a business has to do sits in the last of them.

Stage one: November 2025

Rules 1 and 2 (title and definitions) and Rules 17 to 21 came into force on publication. Rules 17 to 21 deal with the Data Protection Board itself: how its Chairperson and members are selected, their terms of service, how the Board meets, its working as a digital office, and its staff. Nothing in this stage places new day to day duties on a business. It builds the regulator that will later enforce the law.

Stage two: November 2026

Rule 4 starts one year after publication, in November 2026. It sets out how Consent Managers are registered with the Board and what they must do. A Consent Manager is a registered platform through which a person can give, manage, review and withdraw consent across businesses. Applicants must meet the conditions in the First Schedule, including a minimum net worth of two crore rupees. Few businesses will become Consent Managers, but once they exist, a business should expect some people to give or withdraw consent through one, and should be ready to act on it.

Stage three: May 2027

Rules 3, 5 to 16, 22 and 23 start eighteen months after publication, which places them in May 2027. This is when the duties of a Data Fiduciary, the business that decides why and how personal data is processed, become operational:

• Notice (Rule 3). A notice that can be understood on its own, itemises the personal data and the specific purposes, and explains how to withdraw consent, exercise rights and complain to the Board. Withdrawing consent must be about as easy as giving it.
• Security safeguards (Rule 6). Reasonable measures including encryption, masking or tokenisation, access control, logging and monitoring, and backups, with logs kept for a year. The contract with each Data Processor must contain security safeguards.
• Breach intimation (Rule 7). Affected people must be told without delay, in plain language. The Board must be told without delay and given a detailed report within 72 hours, or a longer period the Board allows.
• Retention and erasure (Rule 8). Personal data is erased once its purpose is served, unless the law requires it to be kept. Large ecommerce, social media and online gaming platforms have a fixed three year period under the Third Schedule, and must warn the person at least 48 hours before erasure.
• Contact details (Rule 9). Prominently publish who answers questions about processing, and repeat it in every reply to a rights request.
• Children and persons with disability (Rules 10 to 12). Verifiable consent of a parent before processing a child's data, checks on lawful guardians, and a limited set of exemptions.
• Significant Data Fiduciaries (Rule 13). Businesses notified as significant must carry out a data protection impact assessment and an audit every twelve months.
• Rights and grievances (Rule 14). Publish how people can exercise their rights, and resolve grievances within a period that may not exceed 90 days.
• Transfers outside India (Rule 15). Allowed, subject to any conditions the Central Government sets by order.

Rules 22 and 23, on appeals to the Appellate Tribunal and on government requests for information, also start then.

What has changed since November 2025

Two developments matter. First, in January 2026 the press reported a proposal to shorten the eighteen month period to twelve months, at least for some obligations. When this article was last checked, no amending notification had been issued, so May 2027 remains the date in force. Treat it as the latest date, not a comfortable one: if the period is shortened, a business that has already started will not be caught out.

Second, on 5 October 2026 the Central Government issued the Digital Personal Data Protection (Removal of Difficulties) Order, 2026. It corrects the wording of two provisions of the Act. Section 9(1) now reads clearly that verifiable consent is needed before processing a child's data, and before processing the data of a person with disability who has a lawful guardian. Section 10(2)(c)(ii) now refers to a data audit, matching the independent data auditor that Significant Data Fiduciaries must appoint. Neither change moves any date.

Why waiting is a risk

The Schedule to the Act sets penalties of up to 250 crore rupees for failing to take reasonable security safeguards to prevent a breach, and up to 200 crore rupees each for failing to report a breach and for failing to meet the duties on children's data. Most of the work that avoids those outcomes is not legal drafting but operational change: knowing what data you hold, changing how it is collected, setting up processes and renegotiating vendor contracts. That takes months, and several pieces depend on each other.

A practical order of work

1. Map what you hold. List the personal data you collect, where it comes from, why you use it, where it is stored and who receives it. Everything else depends on this inventory.
2. Decide the basis for each purpose. For most processing this is consent; some falls under the legitimate uses in Section 7 of the Act. Record which applies and why.
3. Rewrite notices and consent flows. Itemise the data and purposes, add the routes to withdraw consent and to complain, and keep a record of each consent.
4. Close security gaps against Rule 6. Check encryption, access control, logs kept for a year, and backups. A business with an information security programme may already cover much of this.
5. Fix vendor contracts. Every Data Processor needs a valid contract with security safeguards, prompt breach notice and erasure obligations.
6. Build breach and rights processes. Decide who assesses a breach, who notifies the Board and the people affected, and how requests and grievances are answered within the limits.
7. Set retention periods. For each category of data, decide how long you keep it and how you will erase it.
8. Check children's data. If children use your product or service, plan verifiable parental consent and avoid tracking, behavioural monitoring and targeted advertising directed at them.

A business that starts now has time to do this properly. One that starts in 2027 will be making the same changes in a hurry, with less room to test them.