By Akash Sengar · · 8 min read
The three dates that matter
The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Rules, 2025 in the Gazette on 13 November 2025 (G.S.R. 846(E)). A separate notification the same day (G.S.R. 843(E)) brought parts of the Digital Personal Data Protection Act, 2023 into force in three phases. Both documents, with MeitY's own enforcement timeline, are on the MeitY DPDP Rules page.
- 13 November 2025: in force immediately. Definitions and the provisions that set up the Data Protection Board of India (Rules 1, 2 and 17 to 21, and the matching sections of the Act). The Board exists; most duties on businesses did not start yet.
- 13 November 2026: one year later. Rule 4 on the registration and obligations of consent managers, the companies that let people give, manage and withdraw consent through one platform.
- 13 May 2027: eighteen months later. Rules 3, 5 to 16, 22 and 23, and the core duties in the Act: notices, consent, security safeguards, breach intimation, retention and erasure, children's data, rights of data principals, grievance redress and Significant Data Fiduciary obligations.
If you are reading this in October 2026, the consent manager date is about five weeks away and the main compliance deadline about seven months away. Seven months is not long when the first step is finding out where personal data actually sits.
Now to November 2026: understand your data
Nothing in this phase is a legal duty for an ordinary business yet, which is exactly why it is the time to do the slow work.
- Build a data map. For each process (sales, support, HR, recruitment, marketing, finance), record what personal data you collect, from whom, why, where it is stored, who can access it and which suppliers touch it.
- Decide the basis for each purpose. Under the Act you process personal data either with consent or for a specified "legitimate use" (for example, employment purposes or a purpose the person voluntarily provided the data for). Write the basis next to each purpose in the map.
- Find children's data. Under the Act a child is anyone under 18. Note every place where you may collect children's data (schools, ed-tech, gaming, health, family accounts), because those flows need verifiable parental consent under Rule 10.
- List your processors. Every supplier that processes personal data for you (cloud, payroll, CRM, email, call centre) needs a contract. The Act lets a data fiduciary engage a processor only under a valid contract, and you stay responsible for what they do.
Our free DPDP readiness self-assessment is a quick way to see which of these areas is weakest before you start.
November 2026: consent managers go live
From 13 November 2026, consent managers can register with the Board. For most businesses this changes little on day one: you are not required to use a consent manager. It matters if you run a consumer platform where people may choose to manage consent through one, so your systems should be able to accept and honour consent given or withdrawn that way.
Use this phase to rewrite your notices. Rule 3 requires a notice that can be understood on its own, in clear and plain language, with an itemised description of the personal data, the specific purpose and the goods or services enabled, and a link or means to withdraw consent, exercise rights and complain to the Board. Withdrawing consent must be as easy as giving it.
By 13 May 2027: everything else
Reasonable security safeguards (Rule 6)
Rule 6 lists minimum safeguards: encryption, obfuscation, masking or virtual tokens where appropriate; access control; visibility of access through logs, monitoring and review; measures for continued processing after an incident, including backups; and contracts with processors that require the same. It also requires keeping logs and personal data needed to detect and investigate unauthorised access for one year, unless another law requires otherwise.
Breach intimation (Rule 7)
On becoming aware of a personal data breach, you must:
- Inform each affected data principal without delay, in plain language: what happened, likely consequences, what you are doing, what they can do to protect themselves, and a contact.
- Inform the Data Protection Board without delay with a description of the breach.
- Within 72 hours of becoming aware (or a longer period the Board allows on request), send the Board a detailed report: facts, circumstances and reasons, mitigation, findings about the person who caused it, remedial measures and the reports sent to affected people.
This is separate from the six-hour CERT-In reporting duty for cyber incidents, which already applies. One incident can trigger both.
Retention and erasure (Rule 8)
Personal data must be erased once the purpose is served and consent is withdrawn or no longer needed, unless another law requires you to keep it. For the large platforms listed in the Third Schedule (certain e-commerce, online gaming and social media intermediaries above user thresholds), Rule 8 sets a three-year inactivity period and a 48-hour warning before erasure. Everyone else should set retention periods per purpose and actually delete.
Rights and grievances (Rules 9, 14)
Publish the contact of a person who can answer questions about processing (or your Data Protection Officer, if you must have one). Publish how people can exercise their rights to access, correction, erasure and nomination. Rule 14 requires you to respond to grievances within a period you publish, not exceeding 90 days.
Significant Data Fiduciaries (Rule 13)
If the Government notifies you as a Significant Data Fiduciary, you must also appoint a Data Protection Officer based in India, appoint an independent data auditor, carry out a Data Protection Impact Assessment and an audit every 12 months, check that algorithmic software does not risk the rights of data principals, and follow any restrictions on transferring specified data outside India.
DPDP Act penalties
The Schedule to the Act sets maximum penalties per instance, imposed by the Board after an inquiry:
- Failure to take reasonable security safeguards to prevent a breach: up to ₹250 crore.
- Failure to notify the Board or affected people of a breach: up to ₹200 crore.
- Breach of the additional obligations for children: up to ₹200 crore.
- Breach of Significant Data Fiduciary obligations: up to ₹150 crore.
- Breach of any other provision of the Act or Rules: up to ₹50 crore.
The Board must consider the nature, gravity and duration of the breach, the type of data, repetition, any gain or loss avoided, mitigation and the effect on the person when deciding the amount. These are ceilings, not tariffs.
A month-by-month plan
- October to December 2026: data map, legal basis per purpose, processor list, children's data review.
- January to February 2027: new notices and consent flows; withdrawal as easy as consent; processor contracts updated.
- March 2027: safeguards on the systems that hold personal data, one-year log retention configured, retention schedule approved.
- April 2027: breach procedure written with the Board notice, affected-person notice and 72-hour report templates; one tabletop exercise.
- May 2027 onwards: rights and grievance process live, records kept, quarterly review.
For the full picture of what the Act requires, see our DPDP Act explainer.
This guide is general guidance, not legal advice.
