The DPDP Rules, 2025: What Applies Now, What Applies in November 2026, and What Applies in May 2027

When the Digital Personal Data Protection Act, 2023 received the President’s assent in August 2023, it could not do much on its own. Almost every operative duty depended on rules that had not yet been written. Those rules, the Digital Personal Data Protection Rules, 2025, were notified on 13 November 2025, and they bring the Act into force in three stages.

The question we hear most often from clients is a simple one: what do we have to do, and by when? This note answers it.

Stage one: 13 November 2025

The provisions that took effect on notification are institutional. They define terms and set up the Data Protection Board of India: how its members are appointed, how it functions as a digital office, and how its proceedings run. For most businesses, nothing changed operationally on that day. The regulator, however, now exists.

Stage two: 13 November 2026

One year after notification, the provisions on Consent Managers take effect. A Consent Manager is a registered intermediary through which a person can give, manage, review and withdraw consent across different businesses, using an interoperable platform. To register with the Board, a Consent Manager must be a company incorporated in India with adequate technical, operational and financial capacity, including a minimum net worth, and it owes duties to the people who use it, not to the businesses it connects them with.

For most businesses, the practical question in stage two is whether to accept consent through Consent Managers, and how their consent systems will talk to them.

Stage three: 13 May 2027

Eighteen months after notification, the substantive obligations commence. This is the date that matters.

Notice

Every request for consent must be accompanied by a notice that can be understood on its own, without reference to other documents. It must give an itemised description of the personal data and the specified purpose for which it is processed, and explain how the person can withdraw consent (as easily as it was given), exercise their rights and complain to the Board.

Security safeguards

The Rules list minimum measures: encryption, obfuscation, masking or the use of virtual tokens; controlled access; visibility over access through logs and monitoring; measures for continued processing if confidentiality, integrity or availability is compromised; and contracts with processors that require the same safeguards. Logs and the related personal data must be kept for a year to detect and deal with unauthorised access, unless the law requires longer.

Breach intimation

On becoming aware of a personal data breach, a business must inform each affected person without delay, in plain language: what happened, the likely consequences, what is being done, what they can do to protect themselves, and whom to contact. It must also inform the Board without delay, and send a detailed report within 72 hours, covering the facts, the cause, the people affected, the mitigation and the findings about who caused it.

That is in addition to the CERT-In Directions of April 2022, which already require many cyber incidents to be reported to CERT-In within six hours. One incident can trigger both.

Erasure and retention

Personal data must be erased once the purpose is served, or once consent is withdrawn, unless the law requires it to be kept. For the largest e-commerce entities, online gaming intermediaries and social media intermediaries, the Rules fix the period: data must be erased three years after the person last used the service or exercised their rights, with at least 48 hours’ notice before erasure. Separately, all businesses must keep personal data, traffic data and logs for at least one year for the purposes the Rules specify.

Rights and grievances

Businesses must publish, on their website or app, how a person can exercise their rights to access, correction, erasure and nomination, and the contact details of a person who can answer questions about processing (the Data Protection Officer, for a Significant Data Fiduciary). They must respond within the period they publish, which cannot be more than 90 days.

Children and persons with disabilities

Before processing the personal data of anyone under 18, a business must obtain the verifiable consent of a parent, after taking due diligence to check that the person giving consent is an identifiable adult. The Rules exempt certain classes of processing, for example by healthcare providers and educational institutions, and for specified purposes such as a child’s safety. Similar rules apply to the lawful guardians of persons with disabilities.

Significant Data Fiduciaries

Businesses that the government notifies as Significant Data Fiduciaries must appoint a Data Protection Officer based in India, carry out a data protection impact assessment and an audit every year, check that their algorithmic software does not pose a risk to people’s rights, and may be required to keep specified personal data in India.

What applies until May 2027

The old regime has not gone away. Until the relevant provisions of the DPDP Act commence, section 43A of the Information Technology Act and the SPDI Rules, 2011 continue to require a published privacy policy, reasonable security practices and consent for sensitive personal data. The CERT-In Directions continue to apply as well.

A practical plan

Most organisations need nine to twelve months to prepare, mainly because the work cuts across legal, product, IT and vendor management. A sensible order:

1. Map the data. What personal data you hold, where it comes from, why, where it is stored, who can access it and which vendors process it.
2. Decide the basis for each purpose: consent, or one of the “legitimate uses” in section 7, such as employment or data given voluntarily for a specified purpose.
3. Rewrite notices and consent flows so they stand on their own, and make withdrawal as easy as giving consent.
4. Fix vendor contracts. Every processor needs a contract that imposes your security and deletion obligations.
5. Build a breach playbook that meets both the six-hour CERT-In clock and the 72-hour Board report.
6. Write a retention schedule, and start keeping the one-year logs now.
7. Deal with children’s data: age assurance where needed, and verifiable parental consent.
8. Set up the rights and grievance process, and publish it.

Not sure where to start? Our free DPDP Readiness Check asks about twenty questions and our team sends back a written report. For quick answers, see our DPDP FAQs and our data protection practice.

This article is for general information and states the law as at 12 October 2026. It is not legal advice. For advice on your situation, contact the firm. Published by BRB Legal.