The DPDP Rules, 2025: Reading the Compliance Clock Before May 2027

The Digital Personal Data Protection Act, 2023 received Presidential assent in August 2023, but for more than two years it had no operative machinery. That changed when the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 in November 2025, together with notifications bringing the Act into force in phases.

The Government chose a staggered approach rather than a single commencement date. That gives businesses time, but it also creates a risk that compliance programmes are deferred until the last few months. This paper explains the timeline, the core obligations and the operational changes that tend to take longest.

The three stages

The commencement notifications divide implementation into three tranches.

1. November 2025 (immediate). Definitions, the provisions establishing the Data Protection Board of India and its procedures, and the rule-making framework came into force. The Board functions digitally and is the authority that will investigate breaches and impose penalties.

2. November 2026 (twelve months). The framework for registration and obligations of consent managers becomes operative. Consent managers are entities registered with the Board that allow individuals to give, manage, review and withdraw consent through an interoperable platform.

3. May 2027 (eighteen months). The substantive obligations of data fiduciaries take effect, including notice and consent, security safeguards, breach notification, rights of data principals, children's data and the duties of significant data fiduciaries.

Sector regulators have not waited. The Reserve Bank of India, for example, has issued conduct directions for regulated entities that build a consent architecture closely resembling the DPDP framework, with an earlier effective date for banks and NBFCs. Businesses in regulated sectors should map both sets of obligations together.

Notice and consent

Where processing is based on consent, the data fiduciary must give a notice that is understandable on its own, presented independently of other information, and that lists the personal data and the specific purposes for which it is processed. The notice must explain how consent can be withdrawn with ease comparable to giving it, how rights can be exercised and how a complaint can be made to the Board.

The practical consequence is that bundled consents buried in terms of service will not suffice. Organisations will need itemised, purpose-specific consent flows and a reliable record of what each individual agreed to and when.

Reasonable security safeguards and breach reporting

The Rules describe minimum security measures, including encryption, obfuscation or masking of data, access controls, visibility over access through logs and monitoring, and measures for continued processing in the event of compromise. Logs and related data must generally be retained for at least one year to enable detection and investigation of unauthorised access.

On a personal data breach, the data fiduciary must inform affected individuals without delay, in plain language, describing the nature of the breach, its likely consequences and the steps taken. The Board must be informed without delay, with a detailed report within seventy-two hours setting out the facts, the mitigation measures and the findings regarding the person responsible, unless the Board allows a longer period.

Children and persons with disabilities

The Act treats every individual under eighteen as a child. Before processing a child's personal data, the data fiduciary must obtain verifiable consent of the parent, and must take due diligence measures to check that the person identifying as the parent is an adult. The Rules permit reliance on reliable identity details already held or on virtual tokens issued by authorised entities. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited, subject to limited notified exemptions such as for healthcare and educational institutions.

Retention and erasure

Personal data must be erased once the specified purpose is no longer served, unless retention is required by law. For certain large platforms, including e-commerce entities, online gaming intermediaries and social media intermediaries above prescribed user thresholds, the Rules specify a period of inactivity after which data must be erased, with prior notice to the individual. Every organisation should review its retention schedules against both the DPDP framework and sector-specific record-keeping laws.

Significant data fiduciaries

The Government may notify certain data fiduciaries as significant, based on the volume and sensitivity of data and risks to individuals or the State. Significant data fiduciaries must appoint a Data Protection Officer based in India, appoint an independent data auditor, carry out a data protection impact assessment and audit annually, and exercise due diligence over algorithmic software used in processing. The Rules also contemplate that specified categories of personal data processed by them may be subject to restrictions on transfer outside India on the recommendation of a committee.

Penalties

The Schedule to the Act sets out monetary penalties. The highest, up to ₹250 crore, applies to failure to take reasonable security safeguards to prevent a breach. Failure to notify a breach and breach of obligations regarding children can each attract penalties of up to ₹200 crore. Residual breaches carry penalties of up to ₹50 crore. The Board must consider factors such as the nature, gravity and duration of the breach and the steps taken to mitigate it.

Where programmes usually fall behind

• Data mapping. Most organisations do not have a reliable inventory of what personal data they hold, where it sits and which vendors receive it. Every other obligation depends on this exercise.

• Vendor contracts. Data processors are not directly regulated by the Act, so the fiduciary's protection lies in contract. Processing agreements with breach-notice obligations, audit rights and deletion commitments need to be renegotiated well before May 2027.

• Consent records. Systems must be able to prove consent and honour withdrawal across all downstream uses, including marketing tools and analytics.

• Incident response. A seventy-two-hour reporting window requires a tested playbook with clear ownership, not a policy document.

Conclusion

The DPDP framework is principle-based, but the Rules have added operational detail that will require real changes to systems, contracts and governance. With the consent manager stage arriving in November 2026 and the main obligations in May 2027, the window for an orderly programme is now measured in months. Organisations that start with a credible data map and a revised vendor framework will find the remaining steps far more manageable.