DPDP Rules compliance deadline: what applies when
Updated · Rotomal
The Digital Personal Data Protection Rules, 2025 were published in the Gazette in November 2025 and apply in three phases. Rules 1, 2 and 17 to 21 applied at once; Rule 4 on Consent Managers applies one year after publication, from November 2026; and Rules 3, 5 to 16, 22 and 23, which carry the main duties for businesses, eighteen months after publication. Most advisers use 13 May 2027 for that last phase.
The three phases
| When | Rules | What they cover |
|---|---|---|
| On publication (November 2025) | 1, 2 and 17 to 21 | Commencement, definitions and the Data Protection Board |
| One year after publication (November 2026) | 4 | Registration and obligations of Consent Managers |
| Eighteen months after publication (May 2027) | 3, 5 to 16, 22 and 23 | Notice, security safeguards, breach intimation, retention and erasure, contact details, children's and disabled persons' data, rights and other duties |
The Gazette notification is dated 13 November 2025, while the government's press backgrounder says the Rules were notified on 14 November 2025, which is why both 13 and 14 May 2027 appear in commentary.
What the May 2027 duties mean for a small business
- Give a stand-alone notice with an itemised list of personal data and the specific purposes before asking for consent (Rule 3).
- Take reasonable security safeguards, including encryption or masking, access control, logs kept for a year and backups (Rule 6).
- Tell affected people about a breach without delay, and send the Board a detailed report within 72 hours (Rule 7).
- Keep personal data, traffic data and processing logs for at least a year, then erase them unless another law requires more (Rule 8).
- Publish the business contact of a person who can answer privacy questions (Rule 9).
- Get verifiable parental consent before processing a child's data (Rule 10).
- Answer requests to access, correct, update or erase data within ninety days.
Penalties under the Act
| Breach | Maximum penalty |
|---|---|
| Failing to maintain reasonable security safeguards | ₹250 crore |
| Not notifying the Board or affected people of a breach | ₹200 crore |
| Violating obligations on children's data | ₹200 crore |
| Any other violation of the Act or Rules | ₹50 crore |
Could the date change?
In January 2026, press reports said MeitY had asked industry for views on shortening the eighteen-month period to twelve months, with comments due on 4 February 2026; some reports said the change would apply only to Significant Data Fiduciaries. When we checked on 3 November 2026 we had found no notified amendment, and the Gazette text still says eighteen months. Treat May 2027 as the latest date, not a reason to wait.
What to do first
Map where you collect personal data, rewrite your notice and consent wording, publish a privacy contact, and write down what you would do in the first 72 hours of a breach. DPDP Ready does this for small businesses at a fixed price, from a ₹499 check of your website to ₹2,999 for one site.
Questions
Is 13 November 2026 a deadline for every business?
No. Rule 4, which comes into force one year after publication, covers the registration and obligations of Consent Managers. It does not start the main duties for other businesses.
Is the Data Protection Board set up?
The Board's provisions applied on publication in November 2025, and MeitY began the process to appoint its Chairperson and four Members in May 2026. Commentary in August 2026 reported no appointments yet, and we found none announced when we checked on 3 November 2026.
Are startups exempt?
The Act lets the government exempt some Data Fiduciaries, including startups, from some provisions by notification. Do not assume an exemption applies to you without a notification that names your class.
Does it apply to businesses outside India?
Yes, when they process digital personal data outside India in connection with offering goods or services to people in India.
Who has to prove that consent was given?
The business. Where consent is the basis for processing and it is questioned in a proceeding, the Act says the Data Fiduciary must prove that a notice was given and consent obtained, so keep consent records.
Sources
- MeitY: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) Source: meity.gov.in
- PIB backgrounder: DPDP Rules, 2025 Notified (17 November 2025) Source: static.pib.gov.in
- MeitY: Digital Personal Data Protection Act, 2023 Source: meity.gov.in
- Storyboard18: MeitY seeks industry views on a 12-month compliance timeline (28 January 2026) Source: storyboard18.com
- King, Stubb & Kasiva via Legal 500: DPDP Act and Rules, the 2026 compliance milestones (14 August 2026) Source: legal500.com
- LiveLaw: India's Data Protection Board, established in law, absent in fact (1 August 2026) Source: livelaw.in