Reviewed: October 2026. This article summarises publicly available information for general awareness. It is not legal advice; please confirm your obligations against the official text of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and seek legal advice for your circumstances.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) became operational with the notification of the Digital Personal Data Protection Rules, 2025 in November 2025. The Rules take effect in phases, giving organisations time to prepare — but the main obligations apply from May 2027, and the technical work involved takes longer than many expect.
The timeline at a glance
| Phase | When | What it covers (summary) |
|---|---|---|
| Immediate | November 2025 | Definitions, establishment of the Data Protection Board of India and related institutional provisions |
| 12 months | November 2026 | Registration and obligations of Consent Managers |
| 18 months | May 2027 | Most substantive obligations: notice and consent, security safeguards, breach intimation, data principal rights, children's data and more |
What IT and security teams should focus on
Reasonable security safeguards
Data fiduciaries must protect personal data with reasonable security safeguards. The Rules describe measures such as encryption or other appropriate techniques, access controls, visibility of access through logs and monitoring, and the ability to continue processing after an incident through measures like backups. Failure to take reasonable safeguards can attract significant penalties under the Act — up to ₹250 crore.
Breach intimation
If a personal data breach occurs, the Rules require intimation to affected data principals and to the Data Protection Board, including a more detailed report to the Board within 72 hours (unless the Board allows longer). Remember that CERT-In's separate six-hour reporting requirement for specified cyber incidents continues to apply.
Notice, consent and rights
Systems must support clear notices, capture and withdrawal of consent, and requests from individuals to access, correct and erase their data. This touches websites, apps, CRMs and back-office systems.
A practical readiness plan
- Map your personal data — what you collect, why, where it's stored, who can access it and which vendors process it.
- Close the security basics — MFA, encryption, logging, patching, endpoint protection and tested backups.
- Control data movement with data loss prevention and sharing controls in Microsoft 365 or Google Workspace.
- Update your incident response plan to include DPDP breach intimation alongside CERT-In reporting.
- Review vendor contracts so data processors are bound to appropriate safeguards.
- Build consent and rights workflows into customer-facing systems.
- Train your people on handling personal data and reporting incidents.
Want a structured DPDP readiness review? Our compliance and security team can map your data, assess safeguards and build a realistic roadmap. See compliance & advisory.
Sources: Ministry of Electronics and Information Technology (MeitY) and Press Information Bureau notifications of the DPDP Rules, 2025 (November 2025).
