DPDP Rules 2025: What Indian Businesses Must Do and By When

This article is general information, not legal advice. Whether and how the rules apply to you depends on your facts, so check your own case with a lawyer.

India passed the Digital Personal Data Protection Act in August 2023, but it did very little until the detailed Rules arrived. Those Rules are now published, and the clock is running. If your business collects names, phone numbers, emails or order details through a website, an app or a billing system, this affects you. The Act is explained in our DPDP Act glossary entry; this post focuses on dates and practical work.

The dates that matter

The Digital Personal Data Protection Rules, 2025 appear in the Gazette of India (Extraordinary) dated 13 November 2025, and the government announced them as notified on 14 November 2025. They do not all start at once. Rule 1 of the Rules sets three stages:

• Straight away: the opening rules, definitions and the rules that set up the Data Protection Board (rules 1, 2 and 17 to 21).
• One year after publication, around mid-November 2026: the registration rules for Consent Managers (rule 4). A Consent Manager is a registered company that lets people give, view and withdraw consent in one place. It must be an Indian company.
• Eighteen months after publication, around mid-May 2027: the main duties on businesses, including notices, security safeguards, breach reporting, retention, children's data and people's rights (rules 3, 5 to 16, 22 and 23).

As of November 2026 the Rules in the Gazette still say 18 months. News reports in early 2026 said the Ministry of Electronics and Information Technology (MeitY) was considering a shorter timeline for some organisations. We did not find a notified amendment, so treat any shorter date as a proposal until it appears in the Gazette. Check meity.gov.in before you finalise a plan.

What the Rules ask of an ordinary business

The law calls a business that decides why and how personal data is used a Data Fiduciary. If you run a shop with an online store, a school with a parent app or a clinic with a booking page, that is you. The main duties are these.

A clear notice before you collect data

The notice must be in plain language, stand on its own, and say what data you collect and why. It must also tell people how to withdraw consent and how to complain to the Board. A paragraph buried in a long terms page is a weak way to do this.

Reasonable security

The Rules list safeguards that include encryption or similar protection, access control, logs that help you detect unauthorised access, and data backups. They also say to keep the relevant logs and data for one year unless another law needs longer. Your contracts with hosting and software providers should require reasonable safeguards too.

Telling people about a breach

If personal data is breached, you must tell each affected person, without delay, in clear language: what happened, the likely consequences, what you are doing and what they can do. You must also tell the Board without delay, and send a fuller report within 72 hours, unless the Board allows longer on a written request. Businesses covered by CERT-In's separate six-hour reporting direction have a second clock; see our post on CERT-In incident reporting.

Retention and deletion

The Rules require personal data and logs to be kept for at least one year for the purposes in the Seventh Schedule, and then erased unless another law requires otherwise. For very large e-commerce, online gaming and social media platforms, a separate schedule sets a three-year inactivity period before deletion, with advance warning to the user. Most small firms are far below those size thresholds.

Children's data

For anyone under 18, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian before processing, with limited exemptions for areas such as healthcare, education and real-time safety. School and coaching-centre apps should read rule 10 and rule 12 carefully.

People's rights and a contact point

You must publish contact details for someone who can answer questions about your processing, and have a way to handle requests to access, correct or erase data. Grievances should be answered within the period the Rules allow, which is not more than ninety days.

A working checklist for websites and apps

1. List every place you collect personal data: contact forms, checkout, sign-up, newsletter, WhatsApp widgets, analytics and CRM.
2. For each, write down the purpose, who receives the data and how long you keep it.
3. Replace vague consent text with a separate, plain-language notice and a clear way to withdraw.
4. Add a named contact on the site and a simple route to request access or deletion.
5. Turn on two-factor sign-in for admin accounts, restrict who can see customer data, and keep tested backups.
6. Write a one-page breach plan: who decides, who tells customers, who contacts the Board.
7. If you serve minors, design a parent-consent step before collecting a child's data.
8. Review contracts with hosting, payment and software vendors for security and breach-notice clauses.

Penalties, without the headlines

The Act allows large financial penalties, with the highest figure, up to ₹250 crore, reserved for failing to take reasonable security safeguards to prevent a personal data breach. The Board decides penalties after an inquiry and considers factors such as the nature of the breach and what the business did about it. Appeals go to the Appellate Tribunal. Quoting only the maximum figure makes the law sound more arbitrary than it is, so read the schedule itself with your adviser.

How this shapes the software we build

At VS Tech Builders we build consent capture, role-based access, activity logs and export or delete functions into custom web portals and management systems when a client asks for them, because retrofitting these later costs more. If you have an existing site or app and want to know where personal data actually sits, talk to us and we can map it with you. We are a software studio, not a law firm, so your lawyer should confirm the legal side.

For more developments like this, see our tech news hub.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• The Digital Personal Data Protection Rules, 2025 (Gazette of India, Extraordinary) — Ministry of Electronics and Information Technology
• Government notifies Digital Personal Data Protection Rules, 2025 — Press Information Bureau

Frequently asked questions

When do the DPDP Rules apply to my business?

The Rules in the Gazette dated 13 November 2025 start in stages. Consent Manager registration applies one year after publication, and most business duties, including notices, breach reporting and retention, apply eighteen months after publication, around mid-May 2027. Check meity.gov.in for any later amendment before relying on these dates.

Does a small business with a simple website need to comply?

The Act applies to digital personal data processed in India, and the Rules give no blanket exemption by business size. A simple site that collects enquiries or orders still processes personal data. Duties such as a clear notice, security and breach reporting therefore apply in principle. The Rules mention a facilitative regime for startups, so ask your adviser.

How fast must a data breach be reported under the DPDP Rules?

Once you become aware of a breach, you must tell affected people and the Data Protection Board without delay. The Rules then require a more detailed report to the Board within seventy-two hours, unless the Board allows a longer period on a written request. This is separate from any CERT-In reporting duty that may also apply.

Do I need parental consent for users under 18?

Generally yes. The Rules require verifiable consent from a parent or lawful guardian before processing a child's personal data, with limited exemptions for areas such as healthcare, education and real-time safety. A child means anyone under eighteen. If your app serves students, design a parent-approval step and confirm which exemption, if any, applies.