The DPDP Act and Rules 2025: what they require, and by when.

1. Key dates

In January 2026 MeitY proposed shortening the compliance window for some organisations. As of 22 October 2026 no amendment had been notified, so the dates above still stand. Check for later notifications before you plan around them.

2. Who it applies to

The Act covers the processing of digital personal data (Section 3):

• personal data processed in India, whether it was collected online or collected offline and later digitised;
• personal data processed outside India, if the processing is connected to offering goods or services to people in India.

It does not cover data an individual processes for personal or domestic purposes, or data that the person concerned made public themselves (or that someone is legally obliged to publish). Company size does not matter: a five-person firm with a customer list is a Data Fiduciary. The government can exempt some classes of organisation, including startups, from some provisions, but only by specific notification.

3. Key terms

• Data Principal: the person the data is about, such as a customer, employee or lead. For a child, it includes the parent or lawful guardian.
• Data Fiduciary: the organisation that decides why and how the data is processed. That is usually you.
• Data Processor: anyone who processes data on your behalf, such as your CRM, payroll or cloud provider.
• Significant Data Fiduciary (SDF): an organisation the government designates because of the volume and sensitivity of the data it processes and the risks involved. SDFs carry extra duties.
• Consent Manager: an entity registered with the Board that gives people one platform to give, manage, review and withdraw consent.
• Data Protection Board of India: the body that inquires into breaches and imposes penalties.

4. What the Rules require, rule by rule

The Rule 8 platforms are e-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh. Their three-year clock runs from the person's last contact or from the date the Rules started, whichever is later.

5. Security safeguards in practice

The Act says organisations must take "reasonable security safeguards". Rule 6 now lists what that means at a minimum. Here is each clause, and what it usually takes:

6. Breach notification: DPDP and CERT-In

One incident can trigger two separate reporting duties, to two different bodies:

The notice to affected people must describe the breach, its likely consequences for them, what you are doing about it, what they can do to protect themselves, and who they can contact. The 72-hour report to the Board adds the facts and reasons behind the breach, mitigation, findings about who caused it, remedial steps and a report on the notices you sent. Unlike GDPR, there is no "unlikely to cause harm" threshold: every personal data breach is reportable. See our CERT-In reporting clock.

7. Penalties

The Schedule to the Act sets the maximum penalty for each kind of breach:

These are ceilings. The Board decides the amount after an inquiry, considering factors such as the nature, gravity and duration of the breach, the type of data, whether it was repeated, and what you did to mitigate it. Work out your own exposure with our DPDP penalty calculator.

8. DPDP vs GDPR

GDPR work transfers well, especially security controls and data mapping. The gaps are usually the DPDP-specific notice, consent withdrawal, every-breach reporting and the one-year log retention. Read our guide to GDPR Article 32 security measures.

9. Checklist by deadline

Before 13 November 2026

1. Map what personal data you collect, where it is stored and who you share it with.
2. List your processors and check their contracts for security and breach-notice terms.
3. Decide whether you will work with a registered Consent Manager.

Before 13 May 2027

1. Publish a Rule 3 notice and capture consent per purpose, with withdrawal as easy as giving consent.
2. Put the Rule 6 safeguards in place: encryption, access control with MFA, logging kept for at least one year, tested backups.
3. Write one breach runbook that covers both CERT-In (6 hours) and the DPDP Rules (without delay, then 72 hours).
4. Set retention periods, and the three-year erasure rule with 48 hours' notice if you are a Rule 8 platform.
5. Publish how people can exercise their rights, and answer grievances within 90 days.
6. Publish the contact details of the person who answers privacy questions.
7. If you process children's data, add verifiable parental consent.
8. Test the controls: a VAPT and a breach tabletop exercise before the deadline, not after.

10. FAQ

Is the DPDP Act in force?

Partly. The Rules were notified on 13 November 2025, and the provisions setting up the Board took effect that day. Consent Manager registration follows on 13 November 2026, and the main obligations and penalties apply from 13 May 2027.

Does it apply to small businesses?

Yes. There is no general size threshold. The government can exempt specific classes, such as startups, from some provisions, but only by notification.

How fast do I have to report a breach?

Tell affected people and the Board without delay, then send the Board a detailed report within 72 hours of becoming aware (or longer, if the Board allows it on written request). Cyber incidents may also need reporting to CERT-In within 6 hours.

Do I need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint a DPO, based in India. Every other organisation must publish the contact details of someone who can answer questions about its processing.

We are a company outside India. Does it apply to us?

It does if you process personal data in connection with offering goods or services to people in India.

11. How VITI Security helps

We do the security side of DPDP: the Rule 6 safeguards, logging and retention, VAPT, the breach runbook covering CERT-In and the Board, and the data map underneath it all. Notice and consent wording is a legal question, so we work with your counsel on that. See our DPDP compliance services. Fixed quote in one business day after a 30-minute scoping call.

This guide is general information, not legal advice.

12. Sources

• The Digital Personal Data Protection Act, 2023 (MeitY)
• PIB backgrounder on the DPDP Rules, 2025 (November 2025)
• MeitY data protection framework page