The Digital Personal Data Protection Rules are phasing in. Consent manager rules start in November 2026 and full compliance is due by 13 May 2027.
India's Digital Personal Data Protection (DPDP) Rules were notified on 13 November 2025, starting an 18-month phased rollout. For most businesses, the date that matters is 13 May 2027, when the core obligations for Data Fiduciaries take effect.
That may sound far away, but the changes involved touch product design, security, vendor contracts and customer support. Teams that start now will be ready; teams that wait will be rushing.
The key dates
- 13 November 2025: DPDP Rules notified, and the Data Protection Board provisions begin.
- 13 November 2026: Consent Manager registration provisions come into force.
- 13 May 2027: Notice, consent, security safeguards, breach intimation, retention, Data Principal rights and cross-border transfer obligations apply.
What full compliance involves
- Clear notices and consent that tell people what data you collect, why, and how to withdraw consent.
- Reasonable security safeguards, such as encryption, access control, logging and monitoring, to prevent personal data breaches.
- Breach notification to affected individuals and the Data Protection Board, with a detailed report within 72 hours.
- Data Principal rights, including access, correction and erasure, handled within defined timelines.
- Retention limits, so data is deleted once its purpose is served.
Penalties are significant, reported at up to ₹250 crore for some violations.
Don't forget CERT-In
DPDP sits alongside, not instead of, CERT-In's 2022 directions, which already require many cyber incidents to be reported to CERT-In within 6 hours of being noticed. A single incident can trigger both regimes, so your incident response plan needs to cover both.
A practical starting checklist
- Map where personal data lives across apps, databases, backups and vendors.
- Run a security assessment against the safeguards you will need to demonstrate.
- Update privacy notices and consent flows in your website and apps.
- Write and rehearse an incident response plan covering both CERT-In and DPDP.
- Review contracts with processors and cloud providers.
Compliance is far easier when security and privacy are designed into systems from the start rather than added later.
