Writing · Field note

DPDP Act 2023 and Rules 2025: a practical readiness guide

General information drawn from public sources, not legal or tax advice. Check the official text and take advice from your own counsel or CA/CS before acting.

What it is

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's general law on digital personal data. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E), Gazette dated 13 November 2025) and set a phased commencement. Any organisation that decides why and how personal data is processed (a "Data Fiduciary") is covered, and there is no general small-business exemption.

Timeline

• 13 November 2025: Rules notified; Rules 1, 2 and 17–21 (Data Protection Board of India) in force on publication.
• 13 November 2026 (one year): Rule 4, Consent Manager registration and obligations.
• 13 May 2027 (18 months): Rules 3, 5–16, 22 and 23 and the core obligations on Data Fiduciaries apply, including notice, consent, security safeguards, breach intimation, rights of data principals and retention/erasure.

Core obligations, in brief

• Notice and consent: a clear, itemised notice; consent that is free, specific, informed and as easy to withdraw as to give (or a recognised legitimate use).
• Security safeguards: reasonable measures such as encryption/masking, access control, logging and monitoring, plus contracts with processors.
• Breach intimation: inform affected individuals and the Data Protection Board without delay, with a detailed report to the Board within 72 hours of becoming aware (as set out in the Rules).
• Data principal rights: access, correction, erasure, grievance redressal and nomination.
• Retention: erase data once the purpose is served, with specified periods for some large platforms.
• Children's data: verifiable parental consent; no tracking or targeted advertising at children.
• Significant Data Fiduciaries (if notified): DPO in India, independent audit, DPIA.

Penalties

The Schedule sets penalties of up to ₹250 crore per instance for failing to take reasonable security safeguards, and up to ₹200 crore for failures on breach intimation or children's data obligations.

A readiness checklist

1. Inventory where personal data sits: systems, spreadsheets, vendors.
2. Record purpose and lawful basis for each processing activity.
3. List processors and put data-processing terms in place.
4. Map consent touchpoints and rewrite notices.
5. Define retention periods and an erasure process.
6. Write and rehearse a 72-hour breach-response plan.
7. Set up a rights-request and grievance channel.
8. Plan backwards from 13 May 2027 with owners and dates.

Official sources

• MeitY, DPDP Rules, 2025 and enforcement timeline (Rule 1 commencement; Rule 7 breach intimation, 72 hours)
• PIB, Government notifies DPDP Rules (14 Nov 2025; 18-month phased timeline)
• MeitY, DPDP Act, 2023 (Schedule: penalties up to ₹250 crore / ₹200 crore)

← All writing