On this page
Preparing for the DPDP deadline? We run the full engagement for you and route the formal audit through our local partner firms, so you deal with one team and get all your work done.
Our guide to the DPDP Act explains the law itself. This post is the working document: the dates on the calendar, what the security and breach rules actually say, and a checklist your engineering and security teams can work through before May 2027.
The DPDP Rules timeline
13 November 2025: Rules notified
Definitions and the provisions setting up the Data Protection Board of India take effect.
November 2026: consent managers
Registration and obligations of consent managers apply, 12 months after notification.
May 2027: core obligations
Notice, consent, security safeguards, breach reporting, retention and erasure, children's data, data principal rights, significant data fiduciary duties and cross-border rules apply, 18 months after notification.
Count back from May 2027
Security work that needs budget, vendor changes or re-architecture has to start well before the deadline. Testing comes after the safeguards are built, and fixes come after testing. Work backwards from May 2027 and the real start date is much earlier than it looks.
Rule 6: reasonable security safeguards
Section 8(5) of the DPDP Act requires reasonable security safeguards to prevent personal data breaches. Rule 6 sets the minimum. Here is each element and what to build and test for it.
| Rule 6 safeguard | What to build | How to show it works |
|---|---|---|
| Encryption, obfuscation, masking or virtual tokens | Encryption at rest and in transit; masking in non-production and in screens and exports | Test for data exposed in API responses, logs, backups and lower environments |
| Access control | Role-based access, least privilege and MFA for privileged users | Test whether one user or tenant can reach another’s data |
| Visibility through logs, monitoring and review | Central logging of access to personal data, alerting and periodic review | Check that test attacks were logged and noticed |
| Continued processing after compromise | Backups, recovery plans and resilience for systems holding personal data | Restore tests and recovery exercises |
| One-year retention of logs and personal data | Retention settings in logging and storage systems | Confirm logs from 12 months ago can be retrieved |
| Security terms in processor contracts | Contract clauses requiring safeguards and breach cooperation | Vendor reviews and evidence requests |
| Appropriate technical and organisational measures | Policies, training, secure development and change control | Internal audits and independent testing |
Rule 7: personal data breach reporting
Rule 7 sets two clocks once you become aware of a breach:
- Without delay: inform each affected data principal in plain language, covering what happened, the likely consequences, what you are doing about it, what they can do to protect themselves and who to contact. Inform the Data Protection Board with an initial description of the breach.
- Within 72 hours: send the Board a detailed report covering the facts and circumstances, the cause, the measures taken to reduce risk, any findings about the person responsible, remedial steps to prevent recurrence and a report on the notices given to affected people. The Board may allow a longer period on request.
There is no “minor breach” exemption in the Rules: a personal data breach must be reported. That makes detection and fast scoping essential, which is why the Rule 6 logging and monitoring duties matter so much.
Other rules engineering teams should know
Notice and consent
Notices must be standalone, clear and itemised, and consent must be as easy to withdraw as to give. This changes signup and preference flows.
Children's data
Verifiable consent from a parent or lawful guardian is needed before processing a child's data, with checks that the adult is who they claim to be.
Retention and erasure
Data must be erased when no longer needed, and some large platforms must erase data of inactive users after set periods, with prior notice.
Data principal rights
Fiduciaries must publish how to make requests and respond within the time they commit to, with a grievance process.
Significant data fiduciaries
An annual data protection impact assessment and audit, checks on algorithmic software and any localisation the government specifies.
Data processors
Fiduciaries stay responsible for data their processors handle, so contracts and oversight have to cover security and breach reporting.
The DPDP Rules security checklist
- Personal data inventory: every system, API, log store, backup and vendor that holds personal data
- Encryption at rest and in transit on all of them, and masking in non-production environments
- Access reviews, least privilege and MFA for anyone who can reach personal data in bulk
- Penetration tests of web apps, APIs, mobile apps and cloud environments that handle personal data, with fixes and retests
- Central logging of access to personal data, alerting on unusual access and logs kept for at least a year
- Backups and a tested recovery plan for systems holding personal data
- A breach response plan with the “without delay” and 72-hour steps assigned to named people, rehearsed at least once
- Updated processor contracts with security and breach cooperation terms
- A record of all of the above, ready to show the Board
Where penetration testing fits
The Rules do not name penetration testing, but they assume your safeguards work. If the Board investigates a breach, a record of regular, independent testing with findings fixed is concrete evidence that you took reasonable steps. Testing also finds the flaws most likely to cause a reportable breach: broken access control in APIs, exposed cloud storage and data leaking in responses. Our IDOR case study shows how one such flaw exposed thousands of customer records.
How Summit helps with DPDP Rules readiness
Summit is based in New Delhi and helps Indian and international companies test and evidence the safeguards the DPDP Rules require: web application VAPT, API security testing, mobile app VAPT and cloud security assessment, with retests and reports mapped to Rule 6. Where you need a CERT-In empanelled audit as well, we run the engagement and route the formal attestation through our empanelled partner.
Planning your DPDP work to May 2027?
We can test the systems that hold your users’ personal data and give you a prioritised fix list well before the deadline. Read our India DPDP compliance guide or get a quote.
Related reading: What is the DPDP Act? · CERT-In empanelled auditors and VAPT · UAE PDPL compliance guide
Frequently asked questions
When do the DPDP Rules 2025 take effect?
The Rules were notified on 13 November 2025 with a phased start. Provisions on the Data Protection Board took effect immediately, consent manager rules apply 12 months after notification, and most obligations on data fiduciaries, including security safeguards and breach reporting, apply 18 months after notification, in May 2027.
What security safeguards do the DPDP Rules require?
Rule 6 lists minimum reasonable security safeguards: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review to detect unauthorised access; measures such as backups to keep processing going after a compromise; retention of logs and relevant personal data for one year; security terms in contracts with data processors; and appropriate technical and organisational measures.
How quickly must a personal data breach be reported under the DPDP Rules?
Rule 7 requires the data fiduciary to inform affected data principals and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware of the breach, or a longer period if the Board allows.
How long must logs be kept under the DPDP Rules?
Rule 6 requires logs and the relevant personal data to be retained for at least one year, for detecting unauthorised access, investigating it and preventing it from recurring, unless another law requires longer.
What extra duties do significant data fiduciaries have?
Significant data fiduciaries must carry out a data protection impact assessment and an audit every 12 months and report the significant observations to the Board, check that algorithmic software does not risk data principals' rights, and follow any data localisation requirements the government specifies.
Do the DPDP Rules require penetration testing?
Not by name. The Rules require safeguards that prevent breaches and detect unauthorised access. Penetration testing is the most direct way to show that encryption, access control and monitoring actually work, and gives you evidence if the Board investigates a breach.
