India · DPDP Rules 2025 · Phased start
DPDP Rules 2025 timeline: what applies when.
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with a phased start: the Board first, consent managers after 12 months and most duties after 18 months.
The DPDP Rules 2025 apply in three stages. Provisions on the Data Protection Board of India took effect on notification, 13 November 2025. Rules on the registration and duties of consent managers apply 12 months later, in November 2026. Most obligations on Data Fiduciaries, including notice and consent, reasonable security safeguards under Rule 6, breach reporting under Rule 7, children’s data, rights and Significant Data Fiduciary duties, apply 18 months after notification, in May 2027.
The three stages
| When | What applies | What to have ready |
|---|---|---|
| 13 November 2025 | Definitions and the Data Protection Board of India | Ownership: who leads DPDP work and a budget |
| November 2026 | Consent manager registration and obligations | A decision on how you will collect and log consent |
| May 2027 | Notice, consent, Rule 6 security safeguards, Rule 7 breach reporting, retention and erasure, children’s data, rights, Significant Data Fiduciary duties and penalties | A data inventory, tested safeguards, a breach workflow and a rights process |
Checklist for each stage
Now
- Map where personal data lives: databases, email, cloud drives, file shares and endpoints
- Name an owner for DPDP and report progress to leadership
- Decide whether you could be designated a Significant Data Fiduciary
By November 2026
- Choose how consent will be collected, logged and withdrawn
- Decide whether you will integrate with registered consent managers
By May 2027
- Rule 6 safeguards in place: encryption or masking, access control, logging and monitoring, backups
- Penetration testing of systems holding personal data, with a retest
- A breach workflow that can notify the Board and affected people, with a detailed report within 72 hours
- Retention schedules and erasure in code, not only in policy
- A process to answer access, correction and erasure requests
Frequently asked questions
When do the DPDP Rules 2025 come into force?
They were notified on 13 November 2025 and apply in stages: the Board immediately, consent managers from November 2026, and most other obligations from May 2027.
What do I need to do by May 2027?
Have a personal data inventory, notices and consent, Rule 6 security safeguards, a Rule 7 breach reporting process, retention and erasure, children’s data controls and a rights process in place.
Does the DPDP Act apply to companies outside India?
Yes, when they process digital personal data in connection with offering goods or services to people in India.
More on the DPDP Act
Plan your DPDP work back from May 2027
Start with the free personal data inventory, then test the safeguards.