India DPDP Rules 2025: what applies on 13 May 2027

Who is in scope?

The Digital Personal Data Protection Act, 2023 (the DPDP Act) covers digital personal data: data collected in digital form, or collected on paper and digitised later. It applies to processing in India, and to processing outside India that is connected with offering goods or services to people in India (section 3). A company serving Indian users is in scope wherever it is based.

The Act assigns four roles:

• Data Fiduciary: decides why and how personal data is processed, alone or with others.
• Data Processor: processes personal data on a Data Fiduciary's behalf.
• Consent Manager: a registered platform through which people give, review and withdraw consent.
• Significant Data Fiduciary (SDF): a Data Fiduciary the government notifies because of the volume and sensitivity of data it processes or the risk it poses.

What applies on each date?

The DPDP Rules, 2025 were published in the Gazette of India on 13 November 2025 (G.S.R. 846(E)). Rule 1 staggers their start:

• 13 November 2025: Rules 1, 2 and 17 to 21, which set up the Data Protection Board of India as a digital office, applied immediately.
• 13 November 2026: Rule 4 on the registration and obligations of Consent Managers.
• 13 May 2027: Rules 3, 5 to 16, 22 and 23, which cover notice, security safeguards, breach intimation, retention and erasure, contact details, children's data, SDF duties, Data Principal rights, cross-border transfers and the research exemption.

The Act's own sections were brought into force on the same staggered dates, so the core duties in sections 3 to 17 start on 13 May 2027. In January 2026 MeitY consulted industry on shortening the eighteen-month period to twelve. As of 27 September 2026 we have found no notified amendment, so the dates above stand; check MeitY and the Gazette before relying on them.

What changes for notice and consent?

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to the data needed for the stated purpose (section 6). Rule 3 sets the minimum notice:

• It must stand on its own, not be buried in other terms.
• It must itemise the personal data collected and the specific purpose of the processing.
• It must link to a way to withdraw consent as easily as it was given, to exercise rights and to complain to the Board.

Unlike the GDPR, the Act has no general legitimate-interest ground. Processing without consent is limited to the "certain legitimate uses" listed in section 7, such as data a person provides voluntarily for a specified purpose, employment and legal obligations.

What security and breach duties apply?

Rule 6 lists minimum reasonable security safeguards: encryption, masking, obfuscation or tokenisation; access control; logging and monitoring to detect and investigate unauthorised access; backups for continuity; and contracts that bind Data Processors to the same safeguards. Logs must be kept for one year.

When a breach occurs, Rule 7 requires two notices:

1. Each affected person, without delay and in plain language: what happened, the likely consequences, what you are doing and what they can do.
2. The Board, without delay, followed within 72 hours of becoming aware by a detailed report on the facts, causes, mitigation, remedial measures and the notices sent.

Rule 8 adds retention limits. Large e-commerce, online gaming and social media platforms must erase a user's data three years after the user last engaged, unless another law requires it, and warn the user 48 hours before erasure. Every Data Fiduciary must also keep processing logs for at least one year.

What extra duties apply to children's data and SDFs?

A child is anyone under 18. Data Fiduciaries need verifiable parental consent before processing a child's data (Rule 10), and may not track, behaviourally monitor or target advertising at children (section 9). The Fourth Schedule exempts specified classes, such as healthcare and educational institutions, and specified purposes.

An SDF must appoint a Data Protection Officer based in India and an independent data auditor, run a Data Protection Impact Assessment and an audit every twelve months and report significant findings to the Board (Rule 13). It must also check that its algorithmic software does not risk Data Principals' rights, and keep government-specified data in India.

How does DPDP compare with GDPR?

Programs built for the GDPR carry over well: both require notice, security, breach reporting and individual rights, and both reach companies outside their territory. The differences matter:

• DPDP relies on consent and a closed list of legitimate uses; there is no legitimate-interest ground.
• It covers only digital personal data and has no special categories of data.
• Rights requests get up to 90 days, against one month (extendable by two) under the GDPR.
• Penalties are fixed amounts, up to INR 250 crore for security failures and INR 200 crore for breach-notification or children's-data failures, not a share of turnover.

What should you do before 13 May 2027?

1. Map your data. Build an inventory of the personal data you process about people in India, the purposes, and your role for each activity.
2. Rewrite notices and consent flows to the Rule 3 format, and plan for Consent Managers from 13 November 2026.
3. Test breach response against the two-stage Rule 7 process and the 72-hour report.
4. Set up rights handling that answers access, correction, erasure and nomination requests within 90 days.
5. Check children's data and SDF exposure, including age assurance and parental consent.
6. Reuse your privacy evidence. Our India DPDPA guide lists the requirements, and control mapping lets GDPR controls count twice.