DPDP Act Compliance in India: What Your Business Must Do Before 13 May 2027
Quick answer
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and are being phased in. Consent Manager registration opens in November 2026, and almost every obligation that applies to ordinary businesses (notices, consent, security safeguards, breach reporting, retention, children's data and data principal rights) applies from 13 May 2027. Penalties go up to ₹250 crore per breach for failing to protect data. With roughly six months left, now is the time to map your data and fix your contracts.
Key takeaways
- Three phases: Data Protection Board rules immediately, Consent Managers from November 2026, everything else from 13 May 2027.
- Every collection of personal data needs a clear, standalone notice and a lawful basis, usually consent.
- Breaches must be reported to the Board and affected individuals; the detailed report is due within 72 hours.
- Keep processing logs for at least one year; large platforms must erase inactive users' data after three years.
- You remain liable for what your vendors do with your data, so processor contracts matter.
India's privacy law is no longer a future problem. The Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules are coming into force in stages, and the big date for most businesses is 13 May 2027. If your company collects names, phone numbers, emails, health details, payment data or location from customers or employees in India, this law applies to you.
The timeline in one table
| Date | What comes into force | Who it affects |
|---|---|---|
| 13 Nov 2025 | Rules on the Data Protection Board of India and its working | Government and the Board |
| Nov 2026 | Rule 4: registration and duties of Consent Managers | Platforms that want to act as Consent Managers |
| 13 May 2027 | Notice, consent, security safeguards, breach reporting, retention and erasure, children's data, rights of individuals, Significant Data Fiduciary duties, cross-border transfers | Every business that processes personal data |
1. Know what data you hold
You cannot comply with what you cannot see. Build a simple data inventory: what personal data you collect, why, where it is stored, who can access it, which vendors receive it, and how long you keep it. Include HR data, CCTV, website forms, WhatsApp chats with customers and spreadsheets on shared drives.
2. Rewrite your notices and consent
Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. The notice must be standalone and understandable, list the data and the purpose, and explain how to withdraw consent and complain. Individuals can ask for the notice in English or any of the 22 languages in the Eighth Schedule to the Constitution. Withdrawing consent must be as easy as giving it.
Unlike Europe's GDPR, there is no general "legitimate interests" ground. Apart from consent, you can rely only on the specific "certain legitimate uses" listed in the Act, such as data voluntarily provided for a purpose, employment, or legal obligations.
3. Put real security safeguards in place
The Rules expect reasonable security safeguards such as encryption, masking or tokenisation, access controls, monitoring, and backups. They also require you to keep logs that let you detect and investigate unauthorised access. Failure to take reasonable safeguards carries the highest penalty in the Act: up to ₹250 crore.
4. Be ready to report a breach within 72 hours
On becoming aware of a personal data breach, you must inform the Data Protection Board and each affected person without delay, and give the Board a detailed report within 72 hours covering what happened, its extent and likely impact, and what you are doing about it. Not notifying can attract a penalty of up to ₹200 crore. Run a mock drill: who is called at 2 a.m., who decides, and who drafts the notice?
5. Fix retention and erasure
- Erase personal data once the purpose is served or consent is withdrawn, unless another law requires you to keep it.
- Keep the personal data, traffic data and logs related to processing for at least one year for investigation purposes.
- Large e-commerce and social media platforms (and certain online gaming platforms) must erase data of users inactive for three years, after giving them at least 48 hours' notice.
6. Treat children's data with extra care
For anyone under 18, you need verifiable consent from a parent or lawful guardian, and you cannot track, behaviourally monitor or target advertising at children, subject to narrow exemptions (for example, real-time location tracking for a child's safety). The penalty for breaching children's data obligations can reach ₹200 crore.
7. Make rights requests easy to exercise
Individuals can ask for a summary of their data, correction, completion, updating and erasure, and can nominate someone to act for them. Publish clear contact details for privacy queries on your website or app, set up a grievance process, and respond within the time the Rules allow (up to 90 days).
8. Update vendor contracts
Your cloud provider, CRM, payroll processor and marketing agency are "Data Processors". Under the Act you remain responsible for them. Contracts should cover purpose limits, security standards, breach notice to you within hours (not days), sub-processor approval, audits, and deletion at the end of the engagement.
What does non-compliance cost?
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Not notifying a personal data breach | ₹200 crore |
| Breaching obligations on children's data | ₹200 crore |
| Additional duties of Significant Data Fiduciaries | ₹150 crore |
| Any other provision of the Act or Rules | ₹50 crore |
A six-month plan that works: Month 1, data inventory. Month 2, notices and consent flows. Month 3, vendor contracts. Month 4, security and logging. Month 5, breach response and rights request process. Month 6, training and a mock audit.
Frequently asked questions
When does the DPDP Act come into force for businesses?
Most obligations for businesses (notice, consent, security, breach reporting, retention, children's data and individual rights) apply from 13 May 2027, eighteen months after the DPDP Rules were notified on 13 November 2025.
Does the DPDP Act apply to small businesses?
Yes. There is no general size exemption. Any business that processes digital personal data in India, or offers goods or services to people in India, must comply, though the government can exempt notified classes such as certain startups from specific duties.
What is the breach reporting time under the DPDP Rules?
You must inform the Data Protection Board and affected individuals without delay, and file a detailed report with the Board within 72 hours of becoming aware of the breach.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Other penalties range up to ₹200 crore.
Is consent always required under the DPDP Act?
Consent is the main basis, but the Act also allows processing for specific "certain legitimate uses", such as data the person voluntarily provided for a purpose, employment-related processing and compliance with law. There is no broad legitimate-interests ground as under the GDPR.
Sources and further reading
Facing this right now?
Every case turns on its own facts and deadlines. A short consultation can save you months.
Comments and questions 0
No comments yet. Start the conversation, or ask a question below.