Key takeaways
- The DPDP Rules were notified on 13 November 2025 and come into effect in stages.
- Consent manager conditions begin on 13 November 2026. The main duties begin on 13 May 2027.
- Breach reporting has two steps: an initial notice to the Board, then a detailed report within 72 hours.
- Logs used to detect breaches are kept for at least one year, unless another law requires longer.
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. They bring the DPDP Act into operation in stages, so the dates matter more than most compliance deadlines.
The timeline
Consent and related provisions, data fiduciary obligations and the added duties of Significant Data Fiduciaries begin.
Dates as notified on 13 November 2025. Check the official notification for any change.
Until the core duties begin, section 43A of the IT Act and the 2011 SPDI Rules stay in force. Check the official notification and the Ministry of Electronics and IT for any change.
What data fiduciaries have to do
| Duty | What the Rules ask |
|---|---|
| Notice | A standalone notice, separate from other terms, describing the personal data, the purposes and the goods, services or uses it enables |
| Consent withdrawal | A specific link or channel, as easy to use as giving consent. The same channel can be used for rights requests |
| Grievances | Resolve them in a reasonable time, not more than 90 days |
| Security safeguards | Measures such as encryption, obfuscation or masking, access controls, monitoring and logging, and continuity measures. The list is indicative |
| Log retention | Logs for detecting breaches kept for at least one year, unless another law requires longer |
| Breach intimation | An initial notice to the Board without undue delay, then a detailed report within 72 hours, or longer if the Board allows it on written request. Affected individuals are told without delay |
| Children's data | A child is anyone under 18. Verifiable consent from a parent or guardian is needed before processing |
Significant Data Fiduciaries have added duties: annual data protection impact assessments and independent audits, with significant findings reported to the Board. The criteria for classification are still to be notified.
Note. Several details, including the classification criteria for Significant Data Fiduciaries and any limits on transfers outside India, are still to be notified. Plan for them, and watch for the notifications.
A working checklist
Tick what is in place. Your progress is kept in this browser.
Where it gets stuck
The gaps tend to be in the unglamorous places: personal data in systems nobody has listed, vendors with no recent review, and logs kept for thirty days instead of a year. Each is a piece of recurring, owned work, and each needs evidence.
Netra does not list DPDP as a framework today. What it does provide is the working layer that privacy programmes depend on: tasks with owners and due dates, evidence tied to the work, vendor assessments through Third-Party Risk, and related frameworks such as ISO 27701 and GDPR.
This article is a summary for general information. It is not legal advice. Confirm your obligations with your legal team and the official text of the Act and Rules.
Frequently asked questions
When do the DPDP Rules take effect?
The Rules were notified on 13 November 2025 and come into effect in stages. Consent manager conditions begin on 13 November 2026, and the main duties begin on 13 May 2027.
How is a personal data breach reported?
In two steps: an initial notice to the Board, then a detailed report within 72 hours.
How long are logs kept?
Logs used to detect breaches are kept for at least one year, unless another law requires longer.
Turn the checklist into owned work
Tasks with owners and due dates, evidence tied to the work, and vendor assessments in one place.
See it in Netra
A demo on the frameworks that matter to you.
