If you run a business in India that collects personal data, DPDP Act compliance is now dated work. It is no longer something to keep an eye on. The law has been passed. The Rules have been published. The clock is running.
This post is written for the people who have to build it, not for a legal review. We will cover what changes inside your product, in what order to do it, and one date that most articles on this topic get wrong.
The dates, and the one everyone quotes wrongly
Parliament passed the Digital Personal Data Protection Act in August 2023. The Rules that make it work were notified on 14 November 2025, according to the Press Information Bureau, Government of India.
Rule 1 of those Rules sets out the timing. It splits into three parts:
| What | When it starts |
|---|---|
| The Data Protection Board and the machinery around it | On publication, November 2025 |
| Rule 4, the Consent Manager registration framework | One year after publication, November 2026 |
| Everything you actually have to do: notice, consent, security, breach reporting, user rights | Eighteen months after publication, May 2027 |
Here is the part worth getting right. Rule 1 counts from the date of publication in the Official Gazette, not from the date printed on the notification. Those are one day apart. The notification carries 13 November 2025, and the Government says the Rules were published on 14 November 2025.
That is why you will see both 13 and 14 November 2026 quoted for the Consent Manager date, and both 13 and 14 May 2027 for the main deadline. Read literally, Rule 1 points at the later day in each pair.
The single day does not change anything you have to build. We are flagging it because it tells you something about the writing on this subject. A lot of it is copied rather than read. If your plan turns on which of two days it is, the plan started too late anyway.
What actually has to change in your product
The legal summaries all list the same obligations. What they rarely say is which ones are a document and which ones are months of engineering. That distinction is the whole planning problem.
| Obligation | What it really is |
|---|---|
| A clear, separate consent notice stating the specific purpose | Mostly writing, plus a change to your signup flow |
| A published contact for data questions, an officer or a Data Protection Officer | A page, and someone who owns the inbox |
| Telling people what data you hold about them | Engineering. You have to be able to find it |
| Correcting, updating and erasing data on request, within ninety days | Engineering, usually the hardest item on this list |
| Reporting a breach to the Board and to every affected person | Process, plus logging good enough to know who was affected |
| Reasonable security safeguards | Ongoing work, and the item with the largest penalty attached |
The three build items are where the time goes.
Finding a person's data. Most systems can show a user their profile. Very few can answer "everything we hold about this person". That person might sit in a main database, a support tool, an email platform, three log files, and a warehouse nobody has opened since 2023. You cannot answer a request you cannot run a query for.
Deleting it. Deletion is harder than it sounds, because data spreads. Copies sit in backups, in analytics, in caches, and in whatever spreadsheet someone exported last year. A delete button that only clears the main table is not deletion, and saying it is creates a bigger problem than not having one.
Knowing who was affected by a breach. Reporting to the Board is a form. The Rules also say you have to tell every affected person, in plain language, what happened and what it means for them. That requires knowing which records were exposed. Teams usually discover during an incident that their logs cannot tell them.
The penalties
The numbers are worth stating plainly, because they change how the work gets prioritised. Under the DPDP Act, as summarised by the Press Information Bureau:
- Up to 250 crore rupees for failing to keep reasonable security safeguards
- Up to 200 crore rupees for failing to report a breach to the Board or to the people affected
- Up to 200 crore rupees for violations involving children's data
- Up to 50 crore rupees for any other violation
Note where the largest number sits. It is not on paperwork. It is on security.
What about November 2026?
You can probably ignore it.
Rule 4 covers Consent Managers. A Consent Manager is a business that runs a platform where people can give, review and withdraw consent across many companies at once. Under the Rules they have to be companies based in India, and they register with the Board.
That is a product category, not a status your company takes on. If you collect data from your own users for your own purposes, you are a Data Fiduciary. Your date is the one in May 2027.
A sensible order to do this in
- Write down where personal data lives. Every system, every export, every log. This is unglamorous and everything else depends on it.
- Make the requests answerable. Access, correction and deletion, across all of it, inside ninety days.
- Fix consent capture. Separate notice, specific purpose, plain language, and a real way to withdraw.
- Make breaches detectable. If you cannot tell who was affected, you cannot meet the reporting duty.
- Then write the policy. Doing this first is the common mistake. A policy describing behaviour your systems do not have is a record of the gap.
Steps 1 and 2 are the long ones. If you start them in early 2027 you will not finish them.
What we are not telling you
We build software. We are not your lawyers, and this is not legal advice. Where your obligations begin and end is a question for counsel. That is especially true if you handle children's data or health data. It also applies if you are large enough to count as a Significant Data Fiduciary, which carries extra duties including independent audits.
What we can tell you is how long the engineering takes, because that is the part that gets underestimated. Writing a privacy notice takes a week. Being able to find and delete one person across nine systems takes a lot longer, and no lawyer can do it for you.
If you have already done this for European users, the shape will look familiar. We wrote about a related deadline in what the EU AI Act asks of chatbots. For how we handle data, access and confidentiality on client work, see our security position, or what we build.
Common questions
Most of it lands eighteen months after the Rules were published. Rule 1 of the Digital Personal Data Protection Rules, 2025 says the main obligations, covering notice, consent, security, breach reporting and data principal rights, come into force eighteen months after publication in the Official Gazette. The Government of India published the Rules on 14 November 2025, which puts that date in May 2027.
Both, and the engineering half takes longer. A lawyer can write your privacy notice in a week. Rebuilding consent capture, adding a way to delete a user's data across every system, and being able to find every copy of a record within ninety days are product changes. Teams that start with the policy and leave the build for later tend to run out of time.
The Act sets penalties of up to 250 crore rupees for failing to keep reasonable security safeguards, and up to 200 crore rupees for failing to report a breach to the Data Protection Board or to affected people. Violations involving children's data also carry up to 200 crore rupees. Any other breach of the Act or Rules can attract up to 50 crore rupees.
Almost certainly not. A Consent Manager is a separate business that runs a platform where people manage consent across many companies. It is a product you might one day integrate with, not a status ordinary businesses take on. If you collect data from your own users for your own purposes, you are a Data Fiduciary, and the November 2026 date is not yours to worry about.