Draft. Prepared from official sources for Adv. Varun Agarwal's review before publication.
Dotted terms explain themselves on hover or tap. Numbered notes sit in the margin; tap a number to open one.
The timeline
The Digital Personal Data Protection Act, 2023 became fully operational when the Digital Personal Data Protection Rules, 2025 were notifiedNotifiedFormally published by the government in the Official Gazette. This is what brings a law or a set of rules into force. on 14 November 2025.1 The Act received the President’s assent on 11 August 2023, but most of it could not operate until the Rules supplied the detail. The Rules apply in three phases:
| From | What applies |
|---|---|
| November 2025 | Constitution and functioning of the Data Protection Board of India |
| About November 2026 | Registration and obligations of consent managers |
| About May 2027 | The core duties of every business that handles personal data: notice, consent, security, breach reporting, retention and individuals’ rights |
Eighteen months sounds generous. It isn’t, for a company that has never mapped where its customer and employee data actually goes.
Who it applies to
Any business that processes digital personal data in India, and businesses outside India that offer goods or services to people in India. The Act calls such a business a data fiduciaryData fiduciaryAnyone who decides why and how personal data is processed. In practice, almost every business that holds customer or employee data..2 The name is deliberate. A business holding someone’s personal data is treated as holding it in trust, and owes that person duties in return. That covers most companies, because it covers employee and vendor data as well as customer data.
What a data fiduciary must do
- Notice and consent:
- Give a clear, standalone notice that lists the data collected and why.
- Obtain consent that is specific and unambiguous.
- Let people withdraw consent as easily as they gave it.
- Security:
- Take reasonable safeguards, such as encryption, access control and monitoring.
- Keep logs for at least one year.
- Bind your vendors to the same standard by contract.
- Breaches:
- Inform the Data Protection BoardData Protection BoardThe body set up under the DPDP Act to inquire into breaches, impose penalties and direct remedies. and every affected person without delay.
- Follow up with a detailed report to the Board within 72 hours.
- Retention: Erase personal data once the purpose is served, unless the law requires you to keep it.
- Children: Obtain verifiable parental consentVerifiable parental consentConsent from a parent or lawful guardian whose identity has been checked, for example through reliable records or a government-issued identity token. before processing a child’s data.
- Rights and grievances: Publish a contact point, and respond to access, correction, erasure and grievance requests within the prescribed time.
- Significant Data FiduciariesSignificant Data FiduciaryA data fiduciary the government designates because of the volume or sensitivity of the data it handles, or the risk to individuals. It carries extra duties.: Large or sensitive processors that the government notifies carry extra duties: a data protection officer based in India, plus an annual impact assessment and audit.
What is at stake
The Act allows the Board to impose penalties of up to ₹250 crore for a failure to take reasonable security safeguards. Failures to report a breach, or to meet the obligations on children’s data, carry penalties of up to ₹200 crore.3 These are ceilings, not fixed fines. The Board sets the amount after an inquiry, weighing the nature, gravity and duration of the breach and what the business did to limit the harm.
Where we help
- Data mapping and a gap review against the Act and Rules
- Notices, consent flows and privacy policies
- Data processing agreements with vendors
- Breach response plans
- Representation if a matter reaches the Data Protection Board
Sources
- DPDP Rules, 2025: backgrounder, Press Information Bureau, 17 Nov 2025
- Digital Personal Data Protection Rules, 2025, Lawrbit
- Phased commencement of the Rules, DSK Legal
Your checklist
Tick items off as you go. Your progress is saved in this browser.
This article is general information about the law as of the date above. It is not legal advice. Policies and schemes change; check the current position before you act.