CyphrQ
Menu

India DPDP Rules 2025: Timeline, Duties, Rights and Penalties

What India's DPDP Act 2023 and DPDP Rules 2025 require: the 12- and 18-month timeline, 72-hour breach reports, 90-day rights, ₹250 crore cap.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

12 min read

What do India's DPDP Rules 2025 change? They switch on the Digital Personal Data Protection Act, 2023. The Data Protection Board of India came first, in November 2025. Most duties apply 18 months after the Rules were published, which by my arithmetic is around 13 May 2027. Those duties include 72-hour breach reports to the Board, verifiable parental consent for children, set response times for data subject rights, and penalties of up to ₹250 crore.

I am not a lawyer, and this post is not legal advice. It reads the Gazette text and government releases and links each one, so your counsel can check every line.

What are the DPDP Act 2023 and the DPDP Rules 2025?

The Act is India's general law on digital personal data. Parliament passed it as Act No. 22 of 2023, and it received the President's assent on 11 August 2023 (DPDP Act). It did not take effect on that date. Section 1(2) leaves commencement to government notification, and different provisions can start on different dates.

The Rules fill in the detail the Act left to be "prescribed": notice content, security safeguards, breach reports, retention, children's consent and the Board's procedure. MeitY published a draft on 3 January 2025 as G.S.R. 02(E). It then notified the final Rules as G.S.R. 846(E) (DPDP Rules). The government received 6,915 inputs during the consultation, according to the PIB backgrounder.

Key terms (section 2): a Data Fiduciary decides why and how data is processed, roughly a GDPR controller. A Data Principal is the person the data is about; for a child, that includes the parent. A Consent Manager is a registered platform for giving and withdrawing consent.

Who does it cover? Digital personal data processed in India, plus processing abroad "in connection with any activity related to offering of goods or services" to people in India (section 3).

When were the DPDP Rules notified: 13 or 14 November 2025?

The official sources give two dates:

  • The Gazette dates all three notifications 13 November 2025. That covers commencement (G.S.R. 843(E)), the Board (G.S.R. 844(E)) and the Rules (G.S.R. 846(E)).
  • The PIB backgrounder dated 17 November 2025 says the Rules were notified "on 14 November 2025".
  • The PIB press release was posted on 14 November 2025 but gives no date for the notification (PIB).

The Gazette is the legal instrument, so I count deadlines from 13 November. Ask counsel to confirm the start date your plan uses.

What is the DPDP phased timeline?

G.S.R. 843(E) brings the Act's sections into force in three steps (commencement notification). Rule 1 of the Rules uses the same three dates. The calendar dates in the last column are my own arithmetic from 13 November 2025, not dates printed in the notifications.

Phase Act provisions Rules My date estimate
On publication Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3): definitions, the Board Rules 1, 2, 17 to 21: Board appointments, meetings, digital office 13 Nov 2025
One year Section 6(9) and 27(1)(d): Consent Managers Rule 4: Consent Manager registration ~13 Nov 2026
Eighteen months Sections 3 to 5, 6(1)-(8) and (10), 7 to 17, 27 (rest), 28 to 34, 36, 37, 44(2): every fiduciary duty, rights, penalties Rules 3, 5 to 16, 22, 23 ~13 May 2027

In practice: the duties, the rights and the penalty schedule all switch on in the eighteen-month phase. That leaves about six and a half months from the date of this post. If your organisation offers services to people in India, your build window is open now.

Consent Manager registration opens first. The Board was established on publication, with its head office in the National Capital Region (G.S.R. 844(E)).

What must a Data Fiduciary do under the DPDP Rules?

Section 8 of the Act sets the general duties. The Rules say how to meet them:

Duty Where What it requires
Lawful basis s.4, s.6, s.7 Consent that is "free, specific, informed, unconditional and unambiguous", or one of the listed legitimate uses (section 7 includes employment purposes)
Notice s.5, rule 3 A standalone notice with an itemised list of the personal data, the specific purpose, and links to withdraw consent, use rights and complain to the Board. Withdrawing must be as easy as consenting
Security s.8(5), rule 6 Reasonable security safeguards, with the minimums listed in rule 6 (see the deeper section below)
Breach intimation s.8(6), rule 7 Tell each affected person without delay. Tell the Board without delay, then send a detailed report within 72 hours
Retention s.8(7), rule 8 Erase data once the purpose is served. Large platforms get fixed inactivity periods. Keep processing logs for at least a year
Contact s.8(9), rule 9 Publish the contact details of a DPO or a person who can answer questions about processing
Processors s.8(1), s.8(2) Engage processors only under a valid contract. You stay responsible for their processing

The Act's own example shows how tightly consent is scoped. A telemedicine app asks for consent to provide the service and to read the user's phone contacts. The contacts are not needed, so consent covers only the telemedicine processing (section 6(1), Illustration).

Large-platform retention. The Third Schedule covers e-commerce entities and social media intermediaries with at least two crore (20 million) registered users in India. It also covers online gaming intermediaries with at least fifty lakh (5 million). These platforms must erase personal data three years after the user last engaged, or three years after the Rules commence, whichever is later. Rule 8(2) requires a warning at least 48 hours before erasure.

Significant Data Fiduciaries. The government can designate an SDF based on data volume and sensitivity, risk to rights and security of the State (section 10). An SDF needs an India-based DPO who answers to its board, plus an independent data auditor. Every twelve months it must run a Data Protection Impact Assessment and an audit, and send the significant findings to the Board (rule 13). It must also check that its algorithmic software poses no likely risk to people's rights.

How does the DPDP Act protect children's data?

In the Act, a child is anyone under eighteen (section 2(f)). Section 9 sets three duties:

  1. Get verifiable consent from a parent or lawful guardian before processing a child's personal data.
  2. Do no processing "likely to cause any detrimental effect on the well-being of a child".
  3. No tracking, behavioural monitoring or targeted advertising directed at children.

Under rule 10, "verifiable" means checking that the person claiming to be the parent is an identifiable adult. You can use identity and age details you already hold, or details the parent supplies, including a virtual token from an authorised entity such as a Digital Locker service provider.

The Fourth Schedule exempts duties 1 and 3 in narrow, conditional cases: health services, schools and crèches tracking for safety, school transport, email-only accounts, real-time location for safety, and confirming a user is not a child. Rule 11 applies similar verification to court-appointed or other lawful guardians of persons with disabilities.

What rights do people have under DPDP, and how fast must you respond?

The Act gives Data Principals four rights:

  • Access (section 11): a summary of their personal data and processing, plus the identities of every fiduciary and processor it was shared with.
  • Correction, completion, updating and erasure (section 12). Erasure is refused where the specified purpose or the law still requires the data.
  • Grievance redressal (section 13). People must use your grievance process first, before they complain to the Board.
  • Nomination (section 14): someone to exercise the rights on their behalf after death or incapacity.

On response times, the texts differ:

  • PIB: fiduciaries must respond to access, correction, update and erasure requests "within a maximum of 90 days" (press release; the backgrounder says the same).
  • Rule 14(3): the Rule's wording sets a period "not exceeding ninety days" for responding to grievances. Fiduciaries and Consent Managers must publish that period and run measures to meet it.

Treat 90 days as the outer limit for every rights request, and publish your own shorter period. For comparison, see how GDPR handles rights and deadlines.

How do the Data Protection Board of India and appeals work?

The Board was established on 13 November 2025 under section 18 (G.S.R. 844(E)). The PIB backgrounder says it "will consist of four members". The Act says the number is whatever the government notifies (section 19), and I have not read that notification.

The Board works as a digital office (rule 20). It can direct urgent remedial measures after a breach, inquire with civil-court powers, refer disputes to mediation and accept voluntary undertakings (sections 27 to 32). Rule 19(9) gives it six months per inquiry, extendable by up to three months at a time.

Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT):

  • File within 60 days of the order (section 29(2)).
  • The tribunal aims to decide within six months (section 29(6)).
  • Rule 22 requires appeals to be filed digitally, with the fee payable via UPI.

What are the DPDP penalties?

The Board can fine only after an inquiry finds a "significant" breach (section 33). The ceilings are in the Act's Schedule (DPDP Act). One crore is 10 million rupees.

Breach Maximum penalty
Failing to take reasonable security safeguards (s.8(5)) ₹250 crore
Failing to notify the Board or affected people of a breach (s.8(6)) ₹200 crore
Breaching the children's duties (s.9) ₹200 crore
Breaching Significant Data Fiduciary duties (s.10) ₹150 crore
A Data Principal breaching their duties (s.15) ₹10,000
Breaching a voluntary undertaking (s.32) Up to the penalty for the original breach
Any other breach of the Act or Rules ₹50 crore

The PIB backgrounder repeats the ₹250 crore, ₹200 crore and ₹50 crore figures but leaves out the SDF row. Section 33(2) lists what sets the amount: gravity, duration, data type, repetition, gain, mitigation and proportionality.

In practice: the largest ceiling is for weak security, not for the breach itself. A late notice is a separate ₹200 crore exposure. One incident can trigger both.

Going deeper: for security and IT teams

Map rule 6 line by line. Rule 6(1) lists minimum safeguards. Each one should map to a control you can show evidence for:

Rule 6(1) Control Evidence
(a) encryption, obfuscation, masking, virtual tokens Field-level encryption or tokenisation for identifiers. Masking in non-production Data inventory showing protection per field
(b) access control to computer resources Role-based access, MFA, joiner-mover-leaver process Access review records
(c) logs, monitoring and review Centralised logging of reads on personal data stores, with alerting Alert rules, review sign-offs
(d) continued processing, e.g. backups Tested, isolated backups Restore test results
(e) keep logs and personal data for one year Log retention set to at least 365 days Retention configuration screenshots
(f) security terms in processor contracts Contract clauses: safeguards, breach notice, audit rights Contract register
(g) technical and organisational measures Policies, training, change control Policy set, change records

Our posts on ISO/IEC 27701 and ISO/IEC 27001 cover management systems that can hold this mapping.

Rule 7 is two reports, not one. Both clocks start "on becoming aware" of the breach. The first report goes to each affected person and to the Board "without delay". For the Board, it covers the nature, extent, timing, location and likely impact. The second report goes to the Board within 72 hours, unless the Board allows longer on a written request. It covers updated details, the causes, mitigation, any findings on who caused the breach, remedial measures, and a report on the notices sent to individuals.

Unlike some regimes, there is no harm threshold in the text: section 2(u) defines a personal data breach broadly. Record a timestamp for awareness. Pre-draft both templates, and make sure notices to individuals can go out through their user account or a registered channel. The breach deadlines comparison shows how 72 hours sits against other countries.

Settle the retention conflict in design. Rule 8(1) requires erasure. Rule 8(3) requires you to keep personal data, traffic data and processing logs for at least one year from processing. The Rules' own example: an e-book platform must keep order, payment and delivery logs for a year "even if X deletes her account". A second example extends this to a fiduciary's cloud provider. So build erasure jobs that delete live profile data on schedule but hold an access-restricted log tier for 12 months, and push the same rule to processors by contract.

Children. Design age assurance so it does not over-collect. Rule 10 accepts identity and age details you already hold, or a token from an authorised entity, so you do not need to store document images. Separately, audit your ad and analytics tags. Section 9(3) bans tracking and targeted advertising directed at children, and the exemptions are narrow.

Transfers. Transfers abroad are allowed unless the government restricts a country (section 16), and an SDF may face localisation for specified data (rule 13(4)). Tag datasets by residency now. IT service firms should read section 17(1)(d), which exempts much of the Act for data on non-residents processed under a foreign contract.

What to ask your team and vendors.

  1. Who records the "became aware" timestamp, and can we file a detailed Board report in 72 hours?
  2. Do processor contracts require breach notice fast enough for rule 7, and one-year log retention?
  3. Which services could a child use, and how do we verify a parent?

Learn more

More country guides are on the privacy law pillar page, including Singapore's PDPA.

Key takeaways

  • The DPDP Act 2023 took effect only through notifications dated 13 November 2025. PIB's backgrounder gives 14 November as the notification date.
  • The Board exists now. Consent Manager registration follows after one year, and every fiduciary duty, right and penalty arrives at eighteen months, around 13 May 2027 by my count.
  • A breach needs a notice to affected people and the Board without delay, then a detailed Board report within 72 hours (rule 7).
  • Children are under-18s. You need verifiable parental consent, and tracking and targeted advertising aimed at them are banned, with narrow exemptions.
  • Penalties go up to ₹250 crore for weak security safeguards and ₹200 crore each for breach notification and children's duties.

Sources