DPDP Act and DPDP Rules 2025:
what you have to do.
A plain-English walkthrough of India's Digital Personal Data Protection Act, obligation by obligation, written for the people who have to implement it rather than the people who litigate it.
Last updated Published by TryTrustableNot legal advice
Who the Act is talking to
The Act uses three terms consistently, and everything else follows from them. A Data Principal is the individual the data is about. A Data Fiduciary is whoever determines the purpose and means of processing, which for most companies reading this means you. A Data Processor processes on a Fiduciary's behalf, under contract.
The word fiduciary is doing real work there. It signals that the relationship is one of trust rather than transaction, and it explains why the burden of proof sits where it does: when a question arises about whether notice was given and consent taken, it is the Fiduciary who has to show it, not the Principal who has to disprove it.
The obligations, in the order they bite
Read in isolation the Act is a list. Read operationally it is a sequence: you cannot collect until you have given notice, you cannot keep until you have a purpose, and you cannot prove any of it later unless you recorded it at the time.
| Obligation | Where | What it means in practice |
|---|---|---|
| Notice before consent | Section 5 | An itemised notice, in clear and plain language, saying what data, for what purpose, how to withdraw, how to complain to you, and how to complain to the Board. It must be available in English or an Eighth Schedule language. |
| Free, specific, informed consent | Section 6 | Consent must be a clear affirmative action, limited to the data necessary for the stated purpose, and as easy to withdraw as it was to give. Pre-ticked boxes and bundled consent do not qualify. |
| Consent Managers | Section 6(7)–(9) | A Data Principal may give, manage, review and withdraw consent through a Consent Manager registered with the Board, which must be interoperable and accountable to the Principal. Covered in its own section below. |
| Accuracy and security | Section 8 | Keep data accurate where it is used to make decisions, apply reasonable security safeguards, and impose the same obligations on your processors by contract. |
| Breach notification | Section 8(6) | Notify the Board and each affected Data Principal of a personal data breach. The Act does not set a materiality threshold, which makes this broader than most teams expect. |
| Erasure when purpose ends | Section 8(7) | Delete when consent is withdrawn or the purpose is served, unless retention is required by law. This is a deletion obligation, not a retention policy. |
| Children's data | Section 9 | Verifiable parental consent for anyone under 18, and a prohibition on tracking, behavioural monitoring and targeted advertising directed at children. |
| Significant Data Fiduciaries | Section 10 | If the Central Government notifies you as an SDF, you additionally need a DPO based in India, an independent data auditor, and periodic Data Protection Impact Assessments. |
| Data Principal rights | Sections 11–14 | Access to a summary of processing, correction and erasure, grievance redressal, and the right to nominate someone to exercise rights on death or incapacity. |
Section references are to the Act as passed in August 2023. The operational detail sits in the DPDP Rules 2025, which are covered below along with the dates each obligation commences.
The part teams underestimate
Most of the work above is familiar to anyone who has done GDPR. Two things are not.
The burden of proof. When the Board asks whether a person consented, the answer cannot be that your banner was configured correctly. It has to be a record: this person, this notice version, this language, this timestamp, this set of purposes, this action. If your consent tooling stores a boolean, you do not have an answer.
Language. A notice available only in English is not available in the sense the Act means for a large part of your user base. Offering Eighth Schedule languages is straightforward; proving which language a specific person was shown is the part that requires the record to carry the language field.
Both are why we built the consent ledger the way we did: append-only, versioned against the notice that produced it, with the language stored on the record. How that works, or see Consent by TryTrustable, the standalone consent management platform.
What are the DPDP Rules 2025 deadlines?
The DPDP Rules 2025 commence in three stages. The Board provisions took effect when the Rules were notified in November 2025. Consent Manager registration under Rule 4 starts on 13 November 2026. Notice, security safeguards, breach intimation, retention, children's data, Significant Data Fiduciary duties and rights handling all apply from 13 May 2027.
The Act passed in August 2023 but left the operational detail to rules. Those arrived as the Digital Personal Data Protection Rules, 2025, published as Gazette notification G.S.R. 846(E) dated 13 November 2025 and announced by MeitY on 14 November 2025. Rule 1 switches them on in stages, counted from publication: some rules at once, Rule 4 after one year, and the rest after eighteen months. The notified text is on the MeitY site. You are not working to one deadline. You are working to three:
| Date | Rules that commence | What applies | What it means for you |
|---|---|---|---|
| 13 Nov 2025 on publication | Rules 1, 2 and 17–21 | Definitions, and the Data Protection Board: appointment of members, meetings, the Board as a digital office, its staff. | There is now a body that can receive a complaint and open an inquiry. Nothing is theoretical from here. |
| 13 Nov 2026 one year | Rule 4 and the First Schedule | Registration and obligations of Consent Managers. | Registration is narrow: a company incorporated in India with a net worth of at least ₹2 crore and an independently certified platform. Almost nobody becomes one. What matters to you is whether your users will arrive through one. |
| 13 May 2027 eighteen months | Rules 3, 5–16, 22 and 23 | Notice (3), security safeguards (6), breach intimation (7), retention and erasure (8), contact details (9), children and persons with disability (10–12), Significant Data Fiduciaries (13), rights (14), cross-border transfer (15), appeals (22) and government calls for information (23). | The bulk of the work, and the set that needs systems changed rather than documents written. |
Rule numbers and dates from Rule 1(2)–(4) of the DPDP Rules 2025. Confirm against the Gazette text before you build a plan around a specific day.
Will the 13 May 2027 date move earlier? Possibly, for the largest companies. In January 2026 MeitY consulted industry on shortening the eighteen-month window to twelve months, which would bring the substantive duties forward to 13 November 2026, with Significant Data Fiduciaries such as large platforms, banks and insurers the stated focus. As of 28 September 2026 no amending notification has been published, so the dates in the table stand. A large company should plan to be ready by November 2026 anyway: the proposal is on record, and the consent and notice systems take longer to build than a Gazette notice takes to publish.
Three of the new requirements are worth calling out, because each one implies a system change rather than a policy paragraph:
Breach reporting runs on a clock. Under Rule 7 you tell each affected Data Principal without delay, tell the Board without delay, and give the Board the full particulars within 72 hours of becoming aware. A 72-hour obligation is not met by a process that begins with someone noticing an alert on Monday.
Retention has an outer limit tied to inactivity, and a floor. Under Rule 8 and the Third Schedule, large e-commerce entities and social media intermediaries (two crore or more registered users in India) and online gaming intermediaries (fifty lakh or more) must erase personal data three years after the person last engaged, with 48 hours' warning first. Separately, every Data Fiduciary must keep personal data, traffic data and processing logs for at least one year. Both are jobs on a schedule, which means they have to be built.
Children's data needs verifiable parental consent. Under-18s require consent that you can actually evidence, with the parent's identity and age checked under Rule 10, and narrow carve-outs in the Fourth Schedule for healthcare, education and safety. If you cannot tell which of your users are minors, this is the obligation to start on first.
What is a Consent Manager under the DPDP Act?
A Consent Manager under the DPDP Act is a company registered with the Data Protection Board that gives individuals a single, interoperable platform to give, manage, review and withdraw their consent across many Data Fiduciaries. It acts for the Data Principal, not for the business, and Board registration under Rule 4 opens on 13 November 2026.
The definition is in section 2(g) of the Act, and the role in section 6(7) to (9): a Data Principal may give, manage, review or withdraw consent through a Consent Manager; the Consent Manager is accountable to the Data Principal and acts on her behalf; and every Consent Manager must be registered with the Board. Rule 4 and the First Schedule of the Rules set the conditions: a company incorporated in India, net worth of at least ₹2 crore, sufficient technical, operational and financial capacity, an independently certified interoperable platform, a duty to act in a fiduciary capacity towards the Data Principal, and structural separation from the Data Fiduciaries it serves.
Running a consent management platform on your own website or app is a different thing. A CMP is software a Data Fiduciary operates to collect, enforce and evidence its own consents. It acts for the business, covers one business's notices, and needs no registration. Most companies need a CMP; very few will ever become a Consent Manager. What they may need is the ability to honour consent that arrives through one. Our full explainer on DPDP Consent Managers and registration under Rule 4 covers the conditions item by item.
How is the DPDP Act different from the GDPR?
The DPDP Act is narrower than the GDPR in scope and stricter on consent. It covers only digital personal data, allows consent or listed legitimate uses instead of six lawful bases, treats everyone under 18 as a child, requires every breach to be reported, and caps penalties per instance in rupees rather than as a share of turnover.
Each cell below is checked against the DPDP Act, the DPDP Rules 2025 and the GDPR as published on EUR-Lex.
| DPDP Act 2023 and Rules 2025 | GDPR | |
|---|---|---|
| Scope | Digital personal data processed in India (collected digitally, or collected on paper and digitised), and processing outside India connected to offering goods or services to people in India (s.3). Paper records never digitised are out. | Automated processing, and manual processing in a filing system (Art. 2). Controllers established in the EU, and those outside it offering goods or services to, or monitoring, people in the EU (Art. 3). |
| Lawful bases | Consent, or one of the certain legitimate uses in s.7: voluntarily provided data, state functions, employment, medical emergencies, disasters and a few others. No contract or legitimate interests basis. | Six bases in Art. 6(1): consent, contract, legal obligation, vital interests, public task, legitimate interests. |
| Consent standard | Free, specific, informed, unconditional and unambiguous, by clear affirmative action, limited to the data necessary (s.6(1)). Notice available in English or an Eighth Schedule language (s.5(3)). Withdrawal as easy as giving (s.6(4)). The Fiduciary must prove notice and consent (s.6(10)). | Freely given, specific, informed and unambiguous (Art. 4(11)). The controller must be able to demonstrate consent (Art. 7(1)), and withdrawal must be as easy as giving it (Art. 7(3)). |
| Children | Under 18. Verifiable parental consent before processing any child's data (s.9(1), Rule 10), and no tracking, behavioural monitoring or targeted advertising directed at children (s.9(3)). | Under 16 for information society services offered directly to a child where consent is the basis; member states may lower this to no less than 13 (Art. 8). |
| Cross-border transfers | Permitted except to countries the Central Government restricts by notification (s.16), subject to any requirements it sets on data made available to foreign states (Rule 15). Stricter sectoral rules still apply. | Only with an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a listed derogation (Chapter V, Arts. 44–49). |
| Breach notification | Every personal data breach, with no risk threshold, to the Board and each affected Data Principal (s.8(6)). Detailed report to the Board within 72 hours of becoming aware (Rule 7). | To the supervisory authority within 72 hours where feasible, unless unlikely to result in a risk (Art. 33). To individuals only where the risk is high (Art. 34). |
| DPO, SDF and DPIA | A DPO based in India, an independent data auditor and periodic DPIAs only for Significant Data Fiduciaries notified by the Central Government (s.10). Every Fiduciary publishes a contact for questions (Rule 9). | A DPO for public authorities and for large-scale monitoring or special-category processing (Art. 37). A DPIA wherever processing is likely to be high risk (Art. 35). |
| Penalties | Up to ₹250 crore per instance for failed security safeguards, down to ₹50 crore for the catch-all (s.33 and the Schedule). No turnover-based cap. | Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements (Art. 83(5)). |
| Regulator | One national body, the Data Protection Board of India, working as a digital office. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal. | A supervisory authority in each member state, with a lead authority for cross-border processing and the European Data Protection Board for consistency. |
Summary for orientation, not a substitute for the text. Section and article numbers are given so you can check each one.
The practical upshot: a GDPR programme built on legitimate interests or contract will need consent, or a named legitimate use, for the same processing in India. And because the caps apply per instance of non-compliance rather than per affected person, the exposure is easier to judge with numbers in front of you in the DPDP penalty calculator, and in the penalty schedule explained breach by breach.
Section references are to the Act as passed in August 2023 and the Rules as notified in November 2025. This page is reviewed as the position changes; it is not legal advice.
Where to start if you are starting today
In order, because each step makes the next one cheaper:
1. Find out what you are actually doing. Run a scan of your own site and see what fires before anyone consents. Most teams are surprised, and it is the fastest way to size the problem. The free cookie and tracker scan takes a minute.
2. Write the notice. Purpose by purpose, in plain language, in the languages your users read. We publish a free DPDP consent notice template.
3. Make consent provable. Record the choice, the notice version, the language and the timestamp, in a store you cannot quietly edit later. That is the job of a consent management platform with a tamper-evident ledger.
4. Map the data. What you hold, where it goes, who processes it for you, and when it gets deleted. This is also most of what you need for a DPIA. Start from our free DPIA template.
5. Wire the rights. Access, correction, erasure and grievance need a route in and a clock, not an inbox somebody checks.
The things people ask us
When do the DPDP obligations actually bite?
The Rules were notified in November 2025 with a staggered commencement. The provisions constituting the Data Protection Board took effect at once; its powers to inquire and penalise start on 13 May 2027. Consent Manager registration under Rule 4 starts on 13 November 2026, and the substantive duties (notice, security safeguards, breach intimation, retention, children's data and rights ) on 13 May 2027. Treat 13 May 2027 as the date your systems have to be ready for.
What is a Consent Manager under the DPDP Act?
A Consent Manager is a company registered with the Data Protection Board that gives individuals one interoperable platform to give, manage, review and withdraw consent across many Data Fiduciaries. It acts for the Data Principal, not the business. Registration under Rule 4 opens on 13 November 2026. Running a consent management platform on your own site is a different thing and needs no registration.
Does the DPDP Act apply to my company if we only have customers abroad?
It applies to personal data processed in India, and to processing outside India where that processing is in connection with offering goods or services to Data Principals in India. A company incorporated in India processing Indian users' data is squarely in scope. A company abroad with Indian users is also in scope for that processing.
Is consent the only lawful basis under DPDP?
No. Consent is the primary basis, but the Act also allows processing for certain legitimate uses, including where the Data Principal voluntarily provides data for a specified purpose, and for specified state functions, employment purposes, medical emergencies and disasters. Legitimate uses are narrower than the GDPR's legitimate interests and should not be treated as an equivalent.
What languages does the notice have to be available in?
The notice must be available in English or any language listed in the Eighth Schedule to the Constitution of India, which covers 22 languages. In practice this means offering the notice in the languages your users actually read, and being able to show which language a given person was shown.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries are required to appoint a DPO, who must be based in India and report to the board or equivalent. Every Data Fiduciary, however, must publish contact details for a person who can answer questions about processing, and must have a grievance redressal mechanism.
How is this different from the GDPR work we already did?
The obligations rhyme but the mechanics differ. DPDP has no equivalent of legitimate interests as a general basis, requires notice in Eighth Schedule languages, introduces the Consent Manager as a registered intermediary, and puts the burden of proving notice and consent squarely on the Data Fiduciary. Your GDPR controls are a strong starting point but not a complete answer.
What are the DPDP Rules 2025 deadlines?
Three dates. The Rules were notified in November 2025 (Gazette dated 13 November, announced 14 November), and the provisions constituting the Board applied immediately (its powers to inquire and penalise start on 13 May 2027). Rule 4, Consent Manager registration, commences on 13 November 2026. Rules 3 and 5 to 16, covering notice, security, breach intimation, retention, children's data, Significant Data Fiduciaries and rights, commence on 13 May 2027.
See what fires before anyone says yes.
Run the free scan on your own domain. Two passes, one before consent and one after, with every cookie, tracker and fingerprinting call named against the obligation it touches.