Compliance
The Act has been law since 2023 and enforced almost nothing. The Rules notified on 13 November 2025 set the clock — one year for consent managers, eighteen months for everything that touches you.
Check your DPDP readiness — free More on the blogThe Digital Personal Data Protection Act has been on the statute book since August 2023 and required, in practice, almost nothing of anybody. There were no rules, no Board, and no date. That ended on 13 November 2025, when the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 and, with them, a timetable. The timetable is the useful part, and it is the part almost no coverage states plainly. The Rules do not all commence together. They commence in three tranches, and the tranche that matters to an ordinary business is the last one.
So the honest summary is this: the Board exists today, the consent-manager plumbing exists in a year, and the duties that touch your signup form, your CCTV feed and your HR file bite in eighteen months. Your clients have a window, not an exemption — and the window is the reason to start, not a reason to wait.
Rules 3 and 5 to 16 are not administrative housekeeping. Rule 3 governs the notice a Data Fiduciary must give — what it says, how plainly it says it, and that it must stand on its own rather than being buried in a longer document. Rule 6 governs reasonable security safeguards, which the Act leaves undefined and the Rules give shape to. Rule 7 governs what you tell the Board and the affected person when there is a breach, and how fast. Rule 8 governs how long you may keep what you hold. Every one of those is an inventory problem before it is a drafting problem. You cannot write a retention schedule for data you have not listed, and you cannot put a notice at a collection point nobody has catalogued. That is the work, and it is why eighteen months is shorter than it sounds: the drafting takes an afternoon and the listing takes the other seventeen months, mostly in the form of finding the third spreadsheet. The Rules did not make the Act harder. They made it dated. A duty with no date is a thing you agree with; a duty with a date is a thing you schedule.
Start where the Rules will start: with the places personal data enters the business. Every form, every WhatsApp order flow, every delivery address field, every CCTV camera, every HR file, every vendor you have handed a customer list to. For each, three questions — what do we collect, what did we say we would use it for, and how long do we keep it. That inventory answers most of Rule 3, most of Rule 8, and tells you what Rule 6 has to protect. The DPDP readiness check on this site walks the same ground in about five minutes and returns a score with the section behind every gap, and the privacy policy and vendor data processing agreement templates draft from your own answers rather than from a specimen written for somebody else. If you want the underlying duties rather than the timetable, what an Indian SMB actually has to do under the Act covers consent, security and breach reporting in the order a business meets them.
Commencement dates in the Rules run from publication, and different summaries of them differ by a day depending on whether they count from the date of publication or the date the first tranche took effect. Where a day matters to you — a board paper, a client undertaking, a contractual warranty — read the commencement clause in the notified Rules rather than any summary of it, this one included. Everywhere else, work to the month: November 2026 and May 2027.
In three stages. Rules 1, 2 and 17 to 21 — definitions, and the constitution and procedure of the Data Protection Board — took effect on notification, 13 November 2025. Rule 4, the registration and obligations of Consent Managers, comes into force one year after publication, on 12 November 2026. Everything else — Rule 3 and Rules 5 to 16, plus Rules 22 and 23 — comes into force eighteen months after publication, on 12 May 2027. That last tranche is the one that carries notice, security safeguards, breach reporting, retention, children’s data and data principal rights, which is to say almost everything an ordinary business has to do.
The Act’s own duties have been in force since it was passed; what the Rules add is the detail of how to discharge them and a date by which the detail bites. Waiting until May 2027 to start means building a consent notice, a retention schedule, a breach procedure and a grievance channel in the same quarter, across every form and system you own. The work is inventory work and it does not compress well. Businesses that treat the eighteen months as preparation time rather than exemption time finish it in ordinary weeks.
A Consent Manager is an intermediary registered with the Data Protection Board through which a Data Principal can give, manage, review and withdraw consent across the businesses that hold their data, from a single place. Rule 4 sets the registration conditions and the obligations that follow, and it comes into force on 12 November 2026 — a year before the substantive rules. For most small businesses this is not a duty so much as a channel: consent you rely on may arrive, and may be withdrawn, through somebody else’s interface.
Rule 8 read with the Third Schedule sets erasure timelines for specified classes of Data Fiduciary once the Data Principal has not approached them for the specified period, with notice before erasure. For everyone else the governing principle is the Act’s own: keep personal data only as long as the purpose you took consent for requires it, then erase it. In practice the compliance artefact is a written retention schedule that names each category of data, the purpose, and the period — and that is the document almost nobody has.
Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this