DPDP Rules timeline: what applies when, and what to build by May 2027

The Digital Personal Data Protection Rules, 2025 come into force in three stages: the Data Protection Board from 13 November 2025, the registration of Consent Managers one year later, and almost every duty on businesses eighteen months after notification, on 13 May 2027 (rule 1 of the Rules). If your business collects personal data through a website, an app or a form, the last date is the one to plan for, and most of the work is in your systems, not your policies. This is not legal advice. TechSum implements the technical side, and partner counsel advises on what the law requires of you.

What are the three DPDP dates?

The Rules were notified as G.S.R. 846(E), dated 13 November 2025, and the Press Information Bureau announced them the next day (PIB backgrounder on the DPDP Rules). Rule 1 then splits them into three groups, and a separate commencement notification does the same for the sections of the Digital Personal Data Protection Act, 2023.

1. 13 November 2025: definitions and the Data Protection Board (rules 1, 2 and 17 to 21).
2. 13 November 2026: registration and duties of Consent Managers (rule 4 and section 6(9)).
3. 13 May 2027: notice, consent, security, breach intimation, retention, children's data and the rights of individuals (rules 3, 5 to 16, 22 and 23).

The calendar dates are worked out from the date of publication. The PIB release gives 14 November 2025 as the notification date, so some count from that day instead. A day either way changes nothing about how early you should start.

What has applied since November 2025?

Only the machinery. The Data Protection Board exists, its members can be appointed and it can set up its digital office (rules 17 to 21). No duty on a normal business switched on that day. Separate rules already apply under the Information Technology Act, including the CERT-In direction to report certain cyber incidents within six hours (our guide to the CERT-In rule).

What changed on 13 November 2026?

Consent Managers can now be registered. A Consent Manager is a company that runs a platform where people give, review and withdraw consent across many businesses (section 6(7) of the Act). It must be registered with the Board (section 6(9)), and rule 4 with the First Schedule sets who may apply and what a registered one must do. Among other conditions, the applicant must be a company incorporated in India with a net worth of at least two crore rupees (First Schedule, Part A).

For a business that only wants to collect consent on its own site or app, this date changes nothing. Using a Consent Manager is optional.

Has the timeline been shortened?

Not by any notification published as of 14 November 2026. In January 2026, Business Standard reported that the Ministry of Electronics and Information Technology had floated cutting the window to twelve months for some provisions, mainly for Significant Data Fiduciaries. No amendment to rule 1 or to the commencement notification has followed. Plan to 13 May 2027 and check the Gazette before you rely on any reported change.

What must your website and app have by 13 May 2027?

Each rule below becomes a change to a form, a database, a log or a page.

Notice (rule 3)

The notice must stand on its own, list the personal data and the purpose in plain language, and link to how a person can withdraw consent, exercise their rights and complain to the Board. On a site, that means a short notice beside every form and sign-up screen, item by item, with its own link, separate from the privacy policy.

Consent (section 6)

Consent must be specific and given by a clear action, and withdrawing it must be as easy as giving it (section 6(4)). Build unticked boxes, one per purpose, and keep a consent record for each person with the time, the notice version and the purpose. Put a withdraw button in the account or the footer, one click away like the original tick.

Security (rule 6)

The rule asks for encryption or masking, access control, logs and monitoring, backups, and security terms in your contracts with processors. In practice: encrypted fields for sensitive data, role-based access in the admin, an access log you can search, backups you have restored at least once, and a clause in each vendor contract.

Logs (rule 6(1)(e) and rule 8(3))

Keep the relevant logs and personal data of processing for at least one year. Set log retention to a year or longer in your hosting, database and analytics tools, then delete after that.

Breach (rule 7)

Tell each affected person without delay, and the Board without delay, with a detailed report to the Board within seventy-two hours (rule 7(2)(b)). You need an incident runbook, a way to email or message every affected user from your own system, and a named person who writes the report.

Retention (rule 8)

Erase data once its purpose is served. The Third Schedule sets three years of inactivity for large e-commerce, gaming and social media platforms, and rule 8(2) asks for a notice forty-eight hours before erasure. Build a scheduled deletion job for each data type, with an automated warning email before it runs.

Contact (rule 9)

Publish the business contact of a person who can answer questions about personal data. Show it on the website and in the app, and include it in every reply to a rights request.

Children (rule 10)

Get verifiable consent from a parent before processing a child's data. If anyone under eighteen uses your service, you need an age gate and a parent verification flow.

Rights (rule 14)

Publish how people can ask for access, correction or erasure, and answer grievances within a period of no more than ninety days (rule 14(3)). Set up a request form or inbox, an internal tracker with dates, and a search that finds a person across every tool that holds their data.

None of these is large on its own, but together they touch most of a typical site: the forms, the CRM sync, the admin panel, the hosting logs and the email platform. That is why they take longer than writing the policy.

How long does this work take?

It depends on how many systems hold personal data, not on the size of the company. A business with one website form and a CRM can finish in a short engagement. One with an app, a payment flow, WhatsApp and three spreadsheets will need longer, mostly because each system has its own export, deletion and logging settings.

Start with a data map: every place personal data enters, moves and rests. Our guide to what a small business must do first under the DPDP Act sets out that first pass. Then work through the list above in the order that saves rework: notice and consent first, then security and logs, then retention and rights. The detail on cookies is in cookie consent under DPDP, and the request process in how to handle data requests.

What are the trade-offs?

Building everything at once is tempting and usually wasteful. A consent record designed before the data map is done often has to be rebuilt when a new source turns up.

There is also a choice between your own consent flow and a registered Consent Manager. Your own flow is simpler and keeps the record in your systems. A Consent Manager may suit a business that shares data with many partners, but it adds a vendor, a contract and an integration to maintain.

Where does TechSum fit?

We build the technical parts listed above: notice and consent flows, consent records, access logs, retention jobs, breach runbooks and request workflows. Partner counsel advises on legal interpretation, and formal testing goes through accredited partners. If you want to know where your own setup stands against these rules, the DPDP Readiness Scan gives a short written report with the fixes to make first. More detail is on the DPDP Act compliance page.