In this article
This article is general information, not legal advice. For your own business, ask a lawyer who knows data protection.
It is written for any business that handles the personal data of people in India, wherever the business is based. Other countries have their own laws, such as the GDPR in the European Union. This article does not cover them, so ask a lawyer who knows the law where your customers live.
India's Digital Personal Data Protection Act, 2023 (the DPDP Act) sets rules for how organisations use personal data. The DPDP Rules, 2025, published in the Gazette of India on 13 November 2025, explain how it works in practice. Here is what an ordinary business must do, and from when.
Who it applies to
The Act covers digital personal data: data about an identifiable person, collected in digital form or collected on paper and digitised later. It applies to processing in India, and outside India when it relates to offering goods or services to people in India. It does not cover data used by an individual for personal or domestic purposes.
The Act calls a business that decides why and how personal data is used a Data Fiduciary. If you hold customer, staff or lead details, that is likely you.
The dates
The Act and the Rules start in stages. The Gazette states the periods, counted from its date of 13 November 2025.
13 November 2025: the parts that set up the law and the Data Protection Board of India came into force. They place no duties on ordinary businesses.
13 November 2026 (one year): rules for registering Consent Managers, companies that help people manage their consent. They do not apply to ordinary businesses.
13 May 2027 (18 months): the main duties for businesses, described below, and the penalties for breaking them.
A January 2026 stakeholder meeting reportedly discussed shortening the period for some duties of significant data fiduciaries, a class the government can name for extra duties. We found no official notification changing any date as of 19 October 2026. Check meity.gov.in before relying on a date.
What you must do from 13 May 2027
1. Give a clear notice before you ask for consent
The notice must list the personal data you want and why, explain how the person can withdraw consent, use their rights and complain to the Data Protection Board, and be understandable on its own, in plain language. People must be able to read it in English or any language listed in the Eighth Schedule to the Constitution of India.
2. Get proper consent and keep proof
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, and limited to the data you need for the stated purpose. Withdrawing must be as easy as giving it, and afterwards you must stop using the data within a reasonable time unless a law requires you to keep it. If asked, you must prove that you gave the notice and got the consent, so keep records. The Act also allows some uses without a fresh request, for example sending a receipt to a number a customer gave you for that purpose.
3. Keep the data safe
The Rules set a minimum: encryption, masking or tokens; control over who can access systems; logs and monitoring to spot unauthorised access; backups; keeping logs and personal data for one year to investigate problems, unless another law says otherwise; and contracts with your service providers that require safeguards. You stay responsible for data your providers handle for you.
4. Report breaches
If personal data is accessed without permission, disclosed by mistake or lost, you must tell each affected person without delay, in plain language: what happened, what it may mean for them, what you are doing, what they can do, and whom to contact. You must also tell the Data Protection Board without delay, and send fuller details within 72 hours, or longer if the Board allows it in writing. Plan now who decides and who writes.
5. Answer people's requests
People can ask for a summary of their data and who it was shared with, and can ask you to correct, complete, update or erase it. Publish how to make a request and a contact who can answer questions, and run a complaints process that responds within 90 days at most.
6. Take extra care with children
A child is anyone under 18. Before using a child's data you need verifiable consent from a parent or lawful guardian, and you must not track or monitor children's behaviour or aim advertising at them. PIB says there are limited exceptions for essential purposes such as healthcare, education and real-time safety.
7. Delete data you no longer need
When a person withdraws consent, or the purpose is served, erase the data and make your service providers erase it too, unless a law says you must keep it.
What happens if you do not comply
The Act sets these upper limits on penalties: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach or for breaking the rules on children, and up to ₹50 crore for most other breaches. A crore is 10 million, so ₹250 crore is 2.5 billion Indian rupees.
Where to start
List the personal data you hold, where it sits and why you collect it.
Rewrite your forms and notices in plain language, and add a consent step that people can also withdraw.
Check your security and your contracts with providers, and write a breach plan.
What to do next
At Supervention we work to the DPDP Act. If other rules apply to you, we set out in writing what we do for each. If you need a system that handles consent, requests and records properly, send us your requirement. We reply with a written proposal showing scope, timeline and quote, at no cost until you agree. Every system has monitoring, tests and human checks.
Sources, checked on 19 October 2026: Ministry of Electronics and Information Technology (meity.gov.in), the Digital Personal Data Protection Act, 2023, notification G.S.R. 843(E) and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), both dated 13 November 2025; Press Information Bureau (pib.gov.in), release of 14 November 2025; Legal 500, article by Khurana & Khurana, 18 March 2026.