India's Digital Personal Data Protection Rules were notified on 13 November 2025. They switch on in stages.
The dates
- 13 November 2025: the title, definitions and the Data Protection Board rules took effect.
- 13 November 2026: the rule on registering and running Consent Managers takes effect.
- 13 May 2027: the main duties for data fiduciaries take effect. These cover notices, security safeguards, breach reporting, retention and erasure, children's data, rights of data principals and cross-border transfers.
What to do now
List every system that holds customer or employee personal data, starting with your CRM, billing and support tools. Ask each vendor how they will support consent records, deletion requests and breach reporting. Put the answers in the contract.
Sample story, checked against the source on 17 October 2026. Confirm details with the source before you rely on them.
Source: DPDP Rules 2025 timeline