India's Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025.

The timeline

  • 13 November 2025: first rules in force, including the Data Protection Board.
  • 13 November 2026: Consent Manager registration and duties.
  • 13 May 2027: the main duties for data fiduciaries.

What the main duties cover

Notice to the person, security safeguards, breach reporting to the Board, retention and erasure, children's data, extra duties for Significant Data Fiduciaries, rights of data principals and cross-border transfers.

Questions for a partner

  • Where will you store our data and who can see it?
  • How do you record consent and handle a deletion request?
  • Who tells the Board and the customer if there is a breach?

Sample story, checked against the source on 17 October 2026. Confirm details with the source before you rely on them.

Source: DPDP Rules 2025 timeline