DPDP Rules 2025 timeline: what applies when

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) does not switch on all at once. The Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, and the Rules bring the law into force in three phases. Here is what applies when, and what to do in each window.

Phase 1: from 13 November 2025

The provisions that set up the Data Protection Board of India took effect straight away (Rules 1, 2 and 17 to 21). They cover how the Board is appointed, its terms of service and how it works as a digital office.

For most organisations nothing changed on day one, but the regulator now exists. This is the time to plan.

Phase 2: from 13 November 2026

Rule 4 on Consent Managers takes effect. Consent Managers are companies registered with the Board that let people give, manage, review and withdraw consent across many organisations from one place.

If your organisation collects consent at scale, decide whether you will accept consent through Consent Managers, and make sure your systems can record consent and withdrawals reliably.

Phase 3: from 13 May 2027

The core duties apply (Rules 3, 5 to 16, 22 and 23). From this date Data Fiduciaries must:

• give a clear, stand-alone notice before or when they collect personal data, and take valid consent where consent is the basis for processing
• take reasonable security safeguards, such as encryption, access control and logging, and keep logs for at least one year
• report a personal data breach to the affected people and to the Board, with a detailed report to the Board within 72 hours
• answer requests from Data Principals to access, correct and erase their data, and run a grievance process
• get verifiable parental consent before processing a child’s data (a child is anyone under 18)
• erase data once its purpose is served, with the time limits the Rules set for some large platforms

Significant Data Fiduciaries, which the Government will notify, have extra duties: a Data Protection Officer based in India, an independent data auditor, and regular Data Protection Impact Assessments and audits.

What to do now

Eighteen months sounds long, but mapping data, rewriting notices, changing consent flows and training staff takes time. A practical order is:

1. Map your data. List what personal data you collect, why, where it is stored and who it is shared with.
2. Fix notices and consent. Rewrite privacy notices in plain language and check each consent request is specific and easy to withdraw.
3. Prepare for breaches. Write a breach response plan that can meet the 72-hour report.
4. Set up rights handling. Decide who answers access, correction and erasure requests and grievances, and how fast.
5. Train your people. Most breaches start with a person, not a system.

Learn it properly

Our online courses explain the Act and the Rules in plain language and turn them into practical steps for compliance, legal, IT, HR and operations teams. Browse the courses.

This article is for education and is not legal advice.