Home › Law library › DPDP Act / DPDP Rules

DPDP Act / DPDP Rules

Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025

Sourced · 11/14 facts confirmed by two sources. Last verified 10 October 2026

Next full re-check due: April 2027. Regulator news is checked monthly; changes are logged in the change log.

Cite this page: GlanceDesk Jurisdiction, “DPDP Act / DPDP Rules (India)”, glancedeskjurisdiction.com/laws/in-dpdp, last verified 10 October 2026.

India Privacy

Status: Enacted; phased in. Rules notified 13 Nov 2025 (G.S.R. 846(E)). Board rules in force 13 Nov 2025; consent-manager rules from 13 Nov 2026; most business obligations from 13 May 2027. Sources differ on which rules start on 13 Nov 2026.Sources: meity.gov.in, hlc.com, dlapiperdataprotection.com
Who it applies to: Processing of digital personal data in India, and processing outside India linked to offering goods or services to people in India. Personal/domestic use and data made public by the individual are excluded.✓DPDP Act s.3 ↗ · Sources: meity.gov.in, dlapiperdataprotection.com
Size thresholds: No size threshold: every Data Fiduciary is covered. Government may designate Significant Data Fiduciaries (SDFs) based on data volume, sensitivity and risk; SDFs carry extra duties.✓DPDP Act s.10(1) ↗ · Sources: meity.gov.in, dlapiperdataprotection.com, static.pib.gov.in
Regulator: Data Protection Board of India (appeals to TDSAT); rules made by the Ministry of Electronics and IT (MeitY)✓DPDP Act ss.18, 27, 29, 40; DPDP Rules rr.17–21 ↗ · Sources: static.pib.gov.in, dlapiperdataprotection.com
Breach or incident reporting: From 13 May 2027 (DPDP Rule 7): inform the Board without delay and file a detailed report within 72 hours of becoming aware (extendable by the Board); tell each affected person without delay in plain language. In force now: report specified cyber incidents to CERT-In within 6 hours (CERT-In Directions, 28 Apr 2022).✓DPDP Act s.8(6); DPDP Rules r.7 (commencement r.1); CERT-In Directions 28 Apr 2022 para (ii) (IT Act s.70B(6)) ↗ · Sources: cert-in.org.in, static.pib.gov.in
Deadline to answer personal data requests: From 13 May 2027: people can ask for access, correction, completion, updating and erasure of their data (DPDP Act ss.11–12). Neither the Act nor the Rules set a fixed reply deadline for these requests; grievances must be resolved within a reasonable period not exceeding 90 days (Rule 14(3), Act s.13).DPDP Act ss.11–13; DPDP Rules r.14(3) ↗ · Sources: static.pib.gov.in
Data protection officer: From 13 May 2027: all fiduciaries must publish contact details of a person who can answer data queries (a designated officer or DPO). Significant data fiduciaries must appoint an India-based DPO reporting to the board.✓DPDP Act s.8(9), s.10(2)(a); DPDP Rules r.9 ↗ · Sources: meity.gov.in, meity.gov.in, dlapiperdataprotection.com
Local representative: No separate local representative rule. Foreign fiduciaries in scope must still publish a contact person; SDF DPOs must be based in India.✓no provision (contact: Act s.8(9); SDF DPO in India: s.10(2)(a)) ↗ · Sources: meity.gov.in, dlapiperdataprotection.com
Sending data abroad: Allowed by default unless the government restricts a country or conditions by order. Sector rules (e.g. RBI, SEBI) may require localisation. SDFs may face data-localisation directions and cannot send specified traffic data abroad.✓DPDP Act s.16(1)–(2); DPDP Rules r.15, r.13(4) ↗ · Sources: meity.gov.in, meity.gov.in, dlapiperdataprotection.com
Cookies and consent: From 13 May 2027: consent must be free, specific, informed and unambiguous, after a clear notice, and can be withdrawn as easily as given. Verifiable parental consent is needed for under-18s; no tracking or targeted ads aimed at children.✓DPDP Act ss.5, 6(1), 6(4), 9(1), 9(3), 2(f); DPDP Rules rr.3, 10 ↗ · Sources: meity.gov.in, meity.gov.in, dlapiperdataprotection.com
Maximum penalty: Up to INR 250 crore per breach for failing to keep reasonable security safeguards; up to INR 200 crore for breach-notice or children's data failures; up to INR 150 crore for breaching SDF duties; up to INR 50 crore for other violations.✓DPDP Act s.33 & Schedule items 1–4, 7 ↗ · Sources: meity.gov.in, amlegals.com, static.pib.gov.in

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

From 13 May 2027: give a clear, itemised privacy notice and get valid consent, or rely on a listed legitimate use
From 13 May 2027: get verifiable parental consent before processing data of anyone under 18
From 13 May 2027: put reasonable security safeguards in place and bind processors by contract
From 13 May 2027: report breaches to the Board without delay, file a full report within 72 hours, and notify affected people (now: cyber incidents to CERT-In within 6 hours)
From 13 May 2027: handle access, correction and erasure requests, and resolve grievances within 90 days
From 13 May 2027: delete data once its purpose ends; large e-commerce, social and gaming platforms delete after 3 years of inactivity
From 13 May 2027: publish a contact person for data queries; if designated an SDF, appoint an India-based DPO and run annual DPIAs and audits

Recent changes

Rules notified 13 Nov 2025 with an 18-month phase-in to 13 May 2027. In Jan-Feb 2026 MeitY consulted on shortening this to 12 months; no amendment notified as of Oct 2026. Data Protection Board appointments: not yet confirmed from the Gazette.

Sources

Sources used for the independent check (10)

= confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.