By Naraway
In this article
India's data protection law was passed in August 2023. Its rules arrived in November 2025, with a deliberate delay built in: the Data Protection Board started at once, and most duties for businesses switch on 18 months later. The clock runs out around May 2027.
| Date | What applies |
|---|---|
| August 2023 | Digital Personal Data Protection Act passed |
| November 2025 | DPDP Rules notified; Data Protection Board set up |
| Around November 2026 | Consent managers can register |
| Around May 2027 | Notice, consent, security, breach, children's data, retention and cross-border rules in force |
Sources: Storyboard18; KPMG; BDO India. Dates for later phases count 18 months from notification.
Who the Act Covers
The Act applies to any organisation that processes digital personal data in India. It also reaches organisations outside India when the processing is connected with offering goods or services to people in India, so an app, store or SaaS product based abroad is covered once it serves Indian users. Organisations deciding why and how data is processed are "data fiduciaries"; the government can designate larger ones as "significant data fiduciaries" with extra duties.
The Obligations With Numbers Attached
Sources: KPMG; PwC; The Week.
- Notice and consent. A clear notice listing the data and purpose, with consent that can be withdrawn as easily as it was given.
- Breach response. Inform the Board and each affected person within 72 hours of becoming aware.
- Retention. Keep personal data and associated logs for at least one year from processing; large platforms erase data of users inactive for three years, after advance notice.
- Children. Verifiable parental consent before processing data of anyone under 18; no tracking or targeted advertising directed at children.
- Significant data fiduciaries. Annual data protection impact assessment and audit, reported to the Board.
How It Compares With GDPR
| India DPDP | EU GDPR | |
|---|---|---|
| Breach notice | 72 hours, to Board and individuals | 72 hours to authority; individuals when high risk |
| Child | Under 18 | Under 16 (states may lower to 13) |
| Maximum fine | Rs 250 crore per breach | EUR 20 million or 4% of global turnover |
| Cross-border transfer | Allowed unless a country is restricted | Adequacy or safeguards required |
A product built for GDPR covers part of the work. The age threshold, the duty to tell every affected person about every breach, and India's consent formats are where most GDPR-ready products still need changes.
Part of Naraway's research series India Market Entry in 2026.
In short
The Digital Personal Data Protection Act, 2023 applies to processing of digital personal data in India, and to processing outside India connected with offering goods or services to people in India. The DPDP Rules, 2025, notified in November 2025, set up the Data Protection Board immediately and bring most duties into force 18 months later, around May 2027. Key obligations include notifying personal data breaches to the Board and affected people within 72 hours, keeping personal data and logs for at least one year, verifiable parental consent for anyone under 18, and annual impact assessments and audits for significant data fiduciaries. Penalties reach Rs 250 crore per breach.
- Rules notified November 2025; Data Protection Board operational immediately.
- Most obligations apply 18 months after notification, around May 2027.
- Breach notice to the Board and affected individuals within 72 hours.
- Minimum one-year retention of personal data and related logs.
- Anyone under 18 is a child: verifiable parental consent required.
Sources
- DPDP Rules 2025: guidance to DPDP Act implementation, KPMG India
- Digital Personal Data Protection Rules, 2025, PwC India
- Govt notifies final DPDP Rules; sets staggered rollout, Storyboard18
- India's DPDP Rules 2025: a deep dive, The Week
- Digital Personal Data Protection Rules 2025: provisions, implementation plan, penalties, BDO India
Frequently Asked Questions
Who does the DPDP Act apply to?
Anyone processing digital personal data in India, and anyone outside India processing personal data in connection with offering goods or services to people in India.
When do the DPDP Rules come into effect?
The Rules were notified in November 2025. The Data Protection Board provisions applied immediately; most obligations come into force 18 months after notification, around May 2027.
How quickly must a data breach be reported under DPDP?
Within 72 hours of becoming aware, to the Data Protection Board and the affected individuals, unless the Board allows longer.
What is the maximum penalty under the DPDP Act?
Up to Rs 250 crore per breach, set by the Data Protection Board depending on the nature of the breach.
Who is a child under the DPDP Act?
Anyone under 18. Processing a child's personal data requires verifiable consent from a parent, with limited exemptions for categories such as healthcare and educational institutions.
