DPDP Rules 2025: key rules, timeline and what changes on 13 May 2027
Updated 20 October 2026 · 6 min read
The Digital Personal Data Protection Rules, 2025 put the DPDP Act, 2023 into practice. They say what a notice must contain, how to report a breach, how long to keep records and how to handle rights requests.
The timeline
- November 2025: Rules notified. Provisions setting up the Data Protection Board apply straight away.
- November 2026: the Consent Manager registration rules apply.
- 13 May 2027: the main duties for businesses apply, including notice, consent, security, breach intimation, retention, children's data and rights.
Rule 3: the notice
The notice must stand on its own, separate from other information, and be in clear and plain language. It must give an itemised description of the personal data and the specific purpose for each item, and say what goods, services or uses that processing enables. It must include a link or other way to withdraw consent as easily as it was given, to use the rights in the Act, and to complain to the Board. Read what a DPDP privacy notice must contain.
Rule 6: security safeguards
Reasonable safeguards include encryption, masking or similar measures, access control, logs and monitoring to detect unauthorised access, backups to keep data available, and contracts that make your processors take safeguards too. Logs and related data should be kept for at least one year.
Rule 7: breach intimation
When a personal data breach happens, tell each affected person without delay: what happened, the likely impact, what you are doing about it, what they can do, and who to contact. Tell the Board without delay too, and send a detailed report within 72 hours of becoming aware of the breach.
Rule 8: how long to keep data
Erase personal data once it is no longer needed for its purpose. For certain large e-commerce, online gaming and social media platforms, the Rules set a three-year limit after the person was last active, with a warning at least 48 hours before erasure. Logs of processing are kept for at least one year either way.
Rule 9: a contact for questions
Publish on your website or app the business contact information of a person who can answer questions about how you process personal data, and include it in your replies to people.
Rule 10: children and people with disabilities
Before processing a child's data, take steps to verify that the person giving consent is the child's parent and an identifiable adult. A similar rule applies to lawful guardians of people with disabilities.
Rule 14: rights requests and grievances
Publish how people can make requests for access, correction, completion, updating and erasure, and how to nominate someone. Grievances must be answered within a period you publish, no longer than 90 days.
Getting ready
Most of this lands on one date, so small businesses have until 13 May 2027 to put a notice, consent, a breach plan and a request process in place. The DPDP checklist turns the Rules into a to-do list.
Questions
When were the DPDP Rules notified?
The Digital Personal Data Protection Rules, 2025 were notified in November 2025. They phase in over 18 months, with the main duties for businesses applying from 13 May 2027.
How quickly must a breach be reported under the DPDP Rules?
Rule 7 asks you to tell affected people and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer.
How long must logs be kept under the DPDP Rules?
The Rules ask Data Fiduciaries to keep the personal data, traffic data and logs connected to processing for at least one year, so that breaches can be detected and investigated.