DPDP Rules 2025: what starts when (and what to do before 13 May 2027)

Sehmat team · 18 October 2026

The Digital Personal Data Protection Rules, 2025 were published in the Gazette on 13 November 2025, and they start in three phases. The rules on the Data Protection Board started that day. The rule on registering Consent Managers starts on 13 November 2026. Most duties for organisations that handle personal data start on 13 May 2027: notice, security, breach reporting, children’s data, rights and grievances.

That leaves about seven months. It is enough time to do this well if you start with your notices and consent records now.

Key points

The Rules are G.S.R. 846(E), dated 13 November 2025. Rule 1 sets out three start dates.
Rules 1, 2 and 17 to 21 (definitions and the Board) applied from the date of publication (Rule 1(2)).
Rule 4 (Consent Manager registration) applies “one year after” publication, so from 13 November 2026 (Rule 1(3)).
Rules 3, 5 to 16, 22 and 23 apply “eighteen months after” publication, so from 13 May 2027 (Rule 1(4)).
In January 2026 the government consulted on shortening this timeline. As of October 2026 no change has been notified.

Which rules start on which date?

Date	Rules that start	What they cover
13 Nov 2025	Rules 1, 2, 17 to 21	Title, definitions, and the Data Protection Board: appointments, service terms, meetings, working as a digital office, staff
13 Nov 2026	Rule 4	Registration and duties of Consent Managers
13 May 2027	Rules 3, 5 to 16, 22, 23	Notice, security, breach intimation, retention, contact details, children, persons with disability, Significant Data Fiduciaries, rights, transfers, research exemption, appeals, information requests

Some advisers count the dates from 14 November 2025, when the press material came out. The Gazette notification itself is dated 13 November 2025, so we use the 13th.

What changes on 13 November 2026?

Rule 4 lets a company apply to the Data Protection Board to register as a Consent Manager. The First Schedule sets the conditions. They include being a company incorporated in India and having a net worth of at least ₹2 crore.

Under the Act, a Consent Manager is a registered “single point of contact” that lets a person give, manage, review and withdraw consent (s.2(g)). People may use one (s.6(7)). It does not take over your duties as a Data Fiduciary. Most organisations will not register as Consent Managers. They still need their own notices, consent records and withdrawal routes.

What changes on 13 May 2027?

This is the main date for most organisations. From then:

Notice (Rule 3). The notice must stand on its own and use clear, plain language. It must list the personal data item by item, state each purpose, and give a link to withdraw consent, use rights and complain to the Board.
Security (Rule 6). Reasonable safeguards such as encryption or masking, access control, logs and backups. Logs are kept for one year.
Breach (Rule 7). Tell affected people without delay. Tell the Board without delay, then send a detailed report within 72 hours.
Retention (Rule 8). Erase data when the purpose is served, unless a law requires you to keep it. Some large platforms have fixed periods and must warn users 48 hours before erasure.
Contact (Rule 9). Publish a contact person who can answer questions about processing.
Children and guardians (Rules 10 to 12). Verifiable consent from a parent or lawful guardian, with exemptions in the Fourth Schedule.
Significant Data Fiduciaries (Rule 13). A Data Protection Impact Assessment and an audit every 12 months.
Rights (Rule 14). Publish how to make a request. Answer grievances within a period of no more than 90 days. Let people nominate someone.

Could the dates change?

Possibly. In January 2026 the government consulted on shortening the 18-month window, especially for Significant Data Fiduciaries. As of October 2026 no amendment has been notified, so the Gazette dates still stand. The safe plan is to aim for 13 May 2027 and not assume extra time. If the window is shortened, you will be ready sooner.

What should you do before 13 May 2027?

Now to December 2026: know your data

List every place you collect personal data: website, app, call centre, field forms, paper registers and events.
For each one, note the data items and the purpose. Rule 3 needs an itemised list.
Mark which processing relies on consent and which relies on a “legitimate use” under s.7.
Find any data about children or people who have a lawful guardian.

Rewrite notices in plain language, so each one makes sense on its own.
Offer the notice in English or any of the 22 Eighth Schedule languages (s.5(3), s.6(3)).
Make withdrawal as easy as giving consent (s.6(4)).
Plan a notice for people who consented before the Act started (s.5(2)).
Keep proof. If a dispute arises, you must show that notice was given and consent was received (s.6(10)).

April to May 2027: test the response side

Write a breach plan and run a practice drill against the 72-hour clock.
Set up rights requests and publish your contact person (Rule 9). Track grievances against the 90-day limit (Rule 14(3)).
Set a retention period for each purpose (s.8(7)).
Check that your contracts with vendors include security terms (Rule 6(1)(f)).

How Sehmat helps

Each notice is versioned at publish. Each consent is stored with the exact notice version and language shown, plus a proof PDF with an integrity code.
Consent forms work in English and the 22 Eighth Schedule languages.
Withdrawal takes effect at once, for one purpose or all. Your other systems are told by signed webhook.
Breach tracking follows the 72-hour Board clock and flags reports that are overdue.
Access, correction, erasure and grievance requests come through one “My request” page with a request number.

Sources

This article is general information, not legal advice.