DPDP Rules 2025: the key dates, the penalties, and what you must prove

The DPDP Act became law in August 2023. It needed Rules to say how it works in practice. Those Rules were notified on 13 November 2025, and they switch on in three stages.

The three dates

The penalties

Penalties are set per breach, by type. Pick one to see the maximum.

Source: Schedule to the Digital Personal Data Protection Act, 2023. The Board decides the actual amount based on how serious the breach was.

What you must be able to prove

The law is about proof as much as behaviour. When the Board asks, you need records, not good intentions:

• Consent: who agreed, to what, and when. And when they withdrew.
• Security: encryption or masking, access control, and logs of access kept for at least a year.
• Breaches: that you told the Board and affected people, with a detailed report within 72 hours.
• Rights: that requests to see, correct or erase data were handled.
• If you are a Significant Data Fiduciary: a yearly data protection impact assessment and audit.

What to do this quarter

1. Name an owner for DPDP, with a budget.
2. Map where personal data sits. Use our 7-step checklist.
3. Turn on access logs in your main systems, if they are not on already.
4. Write and test your breach plan, with the 72-hour clock in mind.

What changes in each phase

Phase 1 · from 13 November 2025

The Data Protection Board is set up and the rules about how it works apply. For most companies nothing has to change on day one. This is the time to prepare.

Phase 2 · from 13 November 2026

Consent managers can register with the Board. These are platforms that let people give, review and withdraw consent across many companies from one place. Expect people to start using them to manage their consent with you.

Phase 3 · from 13 May 2027

The main duties apply in full: notice, consent, security safeguards, breach reporting, rights requests, children's data and the extra duties of Significant Data Fiduciaries.

Who the law applies to

• Any company that processes digital personal data in India.
• Companies outside India that process personal data to offer goods or services to people in India.
• Personal data collected on paper counts too, once it is digitised.

It does not cover data a person makes public about themselves, or data processed for purely personal or household reasons.

Significant Data Fiduciaries

The government can name some companies as Significant Data Fiduciaries, based on things like the volume and sensitivity of data they process and the risk to people. If you are named, you must also:

• appoint a Data Protection Officer based in India,
• appoint an independent data auditor,
• run a data protection impact assessment and an audit every year,
• check that the algorithms you use do not put people's rights at risk.

Children's data

Under the DPDP Act, a child is anyone under 18. Before processing a child's data you need verifiable consent from a parent. You must not track or monitor children's behaviour, or target ads at them, except in cases the government allows.

The Data Protection Board

The Board works as a digital office. It takes complaints from people, looks into breaches, and decides penalties. Appeals against its decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

How DPDP compares with GDPR

Common misreadings

• "We have until 2027, so nothing to do now." Mapping data and fixing systems takes most companies many months.
• "It only applies to tech companies." It applies to any company handling personal data, including banks, hospitals, manufacturers and retailers.
• "Only big breaches need reporting." Under DPDP, every personal data breach must be reported.

How the Board decides a penalty

The amounts in the Schedule are maximums. The Board decides the actual penalty case by case. The Act tells it to consider:

• how serious the breach was, and how long it lasted,
• the type and nature of the personal data involved,
• whether it happened before,
• whether the company gained from it, or avoided a loss,
• what the company did to limit the harm, and how quickly,
• whether the penalty is proportionate, and its likely effect on the company.

In plain terms: acting quickly, being open and having good records all count in your favour.

What to tell your board this quarter

1. The dates. Full duties from 13 May 2027. Consent managers from 13 November 2026.
2. The exposure. Penalties up to ₹250 crore per breach, decided case by case.
3. The owner. Who is accountable for DPDP, and their budget.
4. The gap. How much personal data we hold that is not yet mapped.
5. The plan. What will be done by when, and how progress will be reported.

Key terms

• Personal data: any data about a person who can be identified from it.
• Personal data breach: any unauthorised processing, sharing, loss or destruction of personal data, accidental or not.
• Verifiable consent: consent from a parent or guardian that you can check is genuine.
• Data protection impact assessment: a review of the risks a type of processing creates for people, and how to reduce them.

Where Samvrik fits

Most of what the Board will ask for is a record: who saw what, who changed what, and who approved it. Samvrik keeps that record inside your own walls. Every access and every approval is logged, so the proof exists before anyone asks for it.

Sources: Digital Personal Data Protection Act, 2023 and its Schedule; Digital Personal Data Protection Rules, 2025 (Gazette notification, 13 Nov 2025). Plain summary, not legal advice.

Common questions