Resources · DPDP Updates
Know what changed. Decide what to do next.
Regulatory developments, deadlines, and enforcement signals translated into clear actions for Indian businesses.
Regulatory timeline
From Puttaswamy to full enforcement
24 Aug 2017
Supreme Court recognises privacy as a fundamental right
In Justice K.S. Puttaswamy v. Union of India, a nine-judge bench held that privacy is protected under Article 21 of the Constitution. The judgment called for a data protection framework and set the constitutional foundation for the DPDP Act.
What to do
- Treat privacy as a rights issue, not only an IT control
- Use necessity and proportionality when deciding what data to collect
Source: Supreme Court of India judgment
28 Apr 2022
CERT-In directions: report cyber incidents within 6 hours
CERT-In issued directions under Section 70B of the IT Act requiring service providers, intermediaries, data centres and government bodies to report specified cyber incidents within 6 hours of noticing them, keep ICT logs for 180 days within India, and synchronise clocks with NTP sources. These duties continue alongside the DPDP Act.
What to do
- Run one combined incident playbook for CERT-In and DPDP reporting
- Confirm logs are retained for 180 days
- Name a point of contact for CERT-In
11 Aug 2023
Digital Personal Data Protection Act, 2023 enacted
Parliament passed the DPDP Act, which received Presidential assent on 11 August 2023. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. It introduces consent-based processing, 'legitimate uses', rights for Data Principals, special protections for children, and penalties of up to ₹250 crore per instance.
What to do
- Build an inventory of the personal data you hold
- Identify which processing relies on consent and which on legitimate uses
Source: DPDP Act, 2023 (MeitY)
3 Jan 2025
Draft DPDP Rules released for public consultation
MeitY published the draft Digital Personal Data Protection Rules, 2025 and invited public comments. The draft described notice content, consent managers, breach intimation, verifiable parental consent for children, data retention for large platforms, and the functioning of the Data Protection Board.
What to do
- Compare your privacy notices against the draft requirements
- Start planning verifiable parental consent if you serve children
Source: PIB release on draft rules
13–14 Nov 2025
Final DPDP Rules, 2025 notified with phased commencement
The Government notified the final DPDP Rules, 2025. Provisions setting up the Data Protection Board took effect straight away. Registration of Consent Managers starts after 12 months. Most operational duties for Data Fiduciaries, including notice, security safeguards, breach intimation, children's data and Data Principal rights, start 18 months after notification.
What to do
- Set your compliance deadline for around May 2027
- Plan consent-manager integration for around November 2026
- Budget for remediation now, not in the last quarter
Source: PIB: DPDP Rules notified · MeitY DPDP resources
~Nov 2026
Consent Manager registration opens
Consent Managers are registered entities that let individuals give, manage, review and withdraw consent through an interoperable platform. Under the Rules they must be companies incorporated in India and meet net-worth, technical and conflict-of-interest conditions set out in the Rules.
What to do
- Decide whether your consent flows should support Consent Managers
- Make sure withdrawal is as easy as giving consent
Source: PIB: DPDP Rules notified
~May 2027
Core Data Fiduciary obligations become enforceable
From this point, organisations must give itemised notices, apply reasonable security safeguards, tell the Board and affected individuals about personal data breaches without delay (with a detailed report to the Board within 72 hours), honour access, correction and erasure requests, and obtain verifiable parental consent before processing children's data. Significant Data Fiduciaries carry extra duties such as a DPO based in India, annual DPIAs and audits.
What to do
- Test your breach-notification process end to end
- Publish a grievance contact and response timelines
- Delete data once its purpose ends
Source: DPDP Rules, 2025 (PIB)
Penalties under the Schedule
What non-compliance can cost
Up to ₹250 crore
Failing to take reasonable security safeguards to prevent a personal data breach
Up to ₹200 crore
Failing to notify the Board or affected individuals of a breach
Up to ₹200 crore
Breaching additional obligations for children's data
Up to ₹150 crore
Breaching additional obligations of Significant Data Fiduciaries
Up to ₹10,000
Data Principals breaching their own duties, such as filing frivolous complaints
Up to ₹50 crore
Any other breach of the Act or Rules
Amounts are maximums per instance, decided by the Data Protection Board based on factors such as severity, duration and mitigation. General information, not legal advice.
Analysis from our blog
Latest commentary
13 Nov 2026
Data Principal Rights Under the DPDP Act: A Rule 14 Playbook, and What Vodafone's €30,000 Access-Request Fine Teaches Indian SMEs
From 13 May 2027, customer requests to access, correct or erase their data become legal duties under Rule 14, with a 90-day ceiling on grievance responses. Here is how Indian SMEs can build a working rights-request process in time.
12 Nov 2026
DPDP Privacy Notice Under Rule 3: What Europe's 2026 Transparency Sweep Teaches Indian SMEs
From 13 May 2027, every consent request under the DPDP Act needs a standalone, plain-language notice. Here is what Section 5 and Rule 3 require, what Europe's 25-regulator transparency check is testing, and a six-month plan to fix your privacy notices.
10 Nov 2026
DPDP Compliance Deadline: What Starts on 13 November 2026, and a Six-Month Plan to May 2027
The DPDP Rules turn one this week, but only Rule 4 on Consent Managers switches on. Here is what changes, where the Data Protection Board and court cases stand, and a month-by-month plan for SMEs before 13 May 2027.
30 Oct 2026
Location Data and the DPDP Act: What Google's €403m Fine Teaches Indian Apps
Ireland fined Google €403 million over how it explained, justified and retained location data. Here is how the same failures look under India's DPDP Act, plus a 30-minute audit for apps that use location.
30 Oct 2026
DPDP Act Mobile App Consent: What Fnac's €7m Tracker Fine Teaches Indian App Builders
France's CNIL fined Fnac €7 million on 22 October 2026 for an in-app tracker users never agreed to. Here is how Indian apps can audit their SDKs and fix consent under the DPDP Act before May 2027.
30 Oct 2026
Data Retention Policy Under the DPDP Act: What Free Mobile's €27m Fine Teaches Indian SMEs
France fined Free Mobile €27 million partly for keeping former subscribers' data too long. Here is what Section 8(7) and Rule 8 of India's DPDP framework require, and how to build a retention schedule before May 2027.
27 Oct 2026
DPDP Act Penalties: How the Board Will Set Fines, and What Europe's New Fining Guidelines Reveal
₹250 crore is a ceiling, not a price tag. We compare Section 33 of the DPDP Act with the EDPB's new GDPR fining guidelines to show Indian SMEs what actually lowers penalty exposure.
27 Oct 2026
DPDP Act Penalties Beyond ₹250 Crore: How Section 33 Decides the Real Amount, and What Europe's New Fining Guidelines Signal
The ₹250 crore cap grabs headlines, but Section 33 of the DPDP Act sets seven factors that decide any actual penalty. Read alongside the EDPB's new GDPR fining guidelines, here is how Indian SMEs can build mitigation evidence before May 2027.
24 Oct 2026
DPDP Breach Notification: A Rule 7 Playbook for the 72-Hour Clock
Rule 7 of the DPDP Rules, 2025 sets two notification tracks after a data breach. Here is what each requires and a six-step playbook Indian SMEs can build before May 2027.
17 Oct 2026
The Data Protection Board of India Has No Members Yet: What Indian SMEs Should Do Before May 2027
The Data Protection Board of India exists in law but, per August 2026 reporting, has no Chairperson or Members. Here is what that means for enforcement and how Indian SMEs should use the gap.
12 Oct 2026
DPDP Act Security Safeguards: A Rule 6 Checklist for Indian SMEs, Drawn From 2026 Breach Fines
Rule 6 of the DPDP Rules, 2025 sets the minimum security safeguards for every Data Fiduciary. Here is what it requires, what 2026 European fines say about regulator priorities, and a seven-step checklist.
10 Oct 2026
DPDP Removal of Difficulties Order 2026: What Changed for Guardian Consent and Data Audits
MeitY's 7 October 2026 order tweaks two lines of the DPDP Act. Here's why Indian SMEs serving persons with disabilities, and any company that could become a Significant Data Fiduciary, should act on it now.
1 Oct 2026
Employee Data Under the DPDP Act: What Amazon's €32m Monitoring Fine Teaches Indian Employers
The DPDP Act lets employers process employee data without consent for employment purposes. That is not a licence for unlimited monitoring, as a €32 million French fine over warehouse scanners shows.
1 Oct 2026
Consent Managers Under the DPDP Act Go Live in November 2026: What Indian SMEs Need to Do
Rule 4 of the DPDP Rules, 2025 brings registered Consent Managers into force in mid-November 2026. Here is what changes for ordinary businesses when customers start giving and withdrawing consent through a third party.
30 Sept 2026
Children's Data Under the DPDP Act: What TikTok's £12.7m UK Fine Means for Indian Businesses
TikTok has dropped its appeal and accepted a £12.7m UK fine for mishandling children's data. Here is what Indian SMEs and startups should take from it before the DPDP Act's children's data rules bite in May 2027.
28 Sept 2026
Right to Erasure Under the DPDP Act: What a €300,000 Fine Over Job Applicants' Data Teaches Indian SMEs
France's CNIL fined IT consultancy EXTIA €300,000 for ignoring erasure requests from job candidates. Here is how Indian SMEs can build a DPDP-ready erasure process for HR and recruitment data before May 2027.
27 Sept 2026
The DPDP Act Supreme Court Challenge: Why Indian SMEs Shouldn't Pause Compliance
A Constitution Bench will decide challenges to the DPDP Act's RTI amendment, but there is no stay. Here is what the case covers, where it stands in September 2026, and why your May 2027 deadline has not moved.
25 Sept 2026
Data Processing Agreements Under the DPDP Act: Fixing Vendor Contracts Before May 2027
Under Section 8 of the DPDP Act, your business stays responsible for what your vendors do with personal data. Here is what a DPDP data processing agreement should cover, and a four-week plan to get your vendor contracts in order.
24 Sept 2026
Why VCs Are Now Asking About DPDP Compliance Before They Sign the Term Sheet
Indian venture investors have started treating DPDP readiness as a funding gate, not a legal footnote. Here is what founders should fix before their next round.
23 Sept 2026
The EU AI Act Deadline Just Moved to 2027 — Here's Why Indian AI Companies Shouldn't Relax
The EU's high-risk AI obligations were pushed from August 2026 to December 2027 under the new Digital Omnibus. Here's what actually changed, what didn't, and why Indian AI and SaaS companies still need to move on both EU AI Act readiness and DPDP compliance.
20 Sept 2026
The DPDP Act's Quiet Deadline: What Changes on 14 November 2026 for Indian SMEs
14 November 2026 marks one year since the DPDP Rules were notified, and it is when the Data Protection Board is expected to shift from awareness-building to active supervision. Here is what actually changes, what doesn't, and how Indian SMEs should use the eight weeks that are left.
19 Sept 2026
Are You a Significant Data Fiduciary Under the DPDP Act? How Indian Companies Can Tell Before the Government Decides
The DPDP Act's toughest duties fall on Significant Data Fiduciaries, a category defined loosely enough that a fast-growing Indian startup could land inside it without picturing itself as a data giant. Here's how to tell where you stand before the government decides.
19 Sept 2026
The DPDP Act's One-Time Notice: What Indian SMEs Must Do About the Data They Already Hold
The DPDP Act's one-time notice under Section 5(2) applies to data you collected before the law took effect. Here's what Indian SMEs must tell existing users, and how to handle the withdrawals that follow.
18 Sept 2026
'Too Small to Be Fined' Is Over: What GDPR's 2026 Enforcement Wave Means for Indian SMEs Under DPDP
A EUR 825 million GDPR fine against Uber in August 2026 is the latest sign that privacy regulators no longer spare smaller companies. Here is what that enforcement trend means for Indian SMEs preparing for the DPDP Act's May 2027 deadline.
18 Sept 2026
Do You Need a Data Protection Officer Under the DPDP Act? What Rule 13 Actually Says for Indian SMEs
Most Indian SMEs assume the DPDP Act requires a formal DPO the way GDPR does. It usually does not. Here is the difference between the Section 8(9) contact every business needs and the Rule 13 DPO that only Significant Data Fiduciaries must appoint.
18 Sept 2026
If Your Product Uses AI, the DPDP Act Already Applies: What Indian SMEs Should Check Now
AI and the DPDP Act are now tied together for Indian businesses. Here is what algorithmic due diligence under Rule 13 and the EU AI Act's recalibrated 2026 timeline mean for SMEs and startups building AI features.
10 Sept 2026
Two Clocks, One Breach: Data Breach Reporting in India Under CERT-In and the DPDP Act
A serious incident now triggers two separate breach-reporting duties: CERT-In within six hours and the Data Protection Board within 72. Here's how Indian SMEs build one process that answers to both.
9 Sept 2026
India's Data Protection Board Is Being Assembled: What SMEs Should Fix Before It Starts Hearing Cases
India's Data Protection Board is being staffed in 2026, and the soft-enforcement phase is expected to end around November. Here are the four gaps Indian SMEs should close before the Board starts hearing cases.
20 Jul 2026
The DPDP Privacy Notice: What Rule 3 Actually Requires from Indian SMEs
Your old privacy policy probably will not pass. Rule 3 of the DPDP Rules 2025 demands an itemised, single-purpose notice with easy consent withdrawal. This is how Indian SMEs can build one.
19 Jul 2026
Data Retention Under the DPDP Act: Why 'Keep Everything' Is Now a Liability for Indian SMEs
The DPDP Rules 2025 turn old data from an asset into a risk. Here is how Indian SMEs should think about retention, erasure, and the 48-hour deletion notice.
17 Jul 2026
Reasonable Security Safeguards Under the DPDP Act: The Obligation Indian SMEs Keep Underestimating
Security safeguards carry the DPDP Act's steepest penalty at Rs 250 crore, yet it's the obligation most SMEs overlook. Here's what Section 8(5) and Rule 6 require, and how to prepare before 2027.
16 Jul 2026
Cross-Border Data Transfer Under the DPDP Act: What Indian SMEs on Foreign SaaS Should Check Now
Most Indian SMEs move personal data abroad every day through tools like AWS, Google Workspace and HubSpot. Here is what the DPDP Act's cross-border transfer rules actually require, and the short list of things to sort before May 2027.
13 Jul 2026
Consent Manager or Consent Platform? What Indian SMEs Actually Need Before November 2026
"Do we have to register as a DPDP consent manager?" Almost always, no. Here is the difference between a registered Consent Manager and the consent platform your SME actually needs before the 13 November 2026 deadline.
12 Jul 2026
The DPDP Compliance Clock Has Started: What India's 2026 Deadlines Mean for SMEs
India's DPDP Rules are now in force and the real deadlines land in 2026 and 2027. Here is a plain-English read on the three dates that matter and what a small business should actually do first.
What does an update mean for your business?
Get a practical interpretation for your products, people, and vendors.