DPDP Act and Rules 2025: what applies to your business, and by when
India’s Digital Personal Data Protection Act, 2023 applies to almost every business that collects personal data of people in India in digital form, including customer, employee and job-applicant data. The DPDP Rules, 2025 were notified on 13 November 2025 and switch on in phases: the Data Protection Board from 13 November 2025, Consent Manager registration from 13 November 2026, and the main duties (notice, consent, security, breach reporting, user rights, children’s data) from 13 May 2027.
Does it apply to a small business?
Yes, if you decide why and how personal data is used. The law calls you a Data Fiduciary. Size does not matter: a clinic, a coaching centre, an online store or a 5-person startup keeping customer phone numbers in a CRM is covered. A paper register that is never scanned is outside it.
Why the 13 May 2027 date matters
Most of the work, such as rewriting consent forms, fixing vendor contracts and building a way to answer user requests, takes months. Working backwards from May 2027, mid-2026 was the sensible time to start. If you have not started, start with a list of what data you collect and why.
Not a copy of Europe’s GDPR
There are only two legal grounds: consent, or a listed “legitimate use” such as complying with a law, a medical emergency or employment purposes. There is no broad “legitimate interests” ground, and no separate “sensitive data” category. Penalties go to the government; the Act does not give individuals a damages claim.
A note on the timeline
In January 2026 the IT Ministry consulted industry on shortening the 18-month window. As of August 2026 no amendment had been notified and 13 May 2027 remained the date for the main duties. Check the latest official notification before you plan around it.
Key facts
| Law | Digital Personal Data Protection Act, 2023 (assented 11 August 2023) |
|---|---|
| Rules | DPDP Rules, 2025, notified 13 November 2025 |
| In force now | Data Protection Board of India (Rules 1, 2, 17–21) |
| 13 November 2026 | Consent Manager registration (Rule 4) |
| 13 May 2027 | Notice, consent, security, breach reporting, rights, children’s data (Rules 3, 5–16, 22, 23) |
| Covers | Personal data collected digitally, or collected on paper and later digitised |
| Highest penalty | Up to ₹250 crore per breach of the security duty |
Steps
- List every type of personal data you collect, why, and who you share it with
- Decide your role for each flow: Data Fiduciary or Data Processor
- Rewrite notices and consent so each purpose is clear and can be withdrawn
- Update vendor contracts so processors report breaches to you quickly
- Set up a grievance contact that can answer requests within 90 days
Questions
Do I need a Data Protection Officer?
Only if the government notifies you as a Significant Data Fiduciary. Every business still needs a contact person who can answer questions about its data use.
Does it cover employee data?
Yes. Employee and applicant data is personal data. Some employment uses fall under “legitimate uses” and do not need consent, but notice and security duties still apply.
Is my old customer data covered?
Yes. Data collected before the Act needs a notice to the people concerned under Section 5(2). Plan this early; it takes time.
Sources
- PIB explainer on the DPDP Rules, 2025 (Nov 2025)
- DPDP Rules, 2025 phased commencement (S.S. Rana & Co.)
- MeitY consultation on a shorter timeline (Chambers, Feb 2026)
- DPDPA General Awareness guide (2026 edition), Dr. Naveen Kumar Sharma (Adv.)
Facts checked against these sources on 8 Oct 2026. Laws change; confirm before acting.
This guide is general information, not legal advice for your situation. Talk to an advocate before acting.
