DPDP Act and DPDP Rules 2025: Timeline and Key Duties
Understand the phased DPDP timeline, the core duties of a Data Fiduciary and the CERT-In rules that already apply today.
The DPDP timeline to plan around
The DPDP Act was passed in 2023, but most of its duties only start once the DPDP Rules bring them into force. The Rules were published in the Gazette on 13 November 2025, and they use a phased approach. The Data Protection Board provisions started immediately, the consent manager framework starts later, and the core obligations that affect every product team start eighteen months after publication. Use the dates below as fixed planning milestones.
- 13 November 2025: DPDP Rules 2025 published; Data Protection Board and commencement provisions in force.
- January 2026: MeitY consults on cutting the 18-month window to 12 months for some entities. This is a proposal only, and no amendment has been verified as notified.
- 13 November 2026: consent manager registration framework under Rule 4 comes into force.
- 13 May 2027: core obligations in force, covering notice, consent, security, breach reporting, children, rights, Significant Data Fiduciary duties and transfers. Section 43A of the IT Act is repealed on this date.
Core duties of a Data Fiduciary
From 13 May 2027 every Data Fiduciary must give a clear notice and collect valid consent, or rely on another ground the Act allows. It must protect data with reasonable security safeguards under Section 8(5) and Rule 6, report personal data breaches under Rule 7, and erase data once the purpose is served or consent is withdrawn under Section 8(7). Rule 8 adds a 48-hour notice before erasure where it applies and a minimum one-year retention of logs and related data.
The fiduciary must publish the business contact details of a Data Protection Officer, or of a person who can answer questions about processing, prominently on its website or app under Rule 9. It must run a grievance mechanism that resolves complaints within a reasonable period not exceeding 90 days under Rule 14. It may use processors only under a valid contract. Large e-commerce, social media and online gaming platforms also face a three-year limit tied to user inactivity under Rule 8.
Significant Data Fiduciaries
The Central Government can designate some fiduciaries as Significant Data Fiduciaries. These businesses carry extra duties under Section 10 and Rule 13. They must appoint a Data Protection Officer based in India, carry out an annual data protection impact assessment and an independent data audit, and check that any algorithmic software they deploy does not create risks to the rights of Data Principals. Rule 13 may also require them to keep specified data in India.
If you build for large banks, insurers, platforms or health networks, your client may be designated, and its due diligence will flow down to you as a vendor. Expect questions about model behaviour, audit trails and where data is stored. Preparing evidence early, such as test results for automated decisions, a clear hosting map and a list of every vendor that touches the client's data, makes those reviews shorter and less stressful for everyone involved.
CERT-In Directions already apply
While the DPDP duties phase in, the CERT-In Directions issued on 28 April 2022 under Section 70B(6) of the IT Act have been in force since 28 June 2022. They require reportable cyber incidents to be reported to CERT-In within 6 hours of noticing them. They also require logs of all ICT systems to be enabled and kept for a rolling 180 days within India, and system clocks to be synchronised with NIC or NPL time servers, or sources traceable to them. Non-compliance is punishable under Section 70B(7).
For engineering teams this means three concrete tasks today: route logs to storage in India with at least 180 days of retention, configure NTP on every server and container host to an approved source, and name a CERT-In point of contact in your incident plan. These tasks do not wait for 2027, and they support the DPDP security and breach duties when those arrive.
Penalties and a practical plan
DPDP penalties are set per instance. Failure to keep reasonable security safeguards can attract up to INR 250 crore, breach notification or children's data failures up to INR 200 crore, Significant Data Fiduciary failures up to INR 150 crore and other breaches up to INR 50 crore. A sensible plan works backwards from 13 May 2027: finish a data map first, then notices and consent flows, then deletion and retention jobs, and finally breach drills. Keep watching for any MeitY amendment that shortens the window. General information, not legal advice.
- DPDP Rules were published on 13 November 2025 and core duties start on 13 May 2027.
- Consent manager registration starts on 13 November 2026.
- Significant Data Fiduciaries need an India-based DPO, an annual DPIA and an independent audit.
- CERT-In 6-hour reporting, 180-day logs in India and NTP sync apply now.
- The proposal to shorten the timeline is a consultation, not a notified rule.
Build a one-page timeline for your product from today to 13 May 2027. Mark the CERT-In items you must already meet, then place each DPDP duty in a quarter with an owner. Add a review point to check for any MeitY amendment to the dates.
Check your understanding
1. When do the core DPDP obligations such as notice, consent and breach reporting come into force?
2. How long must ICT system logs be kept under the CERT-In Directions?
3. Which duty applies specifically to Significant Data Fiduciaries?
From USD 49 or INR 2,999 a month. A person approves every step.