What actually happened, and when
For two years India had a data protection Act with no rules under it. That is a genuinely reasonable thing to have filed under “coming eventually”, and most owner-led businesses did. The Digital Personal Data Protection Act was passed as Act 22 of 2023, dated 11 August 2023, and then very little visible happened.
That ended on 13 November 2025, when the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 by gazette notification G.S.R. 846(E). The rules exist, they have a number, and you can look the number up yourself.
The thing almost everybody gets wrong is what comes next. Rule 1(2) does not name dates. It names periods, measured from publication, and they land in three tranches:
Commencement, definitions, and the constitution and procedure of the Data Protection Board of India.
The Consent Manager framework: registration, obligations, and the register the Board keeps.
Notice, consent, security safeguards, breach reporting, erasure, children’s data, and how a person exercises their rights.
So the single 2027 date most people are holding is the lastof three, not the only one, and the first has already gone. The practical position now is that the substantive obligations — notice, consent, security, breach reporting, erasure — commence on 13 or 14 May 2027, and the Consent Manager framework a full six months before that, on 13 or 14 November 2026.
Who it reaches, and who thinks it does not
The Act attaches duties to the data fiduciary: the person who determines the purpose and the means of processing personal data. That is a functional test, not a size test. If you decide why customer data is collected and how, you are the fiduciary, whether you are eleven people or eleven hundred.
Four beliefs do most of the damage here, and all four are worth saying out loud because they are held by capable people:
- “We are too small.” The Act does allow the Central Government to notify exemptions for certain classes of fiduciary. Whether any of them reaches you is a question for counsel, and it is not one this page answers. Planning on the assumption that one will is a bet, and it should be taken knowingly rather than by default.
- “We do not hold sensitive data.” The Act does not work on a sensitivity tier. It works on personal data: data about an identifiable individual. A phone number and a delivery address are squarely in.
- “Our vendor handles it.”A processor acts on your instructions. The duties stay with you, and Rule 6(1) requires the contract with that processor to carry the safeguards through. A vendor’s compliance page is not your position.
- “We have a privacy policy.”A policy copied from another site describes somebody else’s processing. That is worse than having none, because it is a written record of a promise you are not keeping. We have written about the cookie-banner version of exactly this mistake in our case studies.
There is one more that is not a belief but a genuine surprise, and it reaches everybody: the CERT-In Directions already applied to you before the DPDP Rules existed, and they carry no size exemption at all. More on that below.
What the Rules actually require
This is the part worth reading properly, because the Rules are more specific than the commentary around them suggests. Where the Act says “reasonable”, the Rules frequently enumerate. Enumeration is good news: it turns an argument about judgement into a list you can work down.
The notice given to a person must be in clear plain language and must itemise the categories of personal data collected and the specific purposes, together with the goods, services or functions that depend on that processing. It must be presented independently of other information, so it cannot be a clause inside terms and conditions, and it must carry a link and a plain explanation of how to withdraw consent, raise a grievance and complain to the Board.
A Consent Manager is a registered entity through which a person can give, manage, review and withdraw consent, and the Board keeps the register. This is the tranche that commences one year after publication rather than eighteen.
Reasonable security safeguards are spelled out: encryption, obfuscation, masking or virtual tokens; access control over the computer resources used; logs and monitoring sufficient to detect unauthorised access; contractual terms binding any processor; and reasonable measures for continued processing if confidentiality, integrity or availability is compromised, such as by data backups. Logs and personal data are to be retained for one year unless another law requires otherwise.
On becoming aware of a personal data breach, the data fiduciary intimates each affected person without delay, and gives the Board a detailed report within 72 hours, or such longer period as the Board allows. The report covers the facts and causes, the mitigation taken, findings on who was responsible, and what has been done to prevent recurrence.
Before processing a child’s personal data, verifiable consent of a parent or lawful guardian is required, and the Act treats everyone under eighteen as a child. Verifiable means the fiduciary takes reasonable steps to confirm that the consenting adult is an adult and is in fact the parent or guardian; reliance on details already verified on the platform, or on voluntarily provided identity credentials, is contemplated.
For e-commerce and social media entities above two crore registered users, and online gaming intermediaries above fifty lakh, personal data is treated as no longer needed three years after the person’s last interaction or the commencement of the rules, whichever is later, with notice to the person before erasure. Below those thresholds the general rule applies instead: keep it while the purpose lasts, then erase it.
The two clocks nobody has diarised
This is the single most useful thing on this page, and it is almost never in the summaries. A bad morning starts two separate reporting clocks, to two different bodies, under two different instruments, and the shorter one is not the one people know about.
The CERT-In Directions carry no size exemption: they reach companies, startups and MSMEs operating in India alike. The six hours runs from becoming aware of a qualifying incident, not from the incident.
The CERT-In Directions also require logs of ICT systems to be enabled and kept for 180 days, kept within Indian jurisdiction, which sits alongside — and is shorter than — the one-year log retention Rule 6(1) attaches to personal data. If you keep logs for thirty days because that was the default on the plan you signed up for, that is a live gap under an instrument that has been in force since June 2022.
What it can cost, stated honestly
The Schedule to the Act fixes a ceiling for each category of default. These numbers get quoted a great deal and almost always without the sentence that makes them meaningful, so here is the sentence first: These are ceilings per category of default in the Schedule to the Act, not a tariff and not a prediction. The Data Protection Board sets any actual figure case by case, on the facts.
We are not going to build a scare campaign on top of those figures, for two reasons. The first is that we cannot tell you your exposure, because exposure depends on facts about your business that a web page does not have. The second is more practical: for most owner-led businesses the penalty is not the expensive part.
Where this goes wrong, in engineering terms
We build systems for a living, so what follows is not a legal reading. It is the pattern of what breaks when a business that grew normally meets these obligations for the first time.
- Nobody can list where the data is.Not out of carelessness — because it accumulated. The CRM, the spreadsheet the ops lead maintains, the WhatsApp exports, the analytics tool, the courier’s portal, the trial account somebody opened in 2024. Every other obligation is downstream of an inventory, and the inventory is the work nobody budgets for.
- Deletion was never a feature.Most systems are built to accumulate. A user row is referenced by orders, invoices, logs, a warehouse, three vendors and a backup. “Delete this person” turns out to mean a schema conversation, and it is much cheaper before the request arrives than after.
- Consent was collected once and never modelled. A checkbox at signup is an event. What Rule 3 and the withdrawal requirement need is state: what this person agreed to, for what purpose, when, and whether it is still true. Those are different data structures and only one of them can answer a question.
- The notice describes a different company. Because it was copied. It names cookies you do not set and a jurisdiction you do not operate in, while omitting the WhatsApp number where most of your customer data actually arrives.
- Logs are shorter than the law expects. Thirty days, because that was the plan default. Rule 6(1) attaches one year to logs and personal data; the CERT-In Directions attach 180 days, kept within Indian jurisdiction.
- Nobody owns it. Which is why all five of the above stay true for another quarter. This is the real root cause and it is the cheapest one to fix.
None of these is a compliance problem in the sense of paperwork. They are all system-design problems, which is why we think an engineering studio has something honest to say here and why the fix is a build rather than a document.
Check where you stand, right now
Twelve questions, in the browser, nothing submitted. It reports what is in place, what is partly in place, and what is not, with the next step for each gap. It deliberately cannot tell you whether you are compliant — a questionnaire is not capable of establishing that, and a tool that claimed to would be lying to you on the subject it is supposed to be teaching.
Where does your data handling actually stand?
Twelve questions, about two minutes. It reports what is in place, what is partly in place and what is not, and gives you the next step for each gap. It does not tell you whether you are compliant, because that is not a thing a questionnaire can establish.
Question 1 of 12
The checklist, yours to keep
The same ground as the check, laid out as a working document you can print, mark up and hand to whoever ends up owning this. It is organised the way we would actually do the work: locate, then describe, then make the rights executable, then secure, then rehearse the bad day.
34 items across 5 stages, with what "done" looks like for each. One page, printable, no email required.
There is no form in front of it and no address to give us. If it is useful, use it.
What we do, if you want help
We are an engineering studio, not a law firm and not an audit practice. What we are useful for is the part of this that is a system rather than a document: finding where personal data actually lives, tracing whether a person can be removed from all of it, and closing the gaps that turn out to be code.
The DPDP Readiness Sprint is three weeks and produces four things:
- A data map. Every system holding personal data, what it holds, why, who can reach it, and how long it stays.
- A deletion trace. One real record followed through every system, with the places it survives written down. This is usually the finding that changes the plan.
- A gap list, ranked by what it costs to close.Not by severity theatre — by engineering effort, so you can decide what to do now and what to schedule.
- Evidence your counsel can work from. We do not give the legal opinion. We hand your lawyer or company secretary the factual base they would otherwise ask you to produce.
The price
Published, fixed, and the same for everybody. Indian rupees only, because this is Indian law and the offer is scoped to it.
Three weeks. The data map, the deletion trace, the ranked gap list, and the evidence pack for your counsel.
Six weeks. The sprint, plus closing the gap list in your production systems rather than handing you the list.
Optional, afterwards. Monitoring that the position you reached does not quietly decay as the product changes.
The Readiness Sprint, for the first five clients, in exchange for logo and case-study rights.
A real concession against the sprint price, and it is limited to five because the point is the case studies rather than the discount.
If you would rather just talk first, the diagnostic call is free and there is no pitch on it. Tell us what you are dealing with, or get in touch.
Where to read more
Primary sources are listed at the bottom of this page and we would genuinely rather you read those than us. Alongside them:
- Our research series— long-form, cited, and it labels every number as measured, assumed or unknown. The paper on the three commencement stages lives there.
- The AI readiness check — the same discipline applied to whether you are ready to spend on AI at all.
- Continuity readiness — Rule 6(1) names backups and continued processing as a security safeguard, so the two topics overlap more than they look like they should.
- Our FAQ and terms— including who owns the work we do for you, stated plainly.
Sources
Everything factual on this page traces to one of these. Where a link is absent it is because we did not have a stable public one to give, not because the source is vague — the reference number is there so you can look the instrument up yourself.
- The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) · Parliament of India · 11 August 2023
- The Digital Personal Data Protection Rules, 2025 · Ministry of Electronics and Information Technology · 13 November 2025 · G.S.R. 846(E)
- Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents · Indian Computer Emergency Response Team (CERT-In) · 28 April 2022, effective 27 June 2022