DPDP Rules 2025: what small businesses and startups must do by May 2027

India's Digital Personal Data Protection Act, 2023 (the DPDP Act) was passed by Parliament on 11 August 2023, but for two years most businesses could not act on it because the operating rules did not exist. That changed when the Ministry of Electronics and Information Technology (MeitY) published the Digital Personal Data Protection Rules, 2025 in the Gazette on 13 November 2025. The rules set out what a consent notice must say, how to report a breach, what "reasonable security safeguards" means and how long you must keep logs.

The core obligations do not apply on day one. They start 18 months after publication, which puts them in May 2027. For a small business, a startup or an agency that builds products for Indian users, that is enough time to fix things calmly, but not enough to ignore the work. This explainer summarises what the Act and Rules require, based on the Gazette text and the Government's explanatory note, and turns it into a practical plan.

This article is general information, not legal advice. For decisions about your business, read the official text linked in the sources and speak to a qualified lawyer.

Who the law applies to, in plain terms

The Act uses a few terms you will see everywhere:

• Data Fiduciary: the business that decides why and how personal data is processed. If you run an online store, a SaaS product or a clinic's booking system, you are a Data Fiduciary for your customers' data.
• Data Principal: the individual the data is about. For a child, this includes the parent or lawful guardian.
• Data Processor: anyone processing data on your behalf, such as your hosting provider, email service, payment gateway or the agency running your CRM.
• Consent Manager: a registered platform through which people can give, manage, review or withdraw consent. Under the Rules, Consent Managers must be companies based in India.
• Significant Data Fiduciary: a business designated by the Government for heavier duties, such as independent audits and impact assessments. Most small businesses will not be in this group.

The Government's note describes seven principles behind the law: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. If you design your product around those seven words, most of the specific rules follow naturally.

The timeline

Date	What applies
11 August 2023	DPDP Act enacted by Parliament.
3 January 2025	Draft Rules published for consultation.
13 November 2025	Final Rules published in the Gazette (G.S.R. 846(E)). Rules 1, 2 and 17 to 21, which deal with the Data Protection Board, come into force immediately.
13 November 2026	Rule 4 (registration and obligations of Consent Managers) comes into force, one year after publication.
13 May 2027	Rules 3, 5 to 16, 22 and 23 come into force, eighteen months after publication. This includes notices, security safeguards, breach reporting, retention, contact details, children's data and rights requests.

The Government's press note dates the notification to 14 November 2025, while the Gazette copy is dated 13 November 2025. The Rules count their periods from the date of publication in the Gazette, so plan against the Gazette date.

What you must do from May 2027

1. Give a clear, stand-alone notice before asking for consent

Rule 3 says the notice must be understandable on its own, without relying on other documents, and in "clear and plain language". At a minimum it must include an itemised description of the personal data, the specific purposes, and a description of the goods or services the processing enables. It must also give a link to your website or app and explain how a person can withdraw consent, with "the ease of doing so being comparable to that with which such consent was given", how to exercise their rights, and how to complain to the Data Protection Board.

For a product team this means a short, specific consent screen rather than a link to a 20-page privacy policy, and a withdraw option as easy to find as the original checkbox.

2. Put reasonable security safeguards in place

Rule 6 lists the minimum. You must protect personal data in your possession, including data processed for you by a Data Processor, with:

• encryption, obfuscation, masking or tokenisation;
• access control on the systems that hold it;
• logs, monitoring and review so you can detect, investigate and fix unauthorised access;
• measures to keep operating if data is lost or corrupted, "such as by way of data-backups";
• retention of those logs and personal data for one year, unless another law requires otherwise;
• contract terms with Data Processors that require reasonable security safeguards; and
• appropriate technical and organisational measures to make all of this effective.

The penalties make this the most important section for small businesses. According to the Government's explanatory note, failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, the highest in the Act.

3. Report personal data breaches twice

Rule 7 requires two kinds of notice when you become aware of a breach:

• To each affected person, without delay, through their account or a registered contact method: what happened, the likely consequences for them, what you are doing about it, what they can do to protect themselves, and who they can contact.
• To the Data Protection Board: a description without delay, then within 72 hours of becoming aware (or a longer period the Board allows on written request) a detailed report covering the facts, the causes, mitigation, any findings about who caused it, remedial measures and the notices sent to affected people.

The explanatory note says failing to notify the Board or affected individuals can attract a penalty of up to ₹200 crore. If you are a company, remember that CERT-In's separate 2022 directions already require reporting specified cyber incidents to CERT-In within six hours; the two duties run in parallel.

4. Keep processing logs for at least a year, then erase

Rule 8(3) requires every Data Fiduciary to retain personal data, associated traffic data and processing logs for at least one year from the date of processing, for the purposes in the Seventh Schedule, and then erase them unless another law requires longer. The Rules give an e-commerce illustration: after a customer buys an e-book, the platform must keep the order details and logs (order confirmation, payment and delivery events) for at least one year from the transaction, even if the customer deletes the account. A second illustration says a business using a cloud provider must ensure the provider also keeps data and logs for at least a year.

Separate erasure deadlines in the Third Schedule apply to very large platforms: e-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh. They must erase inactive users' data after three years, with 48 hours' warning. Most small businesses fall below those thresholds, but the "one year minimum" in Rule 8(3) applies to everyone.

5. Publish a contact and answer rights requests

Rule 9 requires you to publish, prominently on your website or app, the business contact details of your Data Protection Officer (if you have one) or of a person who can answer questions about your processing. People can ask to access, correct, update or erase their data and can nominate someone to act for them. Rule 14 requires you to publish the time within which you will respond to grievances, not exceeding ninety days, and to put measures in place to meet it.

6. Get verifiable parental consent for children

Rule 10 requires verifiable consent from a parent before processing a child's personal data, with due diligence to check that the person giving consent is an identifiable adult. The Government's note mentions exemptions for essential services such as healthcare, education and real-time safety. If children can sign up for your product, this is a design change, not a policy paragraph.

A practical plan for the next 18 months

Quarter	Work	Output
Now	Data inventory: what personal data you collect, where it is stored, which processors touch it, and why	A one-page data map
Next quarter	Remove data you do not need; set retention periods; check processor contracts for security and retention clauses	Shorter data map; updated contracts
Following quarter	Security baseline: encryption at rest, access reviews, centralised logs kept for a year, tested backups	Evidence you can show the Board
Before end of 2026	Rewrite consent notices and withdraw flows; add a rights-request form and a published contact	Updated sign-up and settings screens
Early 2027	Breach runbook: who decides, who notifies people, who files with the Board and CERT-In, templates ready	A tested tabletop exercise
By 13 May 2027	Final review against Rules 3 and 5 to 16	Sign-off by the owner or board

Notes for developers and agencies

If you build software for clients, you are often the Data Processor, and your client is the Data Fiduciary. Expect clients to ask for contract clauses on security safeguards and log retention, because Rule 6(1)(f) requires them to have those clauses. Building the following into your standard delivery will save time:

• Audit logging of access to personal data, stored for at least a year and protected from tampering.
• Field-level encryption or masking for sensitive fields, and no personal data in application logs that do not need it.
• Consent records that store which notice version a person accepted, when, and how they can withdraw.
• Export and erasure functions for rights requests, with the one-year log retention handled separately from account deletion.
• A documented restore procedure, because the Rules name backups as a safeguard.

Rule 15 also deals with transferring personal data outside India; read it and any later Government orders if your stack uses overseas hosting or processors.

Summary

The DPDP Rules, 2025 turn India's 2023 data protection law into concrete duties: specific consent notices, minimum security safeguards including logs and backups, a 72-hour detailed breach report to the Data Protection Board, one-year retention of processing logs, a published contact, and a grievance response time of no more than ninety days. Most of these apply from 13 May 2027. Start with a data inventory, delete what you do not need, and build security and consent into the product now, while there is time to do it properly.