Writ Petition Article 2026 Guide
When a government department cancels a licence, blacklists a supplier or refuses a statutory approval, the affected business often asks...
Read More →
India's data protection regime is no longer a future event. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and they are coming into force in three stages. Most of the obligations that matter to ordinary businesses apply from 13 May 2027. That sounds distant, but building compliant notices, consent records and breach procedures takes months, not weeks.
India's data protection regime is no longer a future event. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and they are coming into force in three stages. Most of the obligations that matter to ordinary businesses apply from 13 May 2027. That sounds distant, but building compliant notices, consent records and breach procedures takes months, not weeks.
| Date | What comes into force | Who it affects |
|---|---|---|
| 13th November 2025 | Definitions and Data Protection Board of India | The Regulator; no new duties for most businesses |
| 13th November 2025 | Rule 4: Registration and Obligiations of Consent Managers | Organizations that want to operate as Consent Managers |
| 13th May 2027 | The Substantative rules: notice, security safeguards, breach intimation, retention, children's data, rights and cross-border transfers | Every Data Fiduciary |
The November 2026 date is widely misread as a universal deadline. It is not: unless you intend to register as a Consent Manager, nothing new is required of you on that day. The real deadline is May 2027. Penalties under the Act, which can reach ₹250 crore for some breaches, become enforceable from then.
One caution: in January 2026 the Ministry of Electronics and Information Technology was reported to have proposed shortening the timeline for Significant Data Fiduciaries from 18 to 12 months. Large-volume processors should check for any notification before assuming May 2027 applies to them.
1. A map of your personal data. List every point where you collect personal data — website forms, apps, HR records, vendor systems — and the purpose for each. Every later step depends on this map.
2. Notices that stand on their own. The Rules require a notice that is clear and understandable independently of other information, and that sets out the data collected, the specific purpose and how consent can be withdrawn or a complaint made.
3. Consent that can be withdrawn as easily as it was given. Review every consent flow. If a customer can agree in one click, wi2. Notices that stand on their own. The Rules require a notice that is clear and understandable independently of other information, and that sets out the data collected, the specific purpose and how consent can be withdrawn or a complaint made.thdrawal cannot require an email chain.
4. Security safeguards you can evidence. Encryption or masking, access controls, logging and monitoring, and backups are expected, along with contractual safeguards with your processors.
5. A breach response that runs on a clock. A personal data breach must be intimated to affected individuals and to the Board, with a detailed report to the Board within 72 hours. Rehearse who decides, who drafts and who files before an incident tests it.
6. Retention and deletion schedules. Personal data should not be kept after its purpose is served. Decide retention periods by category and build deletion into your systems.
7. A route for rights requests. Data principals can seek information, correction and erasure, and can nominate another person. Publish how to make a request, and train the people who will receive one.
Most businesses process personal data through vendors — cloud hosts, CRMs, payroll providers, marketing tools. Your obligations do not transfer to them. Processor agreements should cover security, breach notification to you, sub-processing and deletion at the end of the engagement. Reviewing these contracts early avoids renegotiating dozens of them under deadline pressure.
Begin with the data map and a gap assessment against the Rules. Together they turn a broad legal obligation into a costed list of changes to notices, systems and contracts, with owners and dates.
This article is for general information only and is not legal advice.
