India’s Digital Personal Data Protection Rules were notified on 13 November 2025, putting the Digital Personal Data Protection Act, 2023 on a working timetable. The Rules come into force in three phases, and the one that matters most to security teams arrives in May 2027, 18 months after notification. That is when the duty to take reasonable security safeguards, the breach-reporting rules and the penalties all begin.
Eighteen months sounds generous. It is not, if you still need to find where personal data lives, change how long you keep logs, rewrite processor contracts and rehearse a breach response that runs on three different clocks.
The timeline
| When | What starts |
|---|---|
| 13 November 2025 | Rules notified. Provisions setting up the Data Protection Board and other preliminary rules take effect. |
| November 2026 | Registration of Consent Managers (12 months after notification). |
| May 2027 | Notice and consent, security safeguards, breach reporting, Significant Data Fiduciary duties, data principal rights and the penalty provisions (18 months after notification). |
Watch one open item. In early 2026 MeitY discussed shortening the window for Significant Data Fiduciaries to 12 months, which would bring their obligations forward to November 2026. As of October 2026 that change had not been notified, but if your organisation could be designated a Significant Data Fiduciary, plan as if it might be.
What the Rules ask of security teams
The Act requires every Data Fiduciary to protect personal data with reasonable security safeguards to prevent a breach. The Rules turn that phrase into minimum measures, including:
- Securing personal data through encryption, obfuscation, masking or virtual tokens
- Controlling access to the computer resources that process it
- Visibility of access, through logs, monitoring and review
- Measures to keep processing going after a compromise, including backups
- Keeping logs and related data for at least one year, so that breaches can be detected, investigated and fixed
- Contract terms that require Data Processors to take appropriate safeguards too
None of this is new to a mature security programme. What is new is that it becomes a legal duty, with a penalty of up to ₹250 crore for failing to take reasonable security safeguards, and that you will need evidence each measure is in place and working.
Breach reporting: three clocks, not one
The Rules require you to report every personal data breach, whatever its size or likely harm. Affected Data Principals must be told without delay, in plain language, what happened, what it means for them and what they can do. The Data Protection Board must be told without delay, followed by a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer. Failing to notify a breach carries a penalty of up to ₹200 crore.
This sits alongside, not instead of, CERT-In’s 2022 directions, which require cyber incidents to be reported to CERT-In within six hours of being noticed. Your incident playbook therefore needs three clocks: CERT-In at six hours, the Board at 72 hours, and affected individuals as soon as possible.
Extra duties for Significant Data Fiduciaries
Organisations the government designates as Significant Data Fiduciaries, typically because of the volume or sensitivity of the data they process, must also appoint a Data Protection Officer based in India, carry out a Data Protection Impact Assessment and an independent data audit every 12 months, and check that the algorithmic software they use does not put data principals’ rights at risk.
A security checklist for the months ahead
- Map your personal data. Know which systems, SaaS tools, backups and processors hold personal data, and whose it is. You cannot protect, log or erase what you have not found.
- Close the encryption and masking gaps. Encrypt personal data at rest and in transit, and mask or tokenise it in test, analytics and support environments.
- Tighten access. Enforce multi-factor authentication and least privilege, review privileged accounts, and remove access that leavers and vendors no longer need.
- Fix log retention. Check how long your SIEM, cloud and application logs are really kept. Defaults are often much shorter than a year: AWS CloudTrail event history and the Azure activity log keep 90 days.
- Test your backups. Restore from backup on a schedule and record the result. A backup you have never restored is not a continuity measure.
- Update processor contracts. Add security, breach-notification and deletion clauses to every contract with a vendor that handles personal data for you.
- Rehearse the breach. Run a tabletop exercise against the three clocks, with legal, communications and leadership in the room.
- Prove it works. Commission a VAPT and a gap assessment against the Rules, fix what they find, and keep the evidence in one place.
What an auditor will ask to see
| Requirement | Evidence to prepare |
|---|---|
| Encryption and masking | Data inventory with encryption status, key management procedure, masking in non-production |
| Access control | Access policy, MFA coverage report, periodic access reviews |
| Logging and monitoring | List of log sources, retention settings showing at least one year, alert and review records |
| Continuity | Backup schedule, restore test results, continuity plan |
| Processor safeguards | Signed contracts with security and breach clauses, vendor assessments |
| Breach readiness | Incident response plan with the notification steps, tabletop exercise report |
How we can help
Our GDPR and DPDP Act audit measures your current controls against the Act and the Rules, and our VAPT and configuration reviews produce the technical evidence that your safeguards work. See the full range of governance, risk and compliance services.
This article is general information about the DPDP Act and Rules, not legal advice. Check the obligations that apply to your organisation with your legal counsel.
