What do the DPDP Act and the DPDP Rules, 2025 require of an Indian business?
By Ajaj Mohammad Qureshi · Published · 6 min read
Not legal, tax or investment advice.
The Digital Personal Data Protection Act, 2023 governs how businesses handle digital personal data in India. Its Rules were published in the Gazette dated 13 November 2025 and come in three stages: the Data Protection Board at once, consent managers after one year, and the main duties — notice, consent, security, breach reports — after eighteen months, in May 2027. Data of people outside India, processed under a contract with a foreign client, is largely exempt, but security duties still apply.
Indian exporter or freelancer? Payzoplus gets you paid from abroad, in rupees.Open a free account →
On this page
What is the DPDP Act, and does it apply to you?
The Digital Personal Data Protection Act, 2023 received the President’s assent on 11 August 2023. It applies to the processing of digital personal data in India — data collected in digital form, or collected on paper and digitised later. It also reaches processing outside India when it is connected with offering goods or services to people in India. Personal data an individual handles for purely personal or domestic purposes is outside it.
In the Act’s words, the business deciding why and how data is processed is the Data Fiduciary; the person the data is about is the Data Principal; anyone processing it on the fiduciary’s behalf — a cloud host, a payroll firm, a CRM — is a Data Processor. Almost every business with customers, staff or leads is a data fiduciary for some data.
When do the DPDP Rules come into force?
The Digital Personal Data Protection Rules, 2025 were published as G.S.R. 846(E) in the Gazette of India dated 13 November 2025. The government’s own backgrounder (PIB, 17 November 2025) describes them as notified on 14 November 2025 after 6,915 consultation inputs. Rule 1 sets three dates, each counted from publication:
How the DPDP Rules phase in
11 Aug 2023
DPDP Act enacted
Assent of the President
13 Nov 2025
Rules published; Board provisions live
Rules 1, 2 and 17–21: definitions and the Data Protection Board
Nov 2026
One year: consent managers
Rule 4 — registration and duties of Consent Managers
May 2027
Eighteen months: the main duties
Rules 3 and 5–16, 22, 23 — notice, security, breach intimation, retention, children’s data, rights
What will you have to do by May 2027?
| Duty | What the Rules say | In practice |
|---|---|---|
| Notice (rule 3) | A notice understandable on its own, with an itemised description of the data and the specific purpose, and how to withdraw consent, exercise rights and complain to the Board | One clear notice per sign-up or form, not a link to a long privacy policy |
| Consent | Free, specific, informed, unconditional and unambiguous; withdrawal as easy as giving it | Unticked boxes; a working “withdraw” route |
| Security (rule 6) | Reasonable safeguards, at minimum encryption, masking or tokens; access control; logs and monitoring; backups; a contract with each processor | Turn on encryption and 2FA, restrict who sees client data, sign data terms with vendors |
| Breach intimation (rule 7) | Tell each affected person without delay; tell the Board without delay, and give a detailed report within 72 hours | A written incident plan with names against each step |
| Retention (rule 8) | Erase data once the purpose is served unless a law requires keeping it; keep processing logs for at least one year | A retention schedule per type of data |
| Contact point (rule 9) | Publish the business contact of a person who can answer questions about processing | A named privacy contact on the website |
| Rights | Access, correction, updating and erasure, and nominating someone to act; requests answered within 90 days | A simple request form and a log of responses |
| Children | Verifiable consent of a parent or guardian, with limited exceptions | Age checks if children can use your service |
How does breach notification work?
Rule 7 has two audiences. Affected people must be told, in a concise, clear and plain manner and without delay, what happened, the likely consequences for them, what you are doing about it, what they can do to protect themselves, and who to contact. The Data Protection Board must get a description of the breach without delay, and then, within 72 hours of your becoming aware of it (or a longer period the Board allows on a written request), a detailed report: the facts and causes, mitigation, any findings about who caused it, steps to prevent a repeat, and a report on the messages sent to the people affected.
A breach response under rule 7
- 1
Contain
Stop the leak: revoke access, rotate passwords and keys, isolate the system.
- 2
Tell the Board
A description without delay: nature, extent, timing, location, likely impact.
- 3
Tell the people affected
Without delay, in plain language, with what they should do and who to contact.
- 4
Detailed report within 72 hours
Causes, mitigation, who caused it if known, prevention, and a report on the intimations sent.
- 5
Fix and record
Remedy the cause and keep the logs; the Rules ask for them to be retained.
Are exporters with only foreign clients exempt?
Partly. Section 17(1)(d) of the Act switches off most of Chapter II (the fiduciary’s duties), all of Chapter III (the individual’s rights) and section 16 (transfers abroad) where personal data of people not in India is processed under a contract with a person outside India by a person based in India. That is the usual position of an Indian BPO, IT or design firm handling a foreign client’s customer data.
Two duties stay even then: section 8(1), that the fiduciary is responsible for compliance, and section 8(5), reasonable security safeguards to prevent a breach. A failure of security safeguards carries the Act’s highest penalty. And the exemption covers only that data. Your Indian staff, Indian clients, website visitors in India and any leads you collect in India are covered in full. Your foreign client may also hold you to its own law, such as the EU’s GDPR, through the contract.
What are the penalties?
| Breach of | Penalty up to |
|---|---|
| Reasonable security safeguards (section 8(5)) | ₹250 crore |
| Intimating the Board or affected people of a breach (section 8(6)) | ₹200 crore |
| Additional obligations for children (section 9) | ₹200 crore |
| Any other provision of the Act or Rules by a fiduciary | ₹50 crore |
These are maximums in the Act’s schedule. The Board decides the amount in each case, having regard to factors the Act lists, such as the nature, gravity and duration of the breach.
A short checklist for a small business
- Map your data. What personal data you hold, about whom, where it sits, and which vendors touch it.
- Split Indian and foreign data. Know which data the section 17(1)(d) exemption covers and which it does not.
- Rewrite notices and forms to the rule 3 standard before May 2027.
- Sign processor terms with every vendor holding personal data for you.
- Write a breach plan that can meet a 72-hour report.
- Set retention periods, keeping what tax, GST and FEMA records need, and deleting the rest on schedule.
- Name a contact and publish it.
Payment records are a case where other laws require you to keep data: invoices, remittance advices and GST records have their own retention periods, and rule 8 allows retention needed to comply with another law.
How Payzoplus helps you
How Payzoplus keeps your export paperwork in order
- The purpose code is checked when you raise the invoice, not discovered at the bank later.
- The bank’s FIRA for every settlement, with our remittance advice beside it: invoice, remitter, purpose code and rate.
- Every payment arrives already matched to the customer who sent it, so reconciling is one step, not a hunt.
- Money is held by our RBI-authorised payment partner and settled to your bank, never by us.
No setup fee · No monthly fee · Verification usually takes one working day
Frequently asked questions
When were the DPDP Rules notified?
They were published as G.S.R. 846(E) in the Gazette of India dated 13 November 2025; PIB’s backgrounder gives 14 November 2025 as the notification date. They phase in over eighteen months.
When do DPDP obligations like consent and breach notification start?
Eighteen months after the Rules were published, in May 2027. Rule 4 on Consent Managers applies after one year, in November 2026. The Data Protection Board provisions applied from publication.
What is the DPDP breach notification deadline?
Tell affected people and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer on a written request.
Does the DPDP Act apply to an Indian company processing a foreign client’s customer data?
Mostly not. Section 17(1)(d) exempts processing of data of people outside India under a contract with a person outside India, except the duties to be responsible for compliance and to keep reasonable security safeguards.
Sources
The primary texts this article was checked against, on 30 October 2026.
- MeitY — Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India dated 13 November 2025
- MeitY — The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- PIB — DPDP Rules, 2025 Notified: backgrounder, 17 November 2025
- eGazette — Digital Personal Data Protection Rules, 2025 (Gazette of India, Extraordinary)
General information, not tax, legal or investment advice. Rules and products change: confirm the details for your business with your CA, your bank or the regulator.
How useful was this article?
Be the first to rate it.
Comments
Be kind and stay on topic. Comments with links or contact details are checked before they appear.