India's data protection law, the Digital Personal Data Protection Act, 2023 (DPDP Act), puts its largest penalty, up to 250 crore rupees, on a single failure: not taking reasonable security safeguards to prevent a personal data breach. The DPDP Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025, give that duty concrete minimums and start an eighteen-month phased compliance period that ends in May 2027. The Act reaches organisations outside India that offer goods or services to people in India, so it matters to global SaaS, fintech, e-commerce and outsourcing firms as much as to Indian companies. This guide covers scope, consent, the Rule 6 safeguards, breach notification, retention, rights, significant data fiduciaries, transfers and penalties, for security, privacy and engineering teams turning the text into controls.
Key takeaways
- The clock is running. Consent manager registration starts on 13 November 2026, and the main obligations in Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027.
- Security is the costliest failure. Section 8(5) requires reasonable security safeguards, Rule 6 lists the minimum (encryption or tokenisation, access control, logging, backups, one-year log retention, processor contracts), and the Schedule sets up to 250 crore rupees.
- Two breach notices, no threshold. Every personal data breach goes to affected data principals without delay and to the Data Protection Board without delay, with a detailed report within 72 hours.
- Consent is narrow and must be reversible. Consent must be "free, specific, informed, unconditional and unambiguous", backed by an itemised notice, and as easy to withdraw as to give.
- Significant data fiduciaries do more. Notified SDFs need a DPO based in India, an independent data auditor, an annual DPIA and audit, algorithmic due diligence, and may face localisation for specified data.
Scope and the key roles
The Act applies to digital personal data processed in India, and to processing outside India "in connection with any activity related to offering of goods or services to Data Principals" in India (s.3). Personal data collected offline and later digitised is in scope once digitised. It does not apply to processing for personal or domestic purposes, or to personal data made publicly available by the data principal or under a legal obligation.
| Role | Definition | Main duties |
|---|---|---|
| Data fiduciary | A person who alone or with others "determines the purpose and means of processing" (s.2(i)) | Lawful ground, notice, security safeguards, breach notice, erasure, grievance redressal, accountability for processors (s.8) |
| Data principal | "the individual to whom the personal data relates"; for a child, includes the parents or lawful guardian (s.2(j)) | Holds rights (ss.11 to 14) and duties (s.15) |
| Data processor | Processes personal data on behalf of a data fiduciary (s.2(k)) | Bound by contract; the fiduciary stays responsible (s.8(1), s.8(5)) |
| Consent manager | Registered with the Board, acting as a single point of contact for data principals to give, manage, review and withdraw consent (s.2(g)) | Registration and obligations under Rule 4 and the First Schedule |
| Significant data fiduciary (SDF) | A fiduciary or class notified by the Central Government, considering volume and sensitivity of data, risk to rights, and risks to sovereignty, electoral democracy, security and public order (s.10(1)) | DPO, independent auditor, DPIA and audit (s.10(2), Rule 13) |
| Data Protection Board of India | Body corporate established under s.18; PIB describes it as a fully digital institution | Receives breach intimations and complaints, registers consent managers, imposes penalties |
A child is anyone under 18 (s.2(f)). There is no separate category of sensitive personal data; sensitivity matters through SDF designation and the reasonableness of safeguards. Section 17 exempts some processing, including enforcement of legal claims, courts, prevention and investigation of offences, certain processing of non-residents' data under foreign contracts, mergers and loan default checks, and research or statistics not used for decisions about an individual.
Commencement: the DPDP Rules 2025 timeline
The Rules were published as G.S.R. 846(E), dated 13 November 2025. Rule 1 phases them in.
| When | Rules | What it means |
|---|---|---|
| 13 November 2025 (on publication) | Rules 1, 2 and 17 to 21 | Definitions, and appointment, service terms and digital functioning of the Board |
| 13 November 2026 (one year after) | Rule 4 | Registration and obligations of consent managers |
| 13 May 2027 (eighteen months after) | Rules 3, 5 to 16, 22 and 23 | Notice, security safeguards, breach intimation, retention, children, SDFs, rights, cross-border transfer, research exemption, appeals and calls for information |
MeitY consulted industry in early 2026 on shortening the eighteen-month period. Check the Gazette for any amendment before planning to the May 2027 date.
Consent, notice and consent managers
- Grounds (s.4): processing needs either consent or one of the legitimate uses in s.7, such as data the principal voluntarily provided for a specified purpose, State benefits, legal obligations, court orders, medical emergencies and disasters, and employment purposes.
- Consent standard (s.6(1)): "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the personal data necessary for the specified purpose. Pre-ticked boxes and bundled consent fail.
- Notice (s.5, Rule 3): understandable on its own, with an itemised description of the personal data and the specific purposes, and links explaining how to withdraw consent, exercise rights and complain to the Board.
- Withdrawal (s.6(4)): as easy as giving consent. On withdrawal the fiduciary, and its processors, must stop processing within a reasonable time unless another lawful basis applies.
- Consent managers (s.6(7) to (9), Rule 4): must register with the Board, be Indian companies with a net worth of at least two crore rupees under the First Schedule, avoid conflicts of interest, and keep consent records for at least seven years.
Engineering consequence: consent has to be a stored, versioned record tied to purposes, readable by every system that processes the data, with withdrawal propagating to downstream processors. See the Consent Management Guide: Cookies, CMPs and GPC and the Identity Data Privacy and Consent Guide.
Children's data
Section 9 requires verifiable consent of a parent or lawful guardian and bars "tracking or behavioural monitoring of children or targeted advertising directed at children". Rule 10 requires checking that the person consenting is an identifiable adult, using reliable identity and age details already held, details provided voluntarily, or a virtual token from an authorised entity. Limited exemptions cover purposes such as healthcare, education and real-time safety. See the Age Assurance Guide.
Security safeguards: section 8(5) and Rule 6
Section 8(5) requires a data fiduciary to protect personal data in its possession or under its control, "including in respect of any processing undertaken by it or on its behalf by a Data Processor", by "taking reasonable security safeguards to prevent personal data breach". Rule 6 sets the minimum measures.
| Rule 6 | Minimum safeguard | Practical control | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| (a) | Encryption, obfuscation, masking or virtual tokens mapped to personal data | Encryption at rest and in transit, tokenisation of identifiers in analytics and test data | A.8.24, A.8.11 |
| (b) | Access control over computer resources used for processing | Role-based access, MFA for administrators, access reviews, removal of leavers and stale service accounts | A.5.15, A.5.18, A.8.5 |
| (c) | Visibility through logs, monitoring and review to detect unauthorised access, investigate it and prevent recurrence | Centralised logging of access to personal data stores, alerting on bulk reads | A.8.15, A.8.16 |
| (d) | Measures for continued processing after compromise, such as backups | Tested, protected backups and recovery plans | A.8.13, A.5.30 |
| (e) | Retaining logs and personal data for one year to detect and investigate breaches, unless other law requires otherwise | Log retention set to at least one year | A.8.15 |
| (f) | Contract terms with data processors to take reasonable safeguards | Data processing agreements with security schedules | A.5.19, A.5.20 |
| (g) | Technical and organisational measures to ensure safeguards are observed | Policy, ownership, testing and evidence | A.5.1, A.5.36 |
Where identity fits
Rule 6(b) and (c) are identity controls. Most large personal data exposures start with a credential: an over-privileged service account, a leaked API key, or a contractor login without MFA. Inventory human and non-human identities with access to personal data stores, scope each to the minimum, vault and rotate secrets, and log every access so you can answer the Board's 72-hour questions about cause and extent. The Indian Government breach shows how credentials left in exposed .git and .env files hand out that access. See the Secrets Management Guide.
Breach notification to the Data Protection Board
A personal data breach is "any unauthorised processing of personal data or accidental disclosure", acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability (s.2(u)). Section 8(6) requires intimation to the Board and to each affected data principal, and Rule 7 sets the form. There is no harm or volume threshold.
| Recipient | Timing | Content |
|---|---|---|
| Each affected data principal | Without delay, through their user account or registered contact | In concise, clear and plain language: nature, extent and timing of the breach, likely consequences, mitigation taken or proposed, safety steps the individual can take, and business contact details of a person who can answer questions |
| Board, initial intimation | Without delay on becoming aware | Description of the breach, including nature, extent, timing, location and likely impact |
| Board, detailed report | Within 72 hours of becoming aware, or a longer period the Board allows on written request | Updated and detailed information, broad facts on causes and circumstances, mitigation taken or proposed, findings on who caused the breach, remedial measures to prevent recurrence, and a report on intimations given to data principals |
Compared with GDPR Article 33, the Board is told even where the risk to individuals is low, and individuals are always told. Build one playbook that produces both notices from the same facts. See the Incident Response Guide.
Retention and erasure
- Purpose limits (s.8(7)): erase personal data, and have processors erase it, when consent is withdrawn or the specified purpose is no longer served, unless law requires retention.
- Inactivity periods (Rule 8, Third Schedule): e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh users and social media intermediaries with at least two crore users must erase personal data three years after the later of the data principal's last contact (for the specified purpose or to exercise rights) and the commencement of the Rules.
- Warning before erasure: tell the data principal at least 48 hours before erasure, and keep the data if they log in or make contact.
- Minimum retention: keep personal data, associated traffic data and logs of processing for at least one year for the purposes in the Seventh Schedule, which cover uses by the State under law and assessing whether a fiduciary should be notified as an SDF, unless another law requires longer.
The result is a floor and a ceiling: one year minimum for logs and traffic data, erasure once the purpose ends. Retention schedules, backups and log platforms all need to reflect both.
Data principal rights and grievance redressal
| Right | Section | What the fiduciary must provide |
|---|---|---|
| Access to information | s.11 | A summary of personal data processed and the processing activities, and the identities of other fiduciaries and processors it was shared with |
| Correction and erasure | s.12 | Correction, completion and updating; erasure unless retention is necessary for the purpose or required by law |
| Grievance redressal | s.13 | A readily available mechanism; the principal must exhaust it before going to the Board |
| Nomination | s.14 | Accept a nominee to exercise rights on death or incapacity |
Rule 14 requires the means of exercising rights to be published and grievances to be resolved within a period not exceeding ninety days. Rule 9 and s.8(9) require prominent business contact details of the DPO or a person who can answer questions. Data principals have duties too: s.15 prohibits false or frivolous complaints and impersonation, with a penalty of up to ten thousand rupees. See the DSAR Guide: Handling Data Subject Requests.
Significant data fiduciaries
Once notified as an SDF, a fiduciary must appoint a DPO based in India who reports to the board or similar body, appoint an independent data auditor, and carry out periodic DPIAs and audits (s.10(2)). Rule 13 makes the DPIA and audit annual, with a report of significant observations to the Board; requires due diligence that algorithmic software used for processing does not risk data principals' rights; and allows the Central Government, on a committee's recommendation, to require that specified personal data and its traffic data are not transferred outside India. See the DPIA Guide: Running a Data Protection Impact Assessment.
Cross-border transfer
The Act takes a negative-list approach. Section 16 lets the Central Government restrict, by notification, transfer of personal data "for processing" to countries or territories outside India; transfers elsewhere are permitted. Rule 15 adds that transfers must meet any requirements the Central Government specifies by general or special order for making data available to a foreign State or its entities. Stricter sectoral rules continue to apply, and SDFs may face the Rule 13 localisation directions above. Map where personal data, backups, logs and support access sit, so you can react if a destination is restricted. See the Data Mapping and ROPA Guide.
Penalties and enforcement
| Schedule item | Breach | Maximum penalty |
|---|---|---|
| 1 | Failure to take reasonable security safeguards (s.8(5)) | 250 crore rupees |
| 2 | Failure to notify the Board or affected data principals of a breach (s.8(6)) | 200 crore rupees |
| 3 | Breach of additional obligations for children (s.9) | 200 crore rupees |
| 4 | Breach of SDF obligations (s.10) | 150 crore rupees |
| 5 | Breach of data principal duties (s.15) | 10,000 rupees |
| 6 | Breach of a voluntary undertaking accepted by the Board (s.32) | Up to the penalty for the underlying breach |
| 7 | Any other breach of the Act or Rules | 50 crore rupees |
Under s.33 the Board may impose a penalty after an inquiry finds a significant breach, weighing factors such as nature, gravity and duration, the type of data, repetition, any gain or loss avoided, and mitigation. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The Act also omits section 43A of the Information Technology Act, 2000 (s.44(2)(a)).
A phased compliance plan to May 2027
- Confirm applicability. Identify digital personal data of people in India, including data processed abroad for Indian customers, and the legal entity acting as fiduciary for each processing activity.
- Map data and processors. Record purposes, grounds, systems, processors, transfer destinations and retention per activity.
- Rebuild notice and consent. Itemised Rule 3 notices, purpose-level consent records, withdrawal that propagates to processors. Pilot on one product, then roll out.
- Close Rule 6 gaps. Encryption or tokenisation, MFA and least privilege for human and non-human access to personal data stores, logging with one-year retention, tested backups. Change log retention in stages and confirm storage capacity before cutting over.
- Update processor contracts with Rule 6(f) safeguards, breach notice to you within hours rather than days, erasure on instruction and audit rights.
- Build the dual breach playbook and exercise it, timing the 72-hour Board report. See the Tabletop Exercise Guide.
- Set retention and erasure jobs, including the 48-hour warning where the Third Schedule applies, and test them on a copy before enabling deletion in production.
- Publish rights channels and the DPO contact, and track grievances against the ninety-day limit.
Decision guidance
- Consent or legitimate use: use s.7 grounds where they genuinely fit, such as employment or data voluntarily provided for a stated purpose; otherwise rely on consent and accept that it can be withdrawn.
- Own consent platform or consent manager: a registered consent manager suits ecosystems where principals share data across fiduciaries; most fiduciaries will still need their own consent records.
- GDPR programme reuse: records of processing, DPIAs, processor contracts and breach playbooks transfer well, but adjust for no harm threshold on breach notice, the narrower lawful grounds, the one-year log floor and the negative-list transfer model. See the GDPR Compliance Guide for Security Teams.
- Smaller fiduciaries: core duties have no size threshold; scale matters only for the Third Schedule and SDF duties.
Measuring readiness
- Consent coverage: percentage of consent-based processing activities with an itemised notice and a stored, purpose-level consent record.
- Withdrawal latency: time from withdrawal to processing stopping across all systems and processors.
- Privileged access to personal data: count of human and non-human identities with read access to bulk personal data, and percentage with MFA or vaulted credentials.
- Log retention compliance: percentage of in-scope systems retaining logs for at least one year.
- Breach exercise timing: hours from detection to Board detailed report in the last exercise, against 72.
- Grievance closure: percentage of grievances resolved within ninety days.
Framework mapping
| DPDP requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 |
|---|---|---|---|
| s.8(5), Rule 6(a) encryption and tokenisation | PR.DS-01, PR.DS-02 | SC-8, SC-28 | 3.10, 3.11 |
| Rule 6(b) access control | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-2 | 5, 6 |
| Rule 6(c) and (e) logging and retention | DE.CM-03, PR.PS-04 | AU-2, AU-6, AU-11 | 8 |
| Rule 6(d) continuity | RC.RP | CP-9, CP-10 | 11 |
| Rule 6(f) processors | GV.SC | SA-9, SR-6 | 15 |
| s.8(6), Rule 7 breach intimation | RS.CO | IR-6 | 17 |
| s.8(7), Rule 8 erasure | PR.DS | SI-12, MP-6 | 3.1, 3.4, 3.5 |
Common failure patterns
- Logs kept for 30 or 90 days: Rule 6(e) needs one year, and short retention also leaves you unable to describe a breach to the Board.
- Processor credentials outside your control: the fiduciary is answerable for processors. The Snowflake breach showed customer data taken through a platform's tenants using stolen credentials without MFA.
- Credential stuffing dismissed as "not a breach": unauthorised processing of accounts is notifiable with no threshold; the 23andMe breach shows how far it spreads.
- Erasure that misses backups and processors: s.8(7) reaches data processors too.
Practitioner checklist
- Record which entity is data fiduciary for each processing activity touching people in India.
- Replace generic privacy notices with itemised Rule 3 notices and purpose-level consent records.
- Implement Rule 6 safeguards: encryption or tokenisation, access control with MFA, logging, backups.
- Set log and processing data retention to at least one year, and erasure when purposes end.
- Inventory and right-size human and non-human identities with access to personal data stores.
- Update processor contracts for safeguards, breach notice, erasure and audit.
- Exercise the dual breach notice, including the 72-hour Board report.
- Publish rights and DPO contact details and track grievances against ninety days.
- Assess SDF likelihood and prepare a DPO in India, an auditor and an annual DPIA.
- Track the Gazette for amendments, transfer restrictions and SDF notifications.
Standards and references
- MeitY: The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- MeitY: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))
- PIB: Government notifies DPDP Rules to empower citizens and protect privacy
- PIB: DPDP Rules, 2025 Notified (backgrounder)
- PIB: DPDP Rules, 2025 Notified (PDF)
- MeitY: Filling up the post of Chairman and Members in the Data Protection Board of India
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · GDPR Compliance Guide for Security Teams · Privacy Programme Guide for Security Teams · Data Breach Notification Checklist · Secrets Management Guide. This guide summarises India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as of 18 October 2026, and is not legal advice.