DPDP Rules, 2025: what a small or mid-sized business must do, and by when

The Digital Personal Data Protection Act, 2023 (the Act) was passed in August 2023. Its provisions are being brought into force in phases by notification G.S.R. 843(E) of 13 November 2025, issued the same day as the Digital Personal Data Protection Rules, 2025 (the Rules, G.S.R. 846(E)). The obligations are being phased in. Most of what a business must actually do applies from 13 May 2027. This note, written as on 28 October 2026, explains what that means for small and mid-sized businesses, whatever their age or size.

Is your business a "Data Fiduciary"?

A Data Fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data (s. 2(i), DPDP Act). There is no turnover or headcount threshold. The Act covers personal data processed in digital form, and also data collected on paper and later digitised (s. 3(a), DPDP Act). A business that keeps a customer list in billing software or runs staff payroll is a Data Fiduciary for that data.

Purely personal or domestic processing by an individual falls outside the Act (s. 3(c)(i), DPDP Act). Some of the heavier duties, such as the data protection officer, the independent audit and the impact assessment, apply only to entities the government notifies as Significant Data Fiduciaries (s. 10, DPDP Act; Rule 13, DPDP Rules). A typical small business is unlikely to be one.

The timeline

Date	What commences	Source
13 November 2025	Definitions, the Data Protection Board and its procedure, rule-making and related general provisions (ss. 1(2), 2, 18–26, 35, 38–43, 44(1) and (3) of the Act); Rules 1, 2 and 17–21	G.S.R. 843(E); Rule 1(2)
13 November 2026	Registration of Consent Managers (s. 6(9) and s. 27(1)(d) of the Act; Rule 4)	G.S.R. 843(E); Rule 1(3)
13 May 2027	All core duties: notice, consent, legitimate uses, security, breach intimation, erasure, children's data, rights, grievances, penalties (ss. 3–5, 6(1)–(8) and (10), 7–17, 27 (except 27(1)(d)), 28–34, 36, 37 and 44(2) of the Act); Rules 3, 5–16, 22 and 23	G.S.R. 843(E); Rule 1(4)

The commencement notification (G.S.R. 843(E)) and Rule 1(4) of the Rules both count eighteen months from publication in the Gazette on 13 November 2025 (Rule 1(4) as corrected by corrigendum G.S.R. 892(E) dated 10 December 2025). Both point to 13 May 2027.

Notice before consent

Every request for consent must come with, or after, a notice. The notice must state the personal data being collected, the purpose, how the person can exercise their rights, and how they can complain to the Board (s. 5(1), DPDP Act). Under the Rules, the notice must make sense on its own, without reference to any other information. It must be in clear and plain language, with an itemised description of the data and the specific purposes. It must also give a means to withdraw consent that is as easy as giving it (Rule 3, DPDP Rules). The person must be given the option to read the notice in English or in any language in the Eighth Schedule to the Constitution (s. 5(3), DPDP Act). Where consent was taken before commencement, a notice must be sent as soon as reasonably practicable (s. 5(2), DPDP Act).

Consent, legitimate uses and Consent Managers

Consent must be free, specific, informed, unconditional and unambiguous. It must be given by a clear affirmative action and limited to the data necessary for the purpose (s. 6(1), DPDP Act). Withdrawal must be as easy as giving consent (s. 6(4), DPDP Act). If a dispute arises, the business must prove that notice was given and consent obtained (s. 6(10), DPDP Act).

Some processing does not need consent. Examples include data a person gives voluntarily for a specified purpose without objecting to its use, and processing for employment purposes (s. 7(a) and (i), DPDP Act). The second covers most staff records.

A Consent Manager is a Board-registered entity through which people can give, manage, review and withdraw consent (s. 6(7)–(9), DPDP Act). It must be a company incorporated in India and meet the conditions in the First Schedule (Rule 4, DPDP Rules).

Reasonable security safeguards

A Data Fiduciary must protect personal data in its possession or control, including data handled by its processors, by taking reasonable security safeguards (s. 8(5), DPDP Act). At a minimum, the Rules require:

• encryption, obfuscation, masking or virtual tokens;
• access controls;
• logs and monitoring to detect unauthorised access;
• backups and continuity measures;
• keeping logs and personal data for one year, unless another law requires otherwise;
• suitable security clauses in contracts with Data Processors;
• technical and organisational measures to make all of the above effective.

(Rule 6(1)(a)–(g), DPDP Rules.)

Personal data breach

A breach must be intimated to the Board and to each affected person (s. 8(6), DPDP Act). The affected person must be told without delay, in plain language: what happened, the likely consequences, the mitigation steps taken, the steps they can take to protect themselves, and a contact person (Rule 7(1), DPDP Rules). The Board must be told without delay. A detailed report on facts, causes, remedial action and the notices sent must follow within 72 hours of becoming aware, or within any longer period the Board allows (Rule 7(2), DPDP Rules).

Retention and erasure

Personal data must be erased once consent is withdrawn or the purpose is no longer served, unless the law requires it to be kept (s. 8(7), DPDP Act). Processors must be made to erase it as well. The Third Schedule sets a fixed erasure period of three years from the date the person last approached the business for the specified purpose or exercised a right, or from the commencement of the Rules, whichever is latest (data needed to access the user account or stored virtual tokens excluded), with at least 48 hours' notice before erasure (Rule 8(1)–(2), DPDP Rules). It covers only three classes:

• e-commerce entities with at least two crore registered users in India;
• online gaming intermediaries with at least fifty lakh registered users in India;
• social media intermediaries with at least two crore registered users in India.

(Rule 8(1)–(2) and Third Schedule, DPDP Rules.) Most small businesses fall outside these classes, but the general duty in s. 8(7) still applies.

Separately, every Data Fiduciary must keep the relevant personal data, associated traffic data and processing logs for at least one year from processing, for the State purposes listed in the Seventh Schedule (Rule 8(3), DPDP Rules).

Children's data

A "child" is anyone under 18 (s. 2(f), DPDP Act). Before processing a child's data, the business must obtain verifiable consent from a parent or lawful guardian (s. 9(1), DPDP Act; Rule 10, DPDP Rules). Tracking, behavioural monitoring and targeted advertising directed at children are prohibited (s. 9(3), DPDP Act). Limited exemptions exist for, among others, educational institutions and crèches, and only to the extent necessary (Rule 12 and Fourth Schedule, DPDP Rules).

Processors, contact point and grievances

A vendor such as a payroll provider, CRM or cloud host may process data only under a valid contract (s. 8(2), DPDP Act). The business remains responsible for compliance whatever the contract says (s. 8(1), DPDP Act). The business must publish the contact details of a person who can answer questions about its processing (s. 8(9), DPDP Act; Rule 9, DPDP Rules). It must also run an effective grievance mechanism (s. 8(10) and s. 13, DPDP Act), publish how it works, and respond within a reasonable period not exceeding ninety days (Rule 14(3), DPDP Rules).

Penalties

Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Failure to intimate a breach, or a breach of the children's-data duties, can attract up to ₹200 crore each. Any other breach of the Act or Rules can attract up to ₹50 crore (Schedule, items 1, 2, 3 and 7, DPDP Act).

The government may notify certain Data Fiduciaries, including startups, to whom the notice duty (s. 5), the accuracy and erasure duties (s. 8(3) and (7)) and the duties of Significant Data Fiduciaries and the right of access (ss. 10 and 11) will not apply (s. 17(3), DPDP Act). Even a notified startup would remain bound by the security and breach-intimation duties in s. 8(5) and (6), which carry the two highest penalties. A business that hopes to rely on an exemption should first confirm that a notification under s. 17(3) actually covers it.

A practical sequence

1. Map what personal data you hold, where it sits, and who outside the business touches it.
2. For each use, record whether it rests on consent or on a legitimate use under s. 7.
3. Draft Rule 3-compliant notices and build a withdrawal route.
4. Put written contracts, with security and erasure clauses, in place with every processor.
5. Implement the Rule 6 controls and one-year log retention.
6. Write a breach-response plan built around the 72-hour report.
7. Fix retention periods and an erasure routine.
8. Publish the contact person and the grievance process.
9. Test all of the above well before 13 May 2027.

Author’s view

Awareness of what the DPDP Act will ask of small and mid-sized businesses appears limited. Those who are aware are worried about how to put it into practice: what a consent notice should say, which words to use, and how to manage the data once it has been collected.

Given the 13 May 2027 date, early planning is sensible. Three steps would put any business on firm ground before 13 May 2027:

• an inventory of the personal data it holds, why it holds it, where it sits and which vendors handle it;
• a clear notice, a simple way to withdraw consent, and written contracts with every vendor;
• basic security measures together with a one-page breach plan.

The burden is heaviest for established businesses. A firm that has run for thirty or forty years, with fifty or more employees, carries decades of customer and staff records, and the Act applies to that legacy data too.

Employers should be careful about resting staff records on consent alone, since consent can be withdrawn at any time (s. 6(4)). The Act already permits processing for employment purposes (s. 7(i)), and consent is better kept for anything beyond that.

A breach can trigger two clocks: six hours for reporting to CERT-In, and seventy-two hours for the detailed report to the Board. A business is best served by one incident plan that starts both clocks at the same moment.

Finally, the maximum penalties of up to ₹250 crore are, in my view, too high for small businesses. The Board must weigh proportionality and the impact on the business (s. 33(2)), but SMEs deserve clearer guidance on how that will work.

Adv. Gurleen Kaur

Sources

• Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India (Extraordinary), 13 November 2025 (e-Gazette) ↗
• The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), India Code text with commencement footnote citing G.S.R. 843(E) dated 13 Nov 2025 ↗
• Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) dated 13 Nov 2025 (bilingual Gazette copy hosted by MeitY) ↗
• Corrigenda to the DPDP Rules, 2025, G.S.R. 892(E) dated 10 Dec 2025 (MeitY) ↗
• PIB press release, "Government notifies DPDP Rules", 14 Nov 2025 ↗
• PIB backgrounder on DPDP Rules, 17 Nov 2025 ↗
• PIB press note on DPDP Rules, 17 Nov 2025 ↗

Data privacy & cybersecurity ↗