Digital Personal Data Protection Act 2025

The DPDP act rules were notified on 13th Nov. DPD Act governs how organizations collect, use, store, and process personal data of individuals (“Data Principals”) in India.

DPDPA Implementation Timeline

Quick Reference Guide

Effective: November 13, 2025 (Notification Date)

• Data Protection Board of India established
• Board composition, qualifications & governance framework
• Rule-making powers activated
• No compliance obligations for organizations yet

PHASE 2: Consent Manager Ecosystem

• Consent Manager registration operational
• Technical & operational framework for consent management
• Optional for Data Fiduciaries
• Single point of contact for consent lifecycle

PHASE 3: Full Compliance & Enforcement

• All consent & notice requirements enforceable
• Security safeguards & breach notification mandatory
• Children’s data protection requirements active
• Significant Data Fiduciary obligations active
• Grievance redressal requirements active
• Data Principal rights enforceable (access, correction, erasure)
• Cross-border transfer restrictions enforced

Want to know more, drop an email to with subject line “DPDP Awareness” and we will be pleased to host an awareness session for you with your management / stakeholders.

In terms of timelines for most of the provisions Govt gave 18 months lead time:

1. provisions relating to Data Protection Board will be in effect from November 13, 2025
2. provisions on Consent Manager will come into effect from Nov 13, 2026 (one year lead time
3. All other provisions will come into effect from May 13, 2027 (18 months lead time)

Penalties (per instance)